2022 CVEs (page 68)
Page 68 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47119 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet. |
CVE-2022-47118 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet. |
CVE-2022-47117 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security parameter at /goform/WifiBasicSet. |
CVE-2022-47116 | High | 7.5 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the SYSPS parameter at /goform/SysToolChangePwd. |
CVE-2022-47115 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet. |
CVE-2022-46601 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setbg_num parameter in the icp_setbg_img (sub_41DD68) function. |
CVE-2022-46600 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin_24g function. |
CVE-2022-46599 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setlogo_num parameter in the icp_setlogo_img (sub_41DBF4) function. |
CVE-2022-46598 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin… |
CVE-2022-46597 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) fu… |
CVE-2022-46596 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the del_num parameter in the icp_delete_img (sub_41DEDC) function. |
CVE-2022-46594 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the update_file_name parameter in the auto_up_fw (sub_420A04) function. |
CVE-2022-46593 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the do_sta_enrollee_wifi function. |
CVE-2022-46592 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the set_sta_enrollee_pin_5g function. |
CVE-2022-46591 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reject_url parameter in the reject (sub_41BD60) function. |
CVE-2022-46590 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstat_rsname parameter in the tools_netstat (sub_41E730) function. |
CVE-2022-46589 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstat_option parameter in the tools_netstat (sub_41E730) function. |
CVE-2022-46588 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) function. |
CVE-2022-46586 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the qcawifi.wifi%d_vap%d.maclist parameter in the kick_ban_wifi_mac_allow (sub_415B00)… |
CVE-2022-46585 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the REMOTE_USER parameter in the get_access (sub_45AC2C) function. |
CVE-2022-46584 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the qcawifi.wifi%d_vap%d.maclist parameter in the kick_ban_wifi_mac_deny (sub_415D7C)… |
CVE-2022-46583 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reboot_type parameter in the wizard_ipv6 (sub_41C380) function. |
CVE-2022-46582 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the login_name parameter in the do_graph_auth (sub_4061E0) function. |
CVE-2022-46581 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.nslookup_target parameter in the tools_nslookup function. |
CVE-2022-46580 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the user_edit_page parameter in the wifi_captive_portal function. |
CVE-2022-4863 | Medium | 6.5 | 2022-12-30 | Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4861 | Medium | 4.8 | 2022-12-30 | Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another reso… |
CVE-2022-4860 | Medium | 5.5 | 2022-12-30 | A vulnerability was found in KBase Metrics. It has been classified as critical. This affects the function upload_user_data of the file source/daily_cron_jobs/m… |
CVE-2022-4859 | Low | 3.5 | 2022-12-30 | A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33. This issue affects the function submitForm of the file wflow-core/s… |
CVE-2022-4858 | Medium | 4.4 | 2022-12-30 | Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configur… |
CVE-2022-44621 | Critical | 9.8 | 2022-12-30 | Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. |
CVE-2022-43396 | High | 8.8 | 2022-12-30 | In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by co… |
CVE-2022-4857 | Medium | 6.3 | 2022-12-30 | A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2022-4856 | Medium | 6.3 | 2022-12-30 | A vulnerability has been found in Modbus Tools Modbus Slave up to 7.5.1 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2022-4855 | High | 7.3 | 2022-12-30 | A vulnerability, which was classified as critical, was found in SourceCodester Lead Management System 1.0. Affected is an unknown function of the file login.ph… |
CVE-2022-48196 | High | 7.4 | 2022-12-30 | Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX40 before 1.0.2.60, RAX35 before 1.0.2.60, R6400v2 be… |
CVE-2022-48194 | High | 8.8 | 2022-12-30 | TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a cr… |
CVE-2022-44137 | High | 7.2 | 2022-12-30 | SourceCodester Sanitization Management System 1.0 is vulnerable to SQL Injection. |
CVE-2022-36437 | Critical | 9.1 | 2022-12-29 | The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity o… |
CVE-2022-30519 | Medium | 6.1 | 2022-12-29 | XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password field. |
CVE-2022-38212 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and… |
CVE-2022-38211 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and… |
CVE-2022-38210 | Medium | 6.1 | 2022-12-29 | There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to crea… |
CVE-2022-38209 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a craft… |
CVE-2022-38208 | Medium | 6.1 | 2022-12-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that cou… |
CVE-2022-38207 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote remote, unauthenticated attacker to create… |
CVE-2022-38206 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create… |
CVE-2022-38205 | High | 8.6 | 2022-12-29 | In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker… |
CVE-2022-38204 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a craf… |
CVE-2022-38203 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and… |
CVE-2022-46181 | Medium | 6.1 | 2022-12-29 | Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allow… |
CVE-2022-46178 | High | 7.4 | 2022-12-29 | MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions pr… |
CVE-2022-4851 | Medium | 5.3 | 2022-12-29 | Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4850 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4849 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4848 | Medium | 5.7 | 2022-12-29 | Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4847 | Medium | 6.5 | 2022-12-29 | Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4846 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4845 | Medium | 4.3 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4844 | High | 8.8 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4843 | High | 7.5 | 2022-12-29 | NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2. |
CVE-2022-4841 | Medium | 5.4 | 2022-12-29 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4840 | Medium | 5.4 | 2022-12-29 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4839 | Medium | 5.4 | 2022-12-29 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4780 | Medium | 4.5 | 2022-12-29 | ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change. |
CVE-2022-4779 | High | 7.5 | 2022-12-29 | StreamX applications from versions 6.02.01 to 6.04.34 are affected by a logic bug that allows to bypass the implemented authentication scheme. StreamX applicat… |
CVE-2022-4778 | Medium | 6.5 | 2022-12-29 | StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get unauthorized access… |
CVE-2022-4823 | Low | 3.1 | 2022-12-28 | A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_control… |
CVE-2022-4822 | Low | 2.4 | 2022-12-28 | A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.ph… |
CVE-2022-4821 | Low | 2.4 | 2022-12-28 | A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uplo… |
CVE-2022-4820 | Low | 3.5 | 2022-12-28 | A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.entry.list.php of the… |
CVE-2022-4819 | Low | 2.4 | 2022-12-28 | A vulnerability was found in HotCRP. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross si… |
CVE-2022-4818 | Medium | 5.5 | 2022-12-28 | A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-4817 | Low | 3.1 | 2022-12-28 | A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to ins… |
CVE-2022-23554 | Medium | 6.5 | 2022-12-28 | Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI… |
CVE-2022-23553 | High | 7.5 | 2022-12-28 | Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are… |
CVE-2022-46740 | Medium | 6.5 | 2022-12-28 | There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a denial of service (Do… |
CVE-2022-45874 | Medium | 5.5 | 2022-12-28 | Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file. |
CVE-2022-44564 | High | 7.8 | 2022-12-28 | Huawei Aslan Children's Watch has a path traversal vulnerability. Successful exploitation may allow attackers to access or modify protected system resources. |
CVE-2022-41579 | Medium | 6.5 | 2022-12-28 | There is an insufficient authentication vulnerability in some Huawei band products. Successful exploit could allow the attacker to spoof then connect to the ba… |
CVE-2022-39012 | High | 7.5 | 2022-12-28 | Huawei Aslan Children's Watch has an improper input validation vulnerability. Successful exploitation may cause the watch's application service abnormal. |
CVE-2022-38202 | High | 7.5 | 2022-12-28 | There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker t… |
CVE-2022-4814 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4813 | Medium | 4.3 | 2022-12-28 | Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4812 | Medium | 6.5 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4811 | High | 8.3 | 2022-12-28 | Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1. |
CVE-2022-4810 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4809 | High | 8.8 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4808 | High | 8.8 | 2022-12-28 | Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4807 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4806 | Medium | 5.3 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4805 | Medium | 4.3 | 2022-12-28 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4804 | Medium | 5.3 | 2022-12-28 | Improper Authorization in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4803 | High | 8.8 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4802 | Medium | 5.4 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4801 | Medium | 5.3 | 2022-12-28 | Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4800 | Medium | 6.5 | 2022-12-28 | Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4799 | Medium | 6.5 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4798 | Medium | 5.3 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4797 | Medium | 4.3 | 2022-12-28 | Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1. |