2022 CVEs (page 62)
Page 62 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41955 | High | 8.8 | 2023-01-14 | Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded p… |
CVE-2022-23532 | High | 7.1 | 2023-01-14 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in… |
CVE-2022-41721 | High | 7.5 | 2023-01-13 | A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the serv… |
CVE-2022-46093 | High | 8.2 | 2023-01-13 | Hospital Management System v1.0 is vulnerable to SQL Injection. Attackers can gain administrator privileges without the need for a password. |
CVE-2022-45299 | Critical | 9.8 | 2023-01-13 | An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL. |
CVE-2022-42136 | High | 8.8 | 2023-01-13 | Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access… |
CVE-2022-46956 | High | 7.2 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/manage_user.php. |
CVE-2022-46955 | Critical | 9.8 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=save_queue. |
CVE-2022-46954 | Critical | 9.8 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_transacti… |
CVE-2022-46953 | High | 7.2 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=save_window. |
CVE-2022-46952 | High | 7.2 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_user. |
CVE-2022-46951 | High | 7.2 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_uploads. |
CVE-2022-46950 | High | 7.2 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_window. |
CVE-2022-46949 | High | 7.2 | 2023-01-13 | Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_helmet. |
CVE-2022-46947 | High | 7.2 | 2023-01-13 | Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category. |
CVE-2022-46946 | High | 7.2 | 2023-01-13 | Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_brand. |
CVE-2022-48091 | Medium | 5.4 | 2023-01-13 | Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php. |
CVE-2022-48090 | Medium | 6.5 | 2023-01-13 | Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php. |
CVE-2022-3693 | High | 7.5 | 2023-01-13 | Path Traversal vulnerability in Deytek Informatics FileOrbis File Management System allows Path Traversal. This issue affects FileOrbis File Management System… |
CVE-2022-42268 | High | 7.8 | 2023-01-13 | Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima. These applications allow execut… |
CVE-2022-3841 | High | 7.8 | 2023-01-13 | RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in the console API endpoint from Red Hat Adva… |
CVE-2022-3782 | Critical | 9.1 | 2023-01-13 | keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker ca… |
CVE-2022-3143 | High | 7.4 | 2023-01-13 | wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in sev… |
CVE-2022-21191 | High | 7.4 | 2023-01-13 | Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes be… |
CVE-2022-42290 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial… |
CVE-2022-42289 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial… |
CVE-2022-42288 | Medium | 5.3 | 2023-01-13 | NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, which may lead to an… |
CVE-2022-42287 | Medium | 6.0 | 2023-01-13 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can upload and download arbitrary files under certain circumstances, which ma… |
CVE-2022-42286 | Medium | 6.0 | 2023-01-13 | DGX A100 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, or escalation of privileges. |
CVE-2022-46502 | Critical | 9.8 | 2023-01-13 | Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollment/admin/login.php. |
CVE-2022-42285 | Medium | 6.0 | 2023-01-13 | DGX A100 SBIOS contains a vulnerability in the Pre-EFI Initialization (PEI)phase, where a privileged user can disable SPI flash protection, which may lead to d… |
CVE-2022-42284 | Medium | 6.2 | 2023-01-13 | NVIDIA BMC stores user passwords in an obfuscated form in a database accessible by the host. This may lead to a credentials exposure. |
CVE-2022-42283 | Medium | 6.4 | 2023-01-13 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execut… |
CVE-2022-42282 | Medium | 6.5 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can access arbitrary files, which may lead to information disclosure. |
CVE-2022-42281 | Medium | 6.7 | 2023-01-13 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the FsRecovery, which may allow a highly privileged local attacker to cause an out-of-bounds write, which… |
CVE-2022-42280 | High | 7.1 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST auth handler, where an un-authorized attacker can exploit a path traversal, which may lead to authentication by… |
CVE-2022-42279 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to code execution, denial… |
CVE-2022-42278 | High | 7.2 | 2023-01-13 | NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memory context of the IP… |
CVE-2022-42277 | High | 7.5 | 2023-01-13 | NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may le… |
CVE-2022-42276 | High | 7.5 | 2023-01-13 | NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flash, which may lead… |
CVE-2022-48258 | Medium | 5.3 | 2023-01-13 | In Eternal Terminal 6.2.1, etserver and etclient have world-readable logfiles. |
CVE-2022-48257 | Medium | 5.3 | 2023-01-13 | In Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp. |
CVE-2022-48256 | High | 7.5 | 2023-01-13 | Technitium DNS Server before 10.0 allows a self-CNAME denial-of-service attack in which a CNAME loop causes an answer to contain hundreds of records. |
CVE-2022-46478 | Critical | 9.8 | 2023-01-13 | The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via cr… |
CVE-2022-46471 | Critical | 9.8 | 2023-01-13 | Online Health Care System v1.0 was discovered to contain a SQL injection vulnerability via the consulting_id parameter at /healthcare/Admin/consulting_detail.p… |
CVE-2022-42275 | High | 7.7 | 2023-01-13 | NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections. This may lead to a loss of integrity and… |
CVE-2022-42274 | High | 7.8 | 2023-01-13 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execut… |
CVE-2022-3161 | High | 7.8 | 2023-01-13 | The APDFL.dll contains a memory corruption vulnerability while parsing specially crafted PDF files. This could allow an attacker to execute code in the con… |
CVE-2022-3160 | High | 7.8 | 2023-01-13 | The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacke… |
CVE-2022-3159 | High | 7.8 | 2023-01-13 | The APDFL.dll contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an att… |
CVE-2022-4616 | High | 7.2 | 2023-01-13 | The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a… |
CVE-2022-46463 | High | 7.5 | 2023-01-13 | An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's… |
CVE-2022-46438 | Medium | 5.4 | 2023-01-13 | A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component of DouPHP v1.7 20221118 allows attackers to execute arbitrary web scrip… |
CVE-2022-42704 | Medium | 5.4 | 2023-01-13 | A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote att… |
CVE-2022-41778 | Critical | 9.8 | 2023-01-13 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollect service port wi… |
CVE-2022-42273 | High | 8.1 | 2023-01-12 | NVIDIA BMC contains a vulnerability in libwebsocket, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execut… |
CVE-2022-42272 | High | 8.1 | 2023-01-12 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execution, denial of serv… |
CVE-2022-25027 | High | 7.5 | 2023-01-12 | The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restricted pages by valida… |
CVE-2022-25026 | High | 7.5 | 2023-01-12 | A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on the internal network… |
CVE-2022-47102 | Medium | 5.4 | 2023-01-12 | A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute arbitrary web scripts or HTML via a craf… |
CVE-2022-46623 | High | 7.8 | 2023-01-12 | Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter. |
CVE-2022-46622 | Medium | 6.1 | 2023-01-12 | A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in… |
CVE-2022-45729 | Medium | 6.1 | 2023-01-12 | A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2022-45728 | Medium | 6.1 | 2023-01-12 | Doctor Appointment Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2022-46472 | High | 7.2 | 2023-01-12 | Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=delete. |
CVE-2022-4842 | Medium | 5.5 | 2023-01-12 | A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system. |
CVE-2022-4743 | High | 7.5 | 2023-01-12 | A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a den… |
CVE-2022-3977 | High | 7.8 | 2023-01-12 | A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. This issue occurs when a user simultaneously… |
CVE-2022-3628 | Medium | 6.6 | 2023-01-12 | A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. This issue occurs when a user connects to a malicious USB device. This can… |
CVE-2022-3145 | Medium | 4.7 | 2023-01-12 | An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary URL. |
CVE-2022-43591 | High | 8.8 | 2023-01-12 | A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an out-of-bounds… |
CVE-2022-40983 | High | 8.8 | 2023-01-12 | An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. A specially-crafted javascript code can trigger an integer ove… |
CVE-2022-46372 | High | 7.2 | 2023-01-12 | Alotcer - AR7088H-A firmware version 16.10.3 Command execution Improper validation of unspecified input field may allow Authenticated command execution. |
CVE-2022-46371 | Medium | 5.3 | 2023-01-12 | Alotcer - AR7088H-A firmware version 16.10.3 Information disclosure. Unspecified error message contains the default administrator user name. |
CVE-2022-46370 | High | 7.3 | 2023-01-12 | Rumpus - FTP server version 9.0.7.1 Improper Token Verification– vulnerability may allow bypassing identity verification. |
CVE-2022-46369 | Medium | 6.8 | 2023-01-12 | Rumpus - FTP server version 9.0.7.1 Persistent cross-site scripting (PXSS) – vulnerability may allow inserting scripts into unspecified input fields. |
CVE-2022-46368 | Medium | 6.8 | 2023-01-12 | Rumpus - FTP server version 9.0.7.1 Cross-site request forgery (CSRF) – vulnerability may allow unauthorized action on behalf of authenticated users. |
CVE-2022-46367 | Medium | 6.8 | 2023-01-12 | Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation vulnerability that may allow privilege escalation. |
CVE-2022-39187 | Medium | 6.8 | 2023-01-12 | Rumpus - FTP server version 9.0.7.1 has a Reflected cross-site scripting (RXSS) vulnerability through unspecified vectors. |
CVE-2022-39186 | Medium | 6.2 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit misconfiguration. System configuration file has misconfigured permissions |
CVE-2022-39185 | Critical | 9.8 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. Unit has an undocumented hard-coded privileged user. |
CVE-2022-39184 | Critical | 9.8 | 2023-01-12 | EXFO - BV-10 Performance Endpoint Unit authentication bypass User can manually manipulate access enabling authentication bypass. |
CVE-2022-39183 | Medium | 6.5 | 2023-01-12 | Moodle Plugin - SAML Auth may allow Open Redirect through unspecified vectors. |
CVE-2022-39182 | Medium | 4.9 | 2023-01-12 | H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation.Version 1.6 is vulnerable to privilege escalation which may allow a malicious actor to gain system pri… |
CVE-2022-46503 | Medium | 5.4 | 2023-01-12 | A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to execute arbitrary… |
CVE-2022-3592 | Medium | 6.5 | 2023-01-12 | A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw… |
CVE-2022-3515 | Critical | 9.8 | 2023-01-12 | A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code executi… |
CVE-2022-3437 | Medium | 6.5 | 2023-01-12 | A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decr… |
CVE-2022-3341 | Medium | 5.3 | 2023-01-12 | A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function… |
CVE-2022-2155 | Medium | 5.7 | 2023-01-12 | A vulnerability exists in the affected versions of Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limi… |
CVE-2022-47927 | Medium | 5.5 | 2023-01-12 | An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data dir… |
CVE-2022-24913 | Medium | 5.5 | 2023-01-12 | Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider() function in StdT… |
CVE-2022-4365 | Medium | 5.5 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-4345 | Medium | 6.3 | 2023-01-12 | Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injectio… |
CVE-2022-4342 | Medium | 5.5 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-4167 | Medium | 5.3 | 2023-01-12 | Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 allows group acces… |
CVE-2022-4131 | Medium | 4.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-4037 | Medium | 6.4 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15… |
CVE-2022-3870 | Medium | 5.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-3613 | Medium | 5.8 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15… |