2022 CVEs (page 60)
Page 60 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-46959 | Medium | 4.3 | 2023-01-23 | An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal. |
CVE-2022-48281 | Medium | 5.5 | 2023-01-23 | processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image. |
CVE-2022-3918 | High | 8.8 | 2023-01-20 | A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers. In this vulnerability… |
CVE-2022-1109 | Medium | 5.5 | 2023-01-20 | An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service. |
CVE-2022-48279 | High | 7.5 | 2023-01-20 | In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is… |
CVE-2022-48152 | Critical | 9.8 | 2023-01-20 | SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicine… |
CVE-2022-48120 | Critical | 9.8 | 2023-01-20 | SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers… |
CVE-2022-47024 | High | 7.8 | 2023-01-20 | A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause den… |
CVE-2022-47021 | High | 7.8 | 2023-01-20 | A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause de… |
CVE-2022-47015 | Medium | 6.5 | 2023-01-20 | MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null… |
CVE-2022-47012 | High | 7.5 | 2023-01-20 | Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21. |
CVE-2022-45748 | High | 8.8 | 2023-01-20 | An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/AssetLib/Collada/Col… |
CVE-2022-45558 | Medium | 6.1 | 2023-01-20 | Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via the meta tag. |
CVE-2022-45557 | Medium | 6.1 | 2023-01-20 | Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names. |
CVE-2022-45542 | Medium | 5.4 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the FileManager component in GET parameter "filename" when editing any file. |
CVE-2022-45541 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-integer char. |
CVE-2022-45540 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-8 char. |
CVE-2022-45539 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in FileManager component in GET value "activepath" when creating a new file. |
CVE-2022-45538 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_GOBACK_URL". |
CVE-2022-45537 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_LIST_URL". |
CVE-2022-41733 | Medium | 5.3 | 2023-01-20 | IBM InfoSphere Information Server 11.7 could allow a remote attacked to cause some of the components to be unusable until the process is restarted. IBM X-Forc… |
CVE-2022-39193 | Medium | 5.3 | 2023-01-20 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer o… |
CVE-2022-35977 | Medium | 5.5 | 2023-01-20 | Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer… |
CVE-2022-38112 | High | 7.5 | 2023-01-20 | In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext. |
CVE-2022-38110 | Medium | 5.4 | 2023-01-20 | In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting. |
CVE-2022-47747 | High | 7.5 | 2023-01-20 | kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs. |
CVE-2022-47732 | High | 7.5 | 2023-01-20 | In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing… |
CVE-2022-43704 | Medium | 5.9 | 2023-01-20 | The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is pos… |
CVE-2022-25631 | High | 7.8 | 2023-01-20 | Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereb… |
CVE-2022-48126 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGene… |
CVE-2022-48125 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGene… |
CVE-2022-48124 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGene… |
CVE-2022-48123 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRul… |
CVE-2022-48122 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules… |
CVE-2022-48121 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules… |
CVE-2022-43959 | Medium | 4.9 | 2023-01-20 | Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP… |
CVE-2022-41441 | Medium | 6.1 | 2023-01-20 | Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2022-40267 | Medium | 5.9 | 2023-01-20 | Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=… |
CVE-2022-48191 | High | 7.0 | 2023-01-20 | A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known malicious executable to a specific location… |
CVE-2022-20967 | Medium | 4.8 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scr… |
CVE-2022-20966 | Medium | 5.4 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scr… |
CVE-2022-20965 | Medium | 4.3 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges action… |
CVE-2022-20964 | Medium | 6.3 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary comma… |
CVE-2022-46476 | Critical | 9.8 | 2023-01-19 | D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function. |
CVE-2022-31901 | Medium | 6.5 | 2023-01-19 | Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files. |
CVE-2022-47766 | High | 8.8 | 2023-01-19 | PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability. |
CVE-2022-46890 | Medium | 4.3 | 2023-01-19 | Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by… |
CVE-2022-46889 | Medium | 5.4 | 2023-01-19 | A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web scrip… |
CVE-2022-46888 | Medium | 6.1 | 2023-01-19 | Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the… |
CVE-2022-46887 | Critical | 9.8 | 2023-01-19 | Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeco… |
CVE-2022-47745 | High | 8.8 | 2023-01-19 | ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a special request and… |
CVE-2022-47740 | Critical | 9.8 | 2023-01-19 | Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php. |
CVE-2022-47197 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-47196 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-47195 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-47194 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-40697 | Medium | 4.8 | 2023-01-19 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions. |
CVE-2022-39167 | Medium | 5.9 | 2023-01-19 | IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle… |
CVE-2022-47105 | Critical | 9.8 | 2023-01-19 | Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData. |
CVE-2022-3738 | Medium | 5.9 | 2023-01-19 | The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like… |
CVE-2022-4892 | Low | 3.5 | 2023-01-19 | A vulnerability was found in MyCMS. It has been classified as problematic. This affects the function build_view of the file lib/gener/view.php of the component… |
CVE-2022-3085 | High | 7.8 | 2023-01-19 | Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbit… |
CVE-2022-4235 | Medium | 5.4 | 2023-01-18 | RushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible because the applica… |
CVE-2022-45927 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Java application server can be used to bypass the authentication of the QDS… |
CVE-2022-45923 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Common Gateway Interface (CGI) program cs.exe allows an attacker to increas… |
CVE-2022-45928 | High | 8.8 | 2023-01-18 | A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). Multiple endpoints allow the user to pass the parameter… |
CVE-2022-45926 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint notify.localizeEmailTemplate allows a low-privilege user to evalua… |
CVE-2022-45925 | High | 7.5 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The action xmlexport accepts the parameter requestContext. If this parameter is… |
CVE-2022-45924 | High | 8.1 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint itemtemplate.createtemplate2 allows a low-privilege user to delete… |
CVE-2022-45922 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The request handler for ll.KeepAliveSession sets a valid AdminPwd cookie even w… |
CVE-2022-47990 | Medium | 6.2 | 2023-01-18 | IBM AIX 7.1, 7.2, 7.3 and VIOS , 3.1 could allow a non-privileged local user to exploit a vulnerability in X11 to cause a buffer overflow that could result in… |
CVE-2022-47966 | Critical | 9.8 | 2023-01-18 | Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka… |
CVE-2022-45613 | Medium | 5.4 | 2023-01-18 | Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows at… |
CVE-2022-47950 | Medium | 6.5 | 2023-01-18 | An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce th… |
CVE-2022-3100 | Medium | 5.9 | 2023-01-18 | A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API. |
CVE-2022-46505 | High | 7.5 | 2023-01-18 | An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that c… |
CVE-2022-47881 | Medium | 6.5 | 2023-01-18 | Foxit PDF Reader and PDF Editor 11.2.1.53537 and earlier has an Out-of-Bounds Read vulnerability. |
CVE-2022-45103 | Medium | 6.5 | 2023-01-18 | Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerability. A low privile… |
CVE-2022-41417 | Critical | 9.8 | 2023-01-18 | BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/. |
CVE-2022-34457 | High | 7.3 | 2023-01-18 | Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads… |
CVE-2022-34436 | Low | 2.7 | 2023-01-18 | Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remo… |
CVE-2022-34435 | Low | 2.7 | 2023-01-18 | Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remo… |
CVE-2022-34399 | Medium | 5.1 | 2023-01-18 | Dell Alienware m17 R5 BIOS version prior to 1.2.2 contain a buffer access vulnerability. A malicious user with admin privileges could potentially exploit this… |
CVE-2022-34462 | High | 8.4 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge of the hard-coded cre… |
CVE-2022-34442 | High | 8.0 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2022-34460 | High | 7.5 | 2023-01-18 | Prior Dell BIOS versions contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability b… |
CVE-2022-34456 | High | 8.8 | 2023-01-18 | Dell EMC Metro node, Version(s) prior to 7.1, contain a Code Injection Vulnerability. An authenticated nonprivileged attacker could potentially exploit this v… |
CVE-2022-34401 | High | 7.5 | 2023-01-18 | Dell BIOS contains a stack based buffer overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SM… |
CVE-2022-34393 | High | 7.5 | 2023-01-18 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32490 | High | 7.5 | 2023-01-18 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-25901 | Medium | 5.3 | 2023-01-18 | Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an inse… |
CVE-2022-47917 | Medium | 6.8 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to sev… |
CVE-2022-47911 | Critical | 9.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup… |
CVE-2022-47395 | High | 8.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor serv… |
CVE-2022-46733 | Medium | 6.3 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services. A… |
CVE-2022-45444 | Critical | 10.0 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the applicati… |
CVE-2022-45127 | High | 8.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its backup servi… |
CVE-2022-43483 | Critical | 9.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor… |
CVE-2022-43455 | Medium | 5.5 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to the… |
CVE-2022-41989 | Critical | 9.0 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during com… |