2022 CVEs (page 70)
Page 70 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24120 | Medium | 4.6 | 2022-12-26 | Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0. |
CVE-2022-24119 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell. This affects iNET… |
CVE-2022-24118 | Critical | 9.1 | 2022-12-26 | Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. This affects iNET… |
CVE-2022-24117 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, T… |
CVE-2022-24116 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0. |
CVE-2022-37310 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI. |
CVE-2022-37309 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name. |
CVE-2022-29853 | Medium | 5.4 | 2022-12-26 | OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message. |
CVE-2022-29852 | Medium | 5.4 | 2022-12-26 | OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked. |
CVE-2022-37308 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages. |
CVE-2022-37313 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record. |
CVE-2022-37312 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet. |
CVE-2022-37311 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet. |
CVE-2022-37307 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature. |
CVE-2022-31469 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI. |
CVE-2022-4741 | Medium | 4.3 | 2022-12-25 | A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/… |
CVE-2022-4740 | Low | 3.5 | 2022-12-25 | A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /p… |
CVE-2022-4739 | High | 7.3 | 2022-12-25 | A vulnerability classified as critical was found in SourceCodester School Dormitory Management System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2022-4738 | Medium | 4.3 | 2022-12-25 | A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index… |
CVE-2022-4737 | High | 7.3 | 2022-12-25 | A vulnerability was found in SourceCodester Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the… |
CVE-2022-4736 | Low | 3.5 | 2022-12-25 | A vulnerability was found in Venganzas del Pasado and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the… |
CVE-2022-41318 | High | 8.6 | 2022-12-25 | A buffer over-read was discovered in libntlmauth in Squid 2.5 through 5.6. Due to incorrect integer-overflow protection, the SSPI and SMB authentication helper… |
CVE-2022-41317 | Medium | 6.5 | 2022-12-25 | An issue was discovered in Squid 4.9 through 4.17 and 5.0.6 through 5.6. Due to inconsistent handling of internal URIs, there can be Exposure of Sensitive Info… |
CVE-2022-40005 | High | 8.8 | 2022-12-25 | Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and /boaform/formTr… |
CVE-2022-37706 | High | 7.8 | 2022-12-25 | enlightenment_sys in Enlightenment before 0.25.4 allows local users to gain privileges because it is setuid root, and the system library function mishandles pa… |
CVE-2022-4735 | Low | 3.5 | 2022-12-25 | A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the… |
CVE-2022-4731 | Low | 2.4 | 2022-12-25 | A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x. Affected is an unknown function of the component Title Handler. The ma… |
CVE-2022-42898 | High | 8.8 | 2022-12-25 | PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind… |
CVE-2022-45896 | Critical | 9.8 | 2022-12-25 | Planet eStream before 6.72.10.07 allows unauthenticated upload of arbitrary files: Choose a Video / Related Media or Upload Document. Upload2.ashx can be used… |
CVE-2022-45895 | Medium | 6.5 | 2022-12-25 | Planet eStream before 6.72.10.07 discloses sensitive information, related to the ON cookie (findable in HTML source code for Default.aspx in some situations) a… |
CVE-2022-45894 | Medium | 6.5 | 2022-12-25 | GetFile.aspx in Planet eStream before 6.72.10.07 allows ..\ directory traversal to read arbitrary local files. |
CVE-2022-45893 | High | 8.8 | 2022-12-25 | Planet eStream before 6.72.10.07 allows a low-privileged user to gain access to administrative and high-privileged user accounts by changing the value of the O… |
CVE-2022-45197 | High | 7.5 | 2022-12-25 | Slixmpp before 1.8.3 lacks SSL Certificate hostname validation in XMLStream, allowing an attacker to pose as any server in the eyes of Slixmpp. |
CVE-2022-44640 | Critical | 9.8 | 2022-12-25 | Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC). |
CVE-2022-44381 | Medium | 5.3 | 2022-12-25 | Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request. |
CVE-2022-44380 | Medium | 5.4 | 2022-12-25 | Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets. |
CVE-2022-44017 | High | 7.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. Due to errors in session management, an attacker can log back into a victim's account after t… |
CVE-2022-44016 | High | 7.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LM_A… |
CVE-2022-44015 | Critical | 9.8 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can inject raw SQL queries. By activating MSSQL features, the attacker is able to… |
CVE-2022-44014 | Medium | 6.5 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. In the design of the API, a user is inherently able to fetch arbitrary SQL tables. This leaks… |
CVE-2022-44013 | Critical | 9.1 | 2022-12-25 | An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can make various API calls without authentication because the password in a Crede… |
CVE-2022-44012 | Medium | 5.4 | 2022-12-25 | An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. An attacker can exe… |
CVE-2022-42953 | High | 7.5 | 2022-12-25 | Certain ZKTeco products (ZEM500-510-560-760, ZEM600-800, ZEM720, ZMM) allow access to sensitive information via direct requests for the form/DataApp?style=1 an… |
CVE-2022-45892 | Medium | 5.4 | 2022-12-25 | In Planet eStream before 6.72.10.07, multiple Stored Cross-Site Scripting (XSS) vulnerabilities exist: Disclaimer, Search Function, Comments, Batch editing too… |
CVE-2022-45891 | Critical | 9.1 | 2022-12-25 | Planet eStream before 6.72.10.07 allows attackers to call restricted functions, and perform unauthenticated uploads (Upload2.ashx) or access content uploaded b… |
CVE-2022-45890 | Medium | 6.1 | 2022-12-25 | In Planet eStream before 6.72.10.07, a Reflected Cross-Site Scripting (XSS) vulnerability exists via any metadata filter field (e.g., search within Default.asp… |
CVE-2022-45889 | High | 7.2 | 2022-12-25 | Planet eStream before 6.72.10.07 allows a remote attacker (who is a publisher or admin) to obtain access to all records stored in the database, and achieve the… |
CVE-2022-47949 | Critical | 9.8 | 2022-12-24 | The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code v… |
CVE-2022-47934 | Medium | 6.5 | 2022-12-24 | Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs… |
CVE-2022-47933 | Medium | 6.5 | 2022-12-24 | Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability… |
CVE-2022-47932 | Medium | 6.5 | 2022-12-24 | Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulne… |
CVE-2022-46175 | High | 7.1 | 2022-12-24 | JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the J… |
CVE-2022-45798 | High | 7.8 | 2022-12-24 | A link following vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacke… |
CVE-2022-43860 | Medium | 4.3 | 2022-12-24 | IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information they are authorized to but not while using this interfa… |
CVE-2022-38658 | High | 7.7 | 2022-12-24 | BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. O… |
CVE-2022-22449 | Medium | 5.3 | 2022-12-24 | IBM Security Verify Governance, Identity Manager 10.01 could allow a remote attacker to obtain sensitive information when a detailed technical error message is… |
CVE-2022-47633 | High | 8.1 | 2022-12-23 | An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject uns… |
CVE-2022-40011 | Medium | 6.1 | 2022-12-23 | Typora through 1.3.8 allows XSS if a document containing an SVG element with an attacker-controlled onload attribute is exported and then used at a victim's or… |
CVE-2022-47946 | Medium | 5.5 | 2022-12-23 | An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kern… |
CVE-2022-28229 | High | 7.5 | 2022-12-23 | The hash functionality in userver before 42059b6319661583b3080cab9b595d4f8ac48128 allows attackers to cause a denial of service via crafted HTTP request, invol… |
CVE-2022-28228 | Critical | 9.1 | 2022-12-23 | Out-of-bounds read was discovered in YDB server. An attacker could construct a query with insert statement that would allow him to read sensitive information f… |
CVE-2022-47945 | Critical | 9.8 | 2022-12-23 | ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthe… |
CVE-2022-23854 | High | 7.5 | 2022-12-23 | AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network acces… |
CVE-2022-4692 | Medium | 5.4 | 2022-12-23 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-43849 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd kernel extension to cause a denial of se… |
CVE-2022-43848 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial o… |
CVE-2022-41290 | High | 8.4 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the rm_rlcache_file command to obtain root privileges… |
CVE-2022-39164 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX kernel to cause a denial of service. IBM X-Fo… |
CVE-2022-46570 | High | 7.2 | 2022-12-23 | D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetWan3Settings module. |
CVE-2022-46569 | High | 7.2 | 2022-12-23 | D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Key parameter in the SetWLanRadioSecurity module. |
CVE-2022-46568 | High | 7.2 | 2022-12-23 | D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the AccountPassword parameter in the SetSysEmailSett… |
CVE-2022-46566 | High | 7.2 | 2022-12-23 | D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetQuickVPNSettings mo… |
CVE-2022-46563 | High | 7.2 | 2022-12-23 | D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetDynamicDNSSettings… |
CVE-2022-46562 | High | 7.2 | 2022-12-23 | D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the PSK parameter in the SetQuickVPNSettings module. |
CVE-2022-46561 | High | 7.2 | 2022-12-23 | D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetWanSettings module. |
CVE-2022-46560 | High | 7.2 | 2022-12-23 | D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetWan2Settings module. |
CVE-2022-45721 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the picName parameter in the formDelWewifiPic function. |
CVE-2022-45720 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the ip, mac, and remark parameters in the formIPMacBindModify function. |
CVE-2022-45719 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the gotoUrl parameter in the formPortalAuth function. |
CVE-2022-45718 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formIPMacBindAdd function. |
CVE-2022-45717 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName parameter in the formSetUSBPartitionUmount f… |
CVE-2022-45716 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the indexSet parameter in the formIPMacBindDel function. |
CVE-2022-45715 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pLanPortRange and pWanPortRange parameters in the formSetPortMapping… |
CVE-2022-45714 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the indexSet parameter in the formQOSRuleDel function. |
CVE-2022-45712 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsForward function. |
CVE-2022-45711 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the hostname parameter in the formSetNetCheckTools function. |
CVE-2022-45710 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple buffer overflows via the pEnable, pLevel, and pModule parameters in the formSetDebugCfg functi… |
CVE-2022-45709 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain multiple command injection vulnerabilities via the pEnable, pLevel, and pModule parameters in the formS… |
CVE-2022-45708 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the sPortMapIndex parameter in the formDelPortMapping function. |
CVE-2022-45707 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the rules parameter in the formAddDnsHijack function. |
CVE-2022-45706 | Critical | 9.8 | 2022-12-23 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a buffer overflow via the hostname parameter in the formSetNetCheckTools function. |
CVE-2022-43381 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM… |
CVE-2022-43380 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX NFS kernel extension to cause a denial of se… |
CVE-2022-40233 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX TCP/IP kernel extension to cause a denial of… |
CVE-2022-39165 | Medium | 6.2 | 2022-12-23 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in CAA to cause a denial of service. IBM X-Force ID: 23… |
CVE-2022-47943 | High | 8.1 | 2022-12-23 | An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a l… |
CVE-2022-4698 | Medium | 5.5 | 2022-12-23 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insuf… |
CVE-2022-4697 | Medium | 5.5 | 2022-12-23 | The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘wp_user_cover_default_image_url’ parameter in versions up to, and i… |
CVE-2022-47942 | High | 8.8 | 2022-12-23 | An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use o… |
CVE-2022-47941 | High | 7.5 | 2022-12-23 | An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate er… |