2022 CVEs (page 62)
Page 62 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3841 | High | 7.8 | 2023-01-13 | RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Adva… |
CVE-2022-3782 | Critical | 9.1 | 2023-01-13 | keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker ca… |
CVE-2022-3143 | High | 7.4 | 2023-01-13 | wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in sev… |
CVE-2022-21191 | High | 7.4 | 2023-01-13 | Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes be… |
CVE-2022-42290 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial… |
CVE-2022-42289 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial… |
CVE-2022-42288 | Medium | 5.3 | 2023-01-13 | NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may lead to an… |
CVE-2022-42287 | Medium | 6.0 | 2023-01-13 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can upload and download arbitrary files under certain circumstances, which ma… |
CVE-2022-42286 | Medium | 6.0 | 2023-01-13 | DGX A100 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, or escalation of privileges. |
CVE-2022-46502 | Critical | 9.8 | 2023-01-13 | Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollment/admin/login.php. |
CVE-2022-42285 | Medium | 6.0 | 2023-01-13 | DGX A100 SBIOS contains a vulnerability in the Pre-EFI Initialization (PEI)phase, where a privileged user can disable SPI flash protection, which may lead to d… |
CVE-2022-42284 | Medium | 6.2 | 2023-01-13 | NVIDIA BMC stores user passwords in an obfuscated form in a database accessible by the host. This may lead to a credentials exposure. |
CVE-2022-42283 | Medium | 6.4 | 2023-01-13 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execut… |
CVE-2022-42282 | Medium | 6.5 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can access arbitrary files, which may lead to information disclosure. |
CVE-2022-42281 | Medium | 6.7 | 2023-01-13 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the FsRecovery, which may allow a highly privileged local attacker to cause an out-of-bounds write, which… |
CVE-2022-42280 | High | 7.1 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST auth handler, where an un-authorized attacker can exploit a path traversal, which may lead to authentication by… |
CVE-2022-42279 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial… |
CVE-2022-42278 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context of the IP… |
CVE-2022-42277 | High | 7.5 | 2023-01-13 | NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may le… |
CVE-2022-42276 | High | 7.5 | 2023-01-13 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead… |
CVE-2022-48258 | Medium | 5.3 | 2023-01-13 | In Eternal Terminal 6.2.1, etserver and etclient have world-readable logfiles. |
CVE-2022-48257 | Medium | 5.3 | 2023-01-13 | In Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp. |
CVE-2022-48256 | High | 7.5 | 2023-01-13 | Technitium DNS Server before 10.0 allows a self-CNAME denial-of-service attack in which a CNAME loop causes an answer to contain hundreds of records. |
CVE-2022-46478 | Critical | 9.8 | 2023-01-13 | The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via cr… |
CVE-2022-46471 | Critical | 9.8 | 2023-01-13 | Online Health Care System v1.0 was discovered to contain a SQL injection vulnerability via the consulting_id parameter at /healthcare/Admin/consulting_detail.p… |
CVE-2022-42275 | High | 7.7 | 2023-01-13 | NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a loss of integrity and… |
CVE-2022-42274 | High | 7.8 | 2023-01-13 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execut… |
CVE-2022-3161 | High | 7.8 | 2023-01-13 | The APDFL.dll contains a memory corruption vulnerability while parsing specially crafted PDF files. This could allow an attacker to execute code in the con… |
CVE-2022-3160 | High | 7.8 | 2023-01-13 | The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacke… |
CVE-2022-3159 | High | 7.8 | 2023-01-13 | The APDFL.dll contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an att… |
CVE-2022-4616 | High | 7.2 | 2023-01-13 | The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a… |
CVE-2022-46463 | High | 7.5 | 2023-01-13 | An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's… |
CVE-2022-46438 | Medium | 5.4 | 2023-01-13 | A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component of DouPHP v1.7 20221118 allows attackers to execute arbitrary web scrip… |
CVE-2022-42704 | Medium | 5.4 | 2023-01-13 | A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote att… |
CVE-2022-41778 | Critical | 9.8 | 2023-01-13 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port wi… |
CVE-2022-42273 | High | 8.1 | 2023-01-12 | NVIDIA BMC contains a vulnerability in libwebsocket, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execut… |
CVE-2022-42272 | High | 8.1 | 2023-01-12 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execution, denial of serv… |
CVE-2022-25027 | High | 7.5 | 2023-01-12 | The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by valida… |
CVE-2022-25026 | High | 7.5 | 2023-01-12 | A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network… |
CVE-2022-47102 | Medium | 5.4 | 2023-01-12 | A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute arbitrary web scripts or HTML via a craf… |
CVE-2022-46623 | High | 7.8 | 2023-01-12 | Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter. |
CVE-2022-46622 | Medium | 6.1 | 2023-01-12 | A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2022-45729 | Medium | 6.1 | 2023-01-12 | A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2022-45728 | Medium | 6.1 | 2023-01-12 | Doctor Appointment Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2022-46472 | High | 7.2 | 2023-01-12 | Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=delete. |
CVE-2022-4842 | Medium | 5.5 | 2023-01-12 | A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system. |
CVE-2022-4743 | High | 7.5 | 2023-01-12 | A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a den… |
CVE-2022-3977 | High | 7.8 | 2023-01-12 | A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously… |
CVE-2022-3628 | Medium | 6.6 | 2023-01-12 | A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can… |
CVE-2022-3145 | Medium | 4.7 | 2023-01-12 | An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL. |
CVE-2022-43591 | High | 8.8 | 2023-01-12 | A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an out-of-bounds… |
CVE-2022-40983 | High | 8.8 | 2023-01-12 | An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer ove… |
CVE-2022-46372 | High | 7.2 | 2023-01-12 | Alotcer - AR7088H-A firmware version 16.10.3 Command execution Improper validation of unspecified input field may allow Authenticated command execution. |
CVE-2022-46371 | Medium | 5.3 | 2023-01-12 | Alotcer - AR7088H-A firmware version 16.10.3 Information disclosure. Unspecified error message contains the default administrator user name. |
CVE-2022-46370 | High | 7.3 | 2023-01-12 | Rumpus - FTP server version 9.0.7.1 Improper Token Verification– vulnerability may allow bypassing identity verification. |
CVE-2022-46369 | Medium | 6.8 | 2023-01-12 | Rumpus - FTP server version 9.0.7.1 Persistent cross-site scripting (PXSS) – vulnerability may allow inserting scripts into unspecified input fields. |
CVE-2022-46368 | Medium | 6.8 | 2023-01-12 | Rumpus - FTP server version 9.0.7.1 Cross-site request forgery (CSRF) – vulnerability may allow unauthorized action on behalf of authenticated users. |
CVE-2022-46367 | Medium | 6.8 | 2023-01-12 | Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation vulnerability that may allow privilege escalation. |
CVE-2022-39187 | Medium | 6.8 | 2023-01-12 | Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting (RXSS) vulnerability through unspecified vectors. |
CVE-2022-39186 | Medium | 6.2 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions |
CVE-2022-39185 | Critical | 9.8 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. Unit has an undocumented hard-coded privileged user. |
CVE-2022-39184 | Critical | 9.8 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass. |
CVE-2022-39183 | Medium | 6.5 | 2023-01-12 | Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors. |
CVE-2022-39182 | Medium | 4.9 | 2023-01-12 | H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actor to gain system pri… |
CVE-2022-46503 | Medium | 5.4 | 2023-01-12 | A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to execute arbitrary… |
CVE-2022-3592 | Medium | 6.5 | 2023-01-12 | A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw… |
CVE-2022-3515 | Critical | 9.8 | 2023-01-12 | A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code executi… |
CVE-2022-3437 | Medium | 6.5 | 2023-01-12 | A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decr… |
CVE-2022-3341 | Medium | 5.3 | 2023-01-12 | A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function… |
CVE-2022-2155 | Medium | 5.7 | 2023-01-12 | A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limi… |
CVE-2022-47927 | Medium | 5.5 | 2023-01-12 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data dir… |
CVE-2022-24913 | Medium | 5.5 | 2023-01-12 | Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdT… |
CVE-2022-4365 | Medium | 5.5 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-4345 | Medium | 6.3 | 2023-01-12 | Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injectio… |
CVE-2022-4342 | Medium | 5.5 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-4167 | Medium | 5.3 | 2023-01-12 | Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group acces… |
CVE-2022-4131 | Medium | 4.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-4037 | Medium | 6.4 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15… |
CVE-2022-3870 | Medium | 5.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-3613 | Medium | 5.8 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15… |
CVE-2022-3573 | Medium | 5.4 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-3514 | Medium | 4.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all version… |
CVE-2022-4344 | Medium | 6.3 | 2023-01-12 | Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted captu… |
CVE-2022-4874 | High | 7.5 | 2023-01-11 | Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, t… |
CVE-2022-4873 | Critical | 9.8 | 2023-01-11 | On Netcomm router models NF20MESH, NF20, and NL1902 a stack based buffer overflow affects the sessionKey parameter. By providing a specific number of bytes, th… |
CVE-2022-4498 | Critical | 9.8 | 2023-01-11 | In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a crafte… |
CVE-2022-46176 | Medium | 5.3 | 2023-01-11 | Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and depen… |
CVE-2022-4499 | High | 7.5 | 2023-01-11 | TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-chann… |
CVE-2022-4885 | Medium | 5.0 | 2023-01-11 | A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical. This vulnerability affects unknown code of the file src/scripts/jeffer… |
CVE-2022-4457 | Medium | 5.5 | 2023-01-11 | Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a… |
CVE-2022-4428 | High | 8.9 | 2023-01-11 | support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitra… |
CVE-2022-40615 | Medium | 6.3 | 2023-01-11 | IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, whi… |
CVE-2022-34335 | Medium | 6.5 | 2023-01-11 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.1 could allow an authenticated user to exhaust server resources which could lead to a denial of… |
CVE-2022-4543 | Medium | 5.5 | 2023-01-11 | A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch si… |
CVE-2022-4415 | Medium | 5.5 | 2023-01-11 | A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel… |
CVE-2022-47864 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeCategories.php. |
CVE-2022-47862 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the customer_id parameter in ajax_represent.php. |
CVE-2022-47861 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeLead.php. |
CVE-2022-47860 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeProduct.php. |
CVE-2022-47859 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the user_id parameter in changePassword.php. |