2022 CVEs (page 58)
Page 58 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47040 | High | 7.8 | 2023-01-26 | An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command after placing a cra… |
CVE-2022-46999 | Critical | 9.8 | 2023-01-26 | Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php. |
CVE-2022-46998 | Critical | 9.8 | 2023-01-26 | An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF). |
CVE-2022-46957 | Medium | 6.1 | 2023-01-26 | Sourcecodester.com Online Graduate Tracer System V 1.0.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-46624 | Medium | 6.1 | 2023-01-26 | A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payl… |
CVE-2022-46128 | Medium | 6.1 | 2023-01-26 | phpgurukul Doctor Appointment Management System V 1.0.0 is vulnerable to Cross Site Scripting (XSS) via searchdata=. |
CVE-2022-45920 | High | 7.5 | 2023-01-26 | In Softing uaToolkit Embedded before 1.41, a malformed CreateMonitoredItems request may cause a memory leak. |
CVE-2022-45820 | Critical | 9.1 | 2023-01-26 | SQL Injection (SQLi) vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. |
CVE-2022-45808 | Critical | 9.9 | 2023-01-26 | SQL Injection vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. |
CVE-2022-45730 | Medium | 6.1 | 2023-01-26 | A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2022-44297 | Critical | 9.8 | 2023-01-26 | SiteServer CMS 7.1.3 has a SQL injection vulnerability the background. |
CVE-2022-44018 | High | 7.5 | 2023-01-26 | In Softing uaToolkit Embedded before 1.40.1, a malformed PubSub discovery announcement message can cause a NULL pointer dereference or out-of-bounds memory acc… |
CVE-2022-43997 | High | 7.8 | 2023-01-26 | Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation. There is an insufficiently protected ha… |
CVE-2022-43917 | Medium | 5.9 | 2023-01-26 | IBM WebSphere Application Server 8.5 and 9.0 traditional container uses weaker than expected cryptographic keys that could allow an attacker to decrypt sensit… |
CVE-2022-43864 | High | 7.5 | 2023-01-26 | IBM Business Automation Workflow 22.0.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL re… |
CVE-2022-42330 | High | 7.5 | 2023-01-26 | Guests can cause Xenstore crash via soft reset When a guest issues a "Soft Reset" (e.g. for performing a kexec) the libxl based Xen toolstack will normally per… |
CVE-2022-41941 | Medium | 6.2 | 2023-01-26 | GLPI is a Free Asset and IT Management Software package. Versions 10.0.0 and above, prior to 10.0.6, are subject to Cross-site Scripting. An administrator may… |
CVE-2022-40037 | Critical | 9.8 | 2023-01-26 | An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component /upFile. |
CVE-2022-40036 | Medium | 6.5 | 2023-01-26 | An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing permission checks via the /adminGetUserLi… |
CVE-2022-40035 | High | 8.8 | 2023-01-26 | File Upload Vulnerability found in Rawchen Blog-ssm v1.0 allowing attackers to execute arbitrary commands and gain escalated privileges via the /uploadFileList… |
CVE-2022-3924 | High | 7.5 | 2023-01-26 | This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value… |
CVE-2022-3902 | Medium | 5.5 | 2023-01-26 | An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions star… |
CVE-2022-3820 | Medium | 6.5 | 2023-01-26 | An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct a… |
CVE-2022-3740 | Medium | 6.5 | 2023-01-26 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. A group… |
CVE-2022-3736 | High | 7.5 | 2023-01-26 | BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver r… |
CVE-2022-3572 | Critical | 9.3 | 2023-01-26 | A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5… |
CVE-2022-3488 | High | 7.5 | 2023-01-26 | Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND… |
CVE-2022-3482 | Medium | 5.3 | 2023-01-26 | An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allowed an un… |
CVE-2022-3478 | Medium | 4.3 | 2023-01-26 | An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions sta… |
CVE-2022-3432 | Medium | 6.7 | 2023-01-26 | A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may allow an attacker wit… |
CVE-2022-3094 | High | 7.5 | 2023-01-26 | Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free me… |
CVE-2022-38775 | High | 7.8 | 2023-01-26 | An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate their privileges to t… |
CVE-2022-38774 | High | 7.8 | 2023-01-26 | An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileged users to elevate… |
CVE-2022-38758 | High | 7.2 | 2023-01-26 | Cross-site Scripting (XSS) vulnerability in NetIQ iManager prior to version 3.2.6 allows attacker to execute malicious scripts on the user's browser. This issu… |
CVE-2022-34405 | High | 7.3 | 2023-01-26 | An improper access control vulnerability was identified in the Realtek audio driver. A local authenticated malicious user may potentially exploit this vulnerab… |
CVE-2022-31711 | Medium | 5.3 | 2023-01-26 | VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application informat… |
CVE-2022-31710 | High | 7.5 | 2023-01-26 | vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data wh… |
CVE-2022-31706 | Critical | 9.8 | 2023-01-26 | The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an imp… |
CVE-2022-31704 | Critical | 9.8 | 2023-01-26 | The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an… |
CVE-2022-29844 | Medium | 6.7 | 2023-01-26 | A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write ar… |
CVE-2022-29843 | Medium | 6.2 | 2023-01-26 | A command injection vulnerability in the DDNS service configuration of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows… |
CVE-2022-27508 | High | 7.5 | 2023-01-26 | Unauthenticated denial of service |
CVE-2022-27507 | Medium | 6.5 | 2023-01-26 | Authenticated denial of service |
CVE-2022-26329 | Low | 1.8 | 2023-01-26 | File existence disclosure vulnerability in NetIQ Identity Manager plugin prior to version 4.8.5 allows attacker to determine whether a file exists on the files… |
CVE-2022-25962 | High | 7.4 | 2023-01-26 | All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization. |
CVE-2022-25927 | Medium | 5.3 | 2023-01-26 | Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial of Service (ReDoS)… |
CVE-2022-25908 | High | 7.4 | 2023-01-26 | All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. |
CVE-2022-25894 | Critical | 9.8 | 2023-01-26 | All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jexl.createExpression… |
CVE-2022-25882 | High | 7.5 | 2023-01-26 | Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a path to the file whi… |
CVE-2022-25860 | High | 8.1 | 2023-01-26 | Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to… |
CVE-2022-25847 | Medium | 5.4 | 2023-01-26 | All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing… |
CVE-2022-25350 | High | 7.4 | 2023-01-26 | All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization. |
CVE-2022-22462 | Low | 3.7 | 2023-01-26 | IBM Security Verify Governance, Identity Manager virtual appliance component 10.0.1 uses weaker than expected cryptographic algorithms that could allow an att… |
CVE-2022-21810 | High | 7.4 | 2023-01-26 | All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization. |
CVE-2022-21192 | High | 7.5 | 2023-01-26 | All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protections employed to the… |
CVE-2022-20494 | Medium | 5.5 | 2023-01-26 | In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. This could lead to local denial of service with no… |
CVE-2022-20493 | High | 7.8 | 2023-01-26 | In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. This could lead to local escalation of p… |
CVE-2022-20492 | High | 7.8 | 2023-01-26 | In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local es… |
CVE-2022-20490 | High | 7.8 | 2023-01-26 | In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to loca… |
CVE-2022-20489 | High | 7.8 | 2023-01-26 | In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local es… |
CVE-2022-20461 | High | 7.8 | 2023-01-26 | In pinReplyNative of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible out of bounds read due to type confusion. This could lead to local… |
CVE-2022-20458 | Medium | 5.5 | 2023-01-26 | The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. StatusBarNotification.getKey() cou… |
CVE-2022-20456 | High | 7.8 | 2023-01-26 | In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This could lead to local… |
CVE-2022-20235 | Medium | 5.5 | 2023-01-26 | The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. This page can only be written by the GPU driver itself, but prior to… |
CVE-2022-20215 | Medium | 5.5 | 2023-01-26 | In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. This could lead to local denial of servic… |
CVE-2022-20214 | Medium | 4.7 | 2023-01-26 | In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. Attackers can overlay the toggle button to enable apps to… |
CVE-2022-20213 | Medium | 5.5 | 2023-01-26 | In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. This could lead to local denial of service w… |
CVE-2022-1892 | Medium | 6.7 | 2023-01-26 | A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code. |
CVE-2022-1891 | Medium | 6.7 | 2023-01-26 | A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code. |
CVE-2022-1890 | Medium | 6.7 | 2023-01-26 | A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitrary code. |
CVE-2022-42423 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42421 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42420 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42419 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42418 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42417 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42416 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42415 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42414 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42413 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42412 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42411 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42410 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42409 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42408 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42407 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42406 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42405 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42404 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42403 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42402 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42401 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42400 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42399 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42398 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42397 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-42396 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42395 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42394 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42393 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |