2022 CVEs (page 68)
Page 68 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-46584 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the qcawifi.wifi%d_vap%d.maclist parameter in the kick_ban_wifi_mac_deny (sub_415D7C)… |
CVE-2022-46583 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reboot_type parameter in the wizard_ipv6 (sub_41C380) function. |
CVE-2022-46582 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the login_name parameter in the do_graph_auth (sub_4061E0) function. |
CVE-2022-46581 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.nslookup_target parameter in the tools_nslookup function. |
CVE-2022-46580 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the user_edit_page parameter in the wifi_captive_portal function. |
CVE-2022-4863 | Medium | 6.5 | 2022-12-30 | Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4861 | Medium | 4.8 | 2022-12-30 | Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another reso… |
CVE-2022-4860 | Medium | 5.5 | 2022-12-30 | A vulnerability was found in KBase Metrics. It has been classified as critical. This affects the function upload_user_data of the file source/daily_cron_jobs/m… |
CVE-2022-4859 | Low | 3.5 | 2022-12-30 | A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33. This issue affects the function submitForm of the file wflow-core/s… |
CVE-2022-4858 | Medium | 4.4 | 2022-12-30 | Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configur… |
CVE-2022-44621 | Critical | 9.8 | 2022-12-30 | Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. |
CVE-2022-43396 | High | 8.8 | 2022-12-30 | In the fix for CVE-2022-24697, a blacklist is used to filter user input commands. But there is a risk of being bypassed. The user can control the command by co… |
CVE-2022-4857 | Medium | 6.3 | 2022-12-30 | A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical. Affected by this issue is some unknown functionality of the file… |
CVE-2022-4856 | Medium | 6.3 | 2022-12-30 | A vulnerability has been found in Modbus Tools Modbus Slave up to 7.5.1 and classified as critical. Affected by this vulnerability is an unknown functionality… |
CVE-2022-4855 | High | 7.3 | 2022-12-30 | A vulnerability, which was classified as critical, was found in SourceCodester Lead Management System 1.0. Affected is an unknown function of the file login.ph… |
CVE-2022-48196 | High | 7.4 | 2022-12-30 | Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX40 before 1.0.2.60, RAX35 before 1.0.2.60, R6400v2 be… |
CVE-2022-48194 | High | 8.8 | 2022-12-30 | TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a cr… |
CVE-2022-44137 | High | 7.2 | 2022-12-30 | SourceCodester Sanitization Management System 1.0 is vulnerable to SQL Injection. |
CVE-2022-36437 | Critical | 9.1 | 2022-12-29 | The Connection handler in Hazelcast and Hazelcast Jet allows a remote unauthenticated attacker to access and manipulate data in the cluster with the identity o… |
CVE-2022-30519 | Medium | 6.1 | 2022-12-29 | XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password field. |
CVE-2022-38212 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and… |
CVE-2022-38211 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and… |
CVE-2022-38210 | Medium | 6.1 | 2022-12-29 | There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to crea… |
CVE-2022-38209 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a craft… |
CVE-2022-38208 | Medium | 6.1 | 2022-12-29 | There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that cou… |
CVE-2022-38207 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote remote, unauthenticated attacker to create… |
CVE-2022-38206 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create… |
CVE-2022-38205 | High | 8.6 | 2022-12-29 | In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker… |
CVE-2022-38204 | Medium | 6.1 | 2022-12-29 | There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a craf… |
CVE-2022-38203 | High | 7.5 | 2022-12-29 | Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and… |
CVE-2022-46181 | Medium | 6.1 | 2022-12-29 | Gotify server is a simple server for sending and receiving messages in real-time per WebSocket. Versions prior to 2.2.2 contain an XSS vulnerability that allow… |
CVE-2022-46178 | High | 7.4 | 2022-12-29 | MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions pr… |
CVE-2022-4851 | Medium | 5.3 | 2022-12-29 | Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4850 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4849 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4848 | Medium | 5.7 | 2022-12-29 | Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4847 | Medium | 6.5 | 2022-12-29 | Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4846 | Medium | 6.5 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4845 | Medium | 4.3 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4844 | High | 8.8 | 2022-12-29 | Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4843 | High | 7.5 | 2022-12-29 | NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2. |
CVE-2022-4841 | Medium | 5.4 | 2022-12-29 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4840 | Medium | 5.4 | 2022-12-29 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4839 | Medium | 5.4 | 2022-12-29 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4780 | Medium | 4.5 | 2022-12-29 | ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change. |
CVE-2022-4779 | High | 7.5 | 2022-12-29 | StreamX applications from versions 6.02.01 to 6.04.34 are affected by a logic bug that allows to bypass the implemented authentication scheme. StreamX applicat… |
CVE-2022-4778 | Medium | 6.5 | 2022-12-29 | StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get unauthorized access… |
CVE-2022-4823 | Low | 3.1 | 2022-12-28 | A vulnerability, which was classified as problematic, was found in InSTEDD Nuntium. Affected is an unknown function of the file app/controllers/geopoll_control… |
CVE-2022-4822 | Low | 2.4 | 2022-12-28 | A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.ph… |
CVE-2022-4821 | Low | 2.4 | 2022-12-28 | A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uplo… |
CVE-2022-4820 | Low | 3.5 | 2022-12-28 | A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.entry.list.php of the… |
CVE-2022-4819 | Low | 2.4 | 2022-12-28 | A vulnerability was found in HotCRP. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross si… |
CVE-2022-4818 | Medium | 5.5 | 2022-12-28 | A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-4817 | Low | 3.1 | 2022-12-28 | A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to ins… |
CVE-2022-23554 | Medium | 6.5 | 2022-12-28 | Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows Authentication Filter bypass. The AuthenticationFilter relies on the request URI… |
CVE-2022-23553 | High | 7.5 | 2022-12-28 | Alpine is a scaffolding library in Java. Alpine prior to version 1.10.4 allows URL access filter bypass. This issue has been fixed in version 1.10.4. There are… |
CVE-2022-46740 | Medium | 6.5 | 2022-12-28 | There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a denial of service (Do… |
CVE-2022-45874 | Medium | 5.5 | 2022-12-28 | Huawei Aslan Children's Watch has an improper authorization vulnerability. Successful exploit could allow the attacker to access certain file. |
CVE-2022-44564 | High | 7.8 | 2022-12-28 | Huawei Aslan Children's Watch has a path traversal vulnerability. Successful exploitation may allow attackers to access or modify protected system resources. |
CVE-2022-41579 | Medium | 6.5 | 2022-12-28 | There is an insufficient authentication vulnerability in some Huawei band products. Successful exploit could allow the attacker to spoof then connect to the ba… |
CVE-2022-39012 | High | 7.5 | 2022-12-28 | Huawei Aslan Children's Watch has an improper input validation vulnerability. Successful exploitation may cause the watch's application service abnormal. |
CVE-2022-38202 | High | 7.5 | 2022-12-28 | There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker t… |
CVE-2022-4814 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4813 | Medium | 4.3 | 2022-12-28 | Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4812 | Medium | 6.5 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4811 | High | 8.3 | 2022-12-28 | Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1. |
CVE-2022-4810 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4809 | High | 8.8 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4808 | High | 8.8 | 2022-12-28 | Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4807 | Medium | 4.3 | 2022-12-28 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4806 | Medium | 5.3 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4805 | Medium | 4.3 | 2022-12-28 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4804 | Medium | 5.3 | 2022-12-28 | Improper Authorization in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4803 | High | 8.8 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4802 | Medium | 5.4 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4801 | Medium | 5.3 | 2022-12-28 | Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4800 | Medium | 6.5 | 2022-12-28 | Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4799 | Medium | 6.5 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4798 | Medium | 5.3 | 2022-12-28 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4797 | Medium | 4.3 | 2022-12-28 | Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4796 | High | 8.1 | 2022-12-28 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-3922 | Medium | 4.8 | 2022-12-28 | The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-46179 | Critical | 9.2 | 2022-12-28 | LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GIT… |
CVE-2022-46174 | Medium | 4.2 | 2022-12-28 | efs-utils is a set of Utilities for Amazon Elastic File System (EFS). A potential race condition issue exists within the Amazon EFS mount helper in efs-utils v… |
CVE-2022-46173 | High | 7.2 | 2022-12-28 | Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when tryi… |
CVE-2022-46172 | Medium | 6.4 | 2022-12-28 | authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can… |
CVE-2022-3347 | High | 7.5 | 2022-12-28 | DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root… |
CVE-2022-3346 | Medium | 6.5 | 2022-12-28 | DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The… |
CVE-2022-23555 | Critical | 9.4 | 2022-12-28 | authentik is an open-source Identity Provider focused on flexibility and versatility. Versions prior to 2022.11.4 and 2022.10.4 are vulnerable to Improper Auth… |
CVE-2022-4773 | Low | 2.5 | 2022-12-28 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the… |
CVE-2022-41967 | High | 7.0 | 2022-12-28 | Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (… |
CVE-2022-41966 | High | 8.2 | 2022-12-28 | XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow… |
CVE-2022-23544 | High | 7.2 | 2022-12-28 | MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions pr… |
CVE-2022-4772 | Medium | 4.5 | 2022-12-27 | A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.jav… |
CVE-2022-4768 | Medium | 6.3 | 2022-12-27 | A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of th… |
CVE-2022-46442 | Critical | 9.8 | 2022-12-27 | dedecms <=V5.7.102 is vulnerable to SQL Injection. In sys_ sql_ n query.php there are no restrictions on the sql query. |
CVE-2022-45963 | Critical | 9.8 | 2022-12-27 | h3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability. |
CVE-2022-45778 | Critical | 9.8 | 2022-12-27 | https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypass vulnerability in… |
CVE-2022-3064 | High | 7.5 | 2022-12-27 | Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. |
CVE-2022-2584 | High | 7.5 | 2022-12-27 | The dag-pb codec can panic when decoding invalid blocks. |