2022 CVEs (page 60)
Page 60 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41733 | Medium | 5.3 | 2023-01-20 | IBM InfoSphere Information Server 11.7 could allow a remote attacked to cause some of the components to be unusable until the process is restarted. IBM X-Forc… |
CVE-2022-39193 | Medium | 5.3 | 2023-01-20 | An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x. Various components of this extension can expose information on the performer o… |
CVE-2022-35977 | Medium | 5.5 | 2023-01-20 | Redis is an in-memory database that persists on disk. Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer… |
CVE-2022-38112 | High | 7.5 | 2023-01-20 | In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext. |
CVE-2022-38110 | Medium | 5.4 | 2023-01-20 | In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting. |
CVE-2022-47747 | High | 7.5 | 2023-01-20 | kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs. |
CVE-2022-47732 | High | 7.5 | 2023-01-20 | In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing… |
CVE-2022-43704 | Medium | 5.9 | 2023-01-20 | The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate using MQTT. It is pos… |
CVE-2022-25631 | High | 7.8 | 2023-01-20 | Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereb… |
CVE-2022-48126 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGene… |
CVE-2022-48125 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGene… |
CVE-2022-48124 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGene… |
CVE-2022-48123 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRul… |
CVE-2022-48122 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules… |
CVE-2022-48121 | Critical | 9.8 | 2023-01-20 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules… |
CVE-2022-43959 | Medium | 4.9 | 2023-01-20 | Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to discover an AD/LDAP… |
CVE-2022-41441 | Medium | 6.1 | 2023-01-20 | Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2022-40267 | Medium | 5.9 | 2023-01-20 | Predictable Seed in Pseudo-Random Number Generator (PRNG) vulnerability in Mitsubishi Electric Corporation MELSEC iQ-F Series FX5U-xMy/z (x=32,64,80, y=T,R, z=… |
CVE-2022-48191 | High | 7.0 | 2023-01-20 | A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known malicious executable to a specific location… |
CVE-2022-20967 | Medium | 4.8 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scr… |
CVE-2022-20966 | Medium | 5.4 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scr… |
CVE-2022-20965 | Medium | 4.3 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges action… |
CVE-2022-20964 | Medium | 6.3 | 2023-01-20 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary comma… |
CVE-2022-46476 | Critical | 9.8 | 2023-01-19 | D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function. |
CVE-2022-31901 | Medium | 6.5 | 2023-01-19 | Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files. |
CVE-2022-47766 | High | 8.8 | 2023-01-19 | PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability. |
CVE-2022-46890 | Medium | 4.3 | 2023-01-19 | Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by… |
CVE-2022-46889 | Medium | 5.4 | 2023-01-19 | A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web scrip… |
CVE-2022-46888 | Medium | 6.1 | 2023-01-19 | Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the… |
CVE-2022-46887 | Critical | 9.8 | 2023-01-19 | Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeco… |
CVE-2022-47745 | High | 8.8 | 2023-01-19 | ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a special request and… |
CVE-2022-47740 | Critical | 9.8 | 2023-01-19 | Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php. |
CVE-2022-47197 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-47196 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-47195 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-47194 | Medium | 5.4 | 2023-01-19 | An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administr… |
CVE-2022-40697 | Medium | 4.8 | 2023-01-19 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions. |
CVE-2022-39167 | Medium | 5.9 | 2023-01-19 | IBM Spectrum Virtualize 8.5, 8.4, 8.3, 8.2, and 7.8, under certain configurations, could disclose sensitive information to an attacker using man-in-the-middle… |
CVE-2022-47105 | Critical | 9.8 | 2023-01-19 | Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData. |
CVE-2022-3738 | Medium | 5.9 | 2023-01-19 | The vulnerability allows a remote unauthenticated attacker to download a backup file, if one exists. That backup file might contain sensitive information like… |
CVE-2022-4892 | Low | 3.5 | 2023-01-19 | A vulnerability was found in MyCMS. It has been classified as problematic. This affects the function build_view of the file lib/gener/view.php of the component… |
CVE-2022-3085 | High | 7.8 | 2023-01-19 | Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbit… |
CVE-2022-4235 | Medium | 5.4 | 2023-01-18 | RushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. This is possible because the applica… |
CVE-2022-45927 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Java application server can be used to bypass the authentication of the QDS… |
CVE-2022-45923 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The Common Gateway Interface (CGI) program cs.exe allows an attacker to increas… |
CVE-2022-45928 | High | 8.8 | 2023-01-18 | A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). Multiple endpoints allow the user to pass the parameter… |
CVE-2022-45926 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint notify.localizeEmailTemplate allows a low-privilege user to evalua… |
CVE-2022-45925 | High | 7.5 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The action xmlexport accepts the parameter requestContext. If this parameter is… |
CVE-2022-45924 | High | 8.1 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The endpoint itemtemplate.createtemplate2 allows a low-privilege user to delete… |
CVE-2022-45922 | High | 8.8 | 2023-01-18 | An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). The request handler for ll.KeepAliveSession sets a valid AdminPwd cookie even w… |
CVE-2022-47990 | Medium | 6.2 | 2023-01-18 | IBM AIX 7.1, 7.2, 7.3 and VIOS , 3.1 could allow a non-privileged local user to exploit a vulnerability in X11 to cause a buffer overflow that could result in… |
CVE-2022-47966 | Critical | 9.8 | 2023-01-18 | Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka… |
CVE-2022-45613 | Medium | 5.4 | 2023-01-18 | Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows at… |
CVE-2022-47950 | Medium | 6.5 | 2023-01-18 | An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce th… |
CVE-2022-3100 | Medium | 5.9 | 2023-01-18 | A flaw was found in the openstack-barbican component. This issue allows an access policy bypass via a query string when accessing the API. |
CVE-2022-46505 | High | 7.5 | 2023-01-18 | An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that c… |
CVE-2022-47881 | Medium | 6.5 | 2023-01-18 | Foxit PDF Reader and PDF Editor 11.2.1.53537 and earlier has an Out-of-Bounds Read vulnerability. |
CVE-2022-45103 | Medium | 6.5 | 2023-01-18 | Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerability. A low privile… |
CVE-2022-41417 | Critical | 9.8 | 2023-01-18 | BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/. |
CVE-2022-34457 | High | 7.3 | 2023-01-18 | Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secured path which leads… |
CVE-2022-34436 | Low | 2.7 | 2023-01-18 | Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remo… |
CVE-2022-34435 | Low | 2.7 | 2023-01-18 | Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuration is set. A remo… |
CVE-2022-34399 | Medium | 5.1 | 2023-01-18 | Dell Alienware m17 R5 BIOS version prior to 1.2.2 contain a buffer access vulnerability. A malicious user with admin privileges could potentially exploit this… |
CVE-2022-34462 | High | 8.4 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. An attacker, with the knowledge of the hard-coded cre… |
CVE-2022-34442 | High | 8.0 | 2023-01-18 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2022-34460 | High | 7.5 | 2023-01-18 | Prior Dell BIOS versions contain an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability b… |
CVE-2022-34456 | High | 8.8 | 2023-01-18 | Dell EMC Metro node, Version(s) prior to 7.1, contain a Code Injection Vulnerability. An authenticated nonprivileged attacker could potentially exploit this v… |
CVE-2022-34401 | High | 7.5 | 2023-01-18 | Dell BIOS contains a stack based buffer overflow vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SM… |
CVE-2022-34393 | High | 7.5 | 2023-01-18 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-32490 | High | 7.5 | 2023-01-18 | Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI… |
CVE-2022-25901 | Medium | 5.3 | 2023-01-18 | Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, which uses an inse… |
CVE-2022-47917 | Medium | 6.8 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to sev… |
CVE-2022-47911 | Critical | 9.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup… |
CVE-2022-47395 | High | 8.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor serv… |
CVE-2022-46733 | Medium | 6.3 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services. A… |
CVE-2022-45444 | Critical | 10.0 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 contains hard-coded passwords for select users in the applicati… |
CVE-2022-45127 | High | 8.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its backup servi… |
CVE-2022-43483 | Critical | 9.1 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the monitor… |
CVE-2022-43455 | Medium | 5.5 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to the… |
CVE-2022-41989 | Critical | 9.0 | 2023-01-18 | Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not validate the length of RTLS report payloads during com… |
CVE-2022-46732 | Critical | 9.8 | 2023-01-18 | Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status. |
CVE-2022-46660 | High | 7.5 | 2023-01-18 | An unauthorized user could alter or write files with full control over the path and content of the file. |
CVE-2022-46331 | High | 7.5 | 2023-01-18 | An unauthorized user could possibly delete any file on the system. |
CVE-2022-43494 | High | 7.5 | 2023-01-18 | An unauthorized user could be able to read any file on the system, potentially exposing sensitive information. |
CVE-2022-39429 | Medium | 4.3 | 2023-01-18 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allo… |
CVE-2022-38469 | High | 7.5 | 2023-01-18 | An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords. |
CVE-2022-41903 | Critical | 9.8 | 2023-01-17 | Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also ex… |
CVE-2022-23521 | Critical | 9.8 | 2023-01-17 | Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `… |
CVE-2022-41953 | High | 8.6 | 2023-01-17 | Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line… |
CVE-2022-47929 | Medium | 5.5 | 2023-01-17 | In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (s… |
CVE-2022-46475 | Critical | 9.8 | 2023-01-17 | D-Link DIR 645A1 1.06B01_Beta01 was discovered to contain a stack overflow via the service= variable in the genacgi_main function. |
CVE-2022-43977 | Critical | 9.8 | 2023-01-17 | An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn service) lacks acces… |
CVE-2022-43976 | Critical | 9.8 | 2023-01-17 | An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direct access to the API is possible on TCP p… |
CVE-2022-43975 | High | 7.5 | 2023-01-17 | An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vulnerability in the web server allows arbi… |
CVE-2022-40319 | High | 7.5 | 2023-01-17 | The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL… |
CVE-2022-39195 | Medium | 6.1 | 2023-01-17 | A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the c parameter. |
CVE-2022-2907 | Medium | 5.7 | 2023-01-17 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versio… |
CVE-2022-2251 | Medium | 4.8 | 2023-01-17 | Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who… |
CVE-2022-23538 | Medium | 5.2 | 2023-01-17 | github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is us… |
CVE-2022-4891 | Low | 3.5 | 2023-01-17 | A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisi… |