2022 CVEs (page 71)
Page 71 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47940 | High | 8.1 | 2022-12-23 | An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in sm… |
CVE-2022-47939 | Critical | 9.8 | 2022-12-23 | An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after-free and OOPS for SMB2_TREE_DISCONNECT. |
CVE-2022-47938 | Medium | 6.5 | 2022-12-23 | An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONN… |
CVE-2022-38757 | High | 7.2 | 2022-12-23 | A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform… |
CVE-2022-46642 | Critical | 9.9 | 2022-12-23 | D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function. |
CVE-2022-46641 | Critical | 9.9 | 2022-12-23 | D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIpMacBindSettings fu… |
CVE-2022-44567 | Critical | 9.8 | 2022-12-23 | A command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to… |
CVE-2022-44565 | Medium | 5.3 | 2022-12-23 | An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <1.4.1 that allows a… |
CVE-2022-43551 | High | 7.5 | 2022-12-23 | A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. Using its HSTS support, curl can be instructed to use… |
CVE-2022-23547 | Medium | 6.5 | 2022-12-23 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2022-47524 | Medium | 5.4 | 2022-12-23 | F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack. |
CVE-2022-46171 | Medium | 6.8 | 2022-12-23 | Tauri is a framework for building binaries for all major desktop platforms. The filesystem glob pattern wildcards `*`, `?`, and `[...]` match file path literal… |
CVE-2022-4690 | Medium | 5.4 | 2022-12-23 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4689 | High | 8.8 | 2022-12-23 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4688 | High | 8.8 | 2022-12-23 | Improper Authorization in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4687 | High | 8.1 | 2022-12-23 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4686 | Critical | 9.8 | 2022-12-23 | Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4684 | High | 8.8 | 2022-12-23 | Improper Access Control in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4683 | Medium | 6.5 | 2022-12-23 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-33324 | High | 7.5 | 2022-12-23 | Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions "32" and prior, Mitsub… |
CVE-2022-4665 | High | 8.8 | 2022-12-23 | Unrestricted Upload of File with Dangerous Type in GitHub repository ampache/ampache prior to 5.5.6. |
CVE-2022-46492 | Medium | 6.5 | 2022-12-23 | nbnbk commit 879858451d53261d10f77d4709aee2d01c72c301 was discovered to contain an arbitrary file read vulnerability via the component /api/Index/getFileBinary. |
CVE-2022-47931 | Critical | 9.1 | 2022-12-23 | IO FinNet tss-lib before 2.0.0 allows a collision of hash values. |
CVE-2022-40899 | High | 7.5 | 2022-12-23 | An issue discovered in Python Charmers Future 0.18.2 and earlier allows remote attackers to cause a denial of service via crafted Set-Cookie header from malici… |
CVE-2022-40898 | High | 7.5 | 2022-12-23 | An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled… |
CVE-2022-40897 | Medium | 5.9 | 2022-12-23 | Python Packaging Authority (PyPA) setuptools before 65.5.1 allows remote attackers to cause a denial of service via HTML in a crafted package or custom Package… |
CVE-2022-23539 | Medium | 5.9 | 2022-12-23 | Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA ke… |
CVE-2022-23513 | Medium | 5.3 | 2022-12-23 | Pi-Hole is a network-wide ad blocking via your own Linux hardware, AdminLTE is a Pi-hole Dashboard for stats and more. In case of an attack, the threat actor w… |
CVE-2022-47928 | Medium | 6.1 | 2022-12-22 | In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp. |
CVE-2022-46493 | Critical | 9.8 | 2022-12-22 | Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/download_img. |
CVE-2022-46491 | Medium | 6.5 | 2022-12-22 | A Cross-Site Request Forgery (CSRF) vulnerability in the Add Administrator function of the default version of nbnbk allows attackers to arbitrarily add Adminis… |
CVE-2022-4662 | Medium | 5.5 | 2022-12-22 | A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash… |
CVE-2022-43603 | Medium | 5.9 | 2022-12-22 | A denial of service vulnerability exists in the ZfileOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput… |
CVE-2022-43602 | High | 8.1 | 2022-12-22 | Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOut… |
CVE-2022-43601 | High | 8.1 | 2022-12-22 | Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOut… |
CVE-2022-43600 | High | 8.1 | 2022-12-22 | Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOut… |
CVE-2022-43599 | High | 8.1 | 2022-12-22 | Multiple code execution vulnerabilities exist in the IFFOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOut… |
CVE-2022-43598 | High | 8.1 | 2022-12-22 | Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially craf… |
CVE-2022-43597 | High | 8.1 | 2022-12-22 | Multiple memory corruption vulnerabilities exist in the IFFOutput alignment padding functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially craf… |
CVE-2022-43596 | Medium | 5.9 | 2022-12-22 | An information disclosure vulnerability exists in the IFFOutput channel interleaving functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially cra… |
CVE-2022-43595 | Medium | 5.9 | 2022-12-22 | Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted Image… |
CVE-2022-43594 | Medium | 5.9 | 2022-12-22 | Multiple denial of service vulnerabilities exist in the image output closing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially crafted Image… |
CVE-2022-43593 | Medium | 5.9 | 2022-12-22 | A denial of service vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOutput O… |
CVE-2022-43592 | Medium | 5.9 | 2022-12-22 | An information disclosure vulnerability exists in the DPXOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially crafted ImageOu… |
CVE-2022-41999 | High | 7.5 | 2022-12-22 | A denial of service vulnerability exists in the DDS native tile reading functionality of OpenImageIO Project OpenImageIO v2.3.19.0 and v2.4.4.2. A specially-cr… |
CVE-2022-41988 | High | 7.5 | 2022-12-22 | An information disclosure vulnerability exists in the OpenImageIO::decode_iptc_iim() functionality of OpenImageIO Project OpenImageIO v2.3.19.0. A specially-cr… |
CVE-2022-41981 | High | 8.1 | 2022-12-22 | A stack-based buffer overflow vulnerability exists in the TGA file format parser of OpenImageIO v2.3.19.0. A specially-crafted targa file can lead to out of bo… |
CVE-2022-41977 | Low | 3.3 | 2022-12-22 | An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially-crafted TIFF file… |
CVE-2022-41838 | Critical | 9.8 | 2022-12-22 | A code execution vulnerability exists in the DDS scanline parsing functionality of OpenImageIO Project OpenImageIO v2.4.4.2. A specially-crafted .dds can lead… |
CVE-2022-41837 | Critical | 9.8 | 2022-12-22 | An out-of-bounds write vulnerability exists in the OpenImageIO::add_exif_item_to_spec functionality of OpenImageIO Project OpenImageIO v2.4.4.2. Specially-craf… |
CVE-2022-41794 | Critical | 9.8 | 2022-12-22 | A heap based buffer overflow vulnerability exists in the PSD thumbnail resource parsing code of OpenImageIO 2.3.19.0. A specially-crafted PSD file can lead to… |
CVE-2022-41684 | Medium | 5.5 | 2022-12-22 | A heap out of bounds read vulnerability exists in the OpenImageIO master-branch-9aeece7a when parsing the image file directory part of a PSD image file. A spec… |
CVE-2022-41649 | Critical | 9.1 | 2022-12-22 | A heap out of bounds read vulnerability exists in the handling of IPTC data while parsing TIFF images in OpenImageIO v2.3.19.0. A specially-crafted TIFF file c… |
CVE-2022-41639 | Critical | 9.8 | 2022-12-22 | A heap based buffer overflow vulnerability exists in tile decoding code of TIFF image parser in OpenImageIO master-branch-9aeece7a and v2.3.19.0. A specially-c… |
CVE-2022-38143 | Critical | 9.8 | 2022-12-22 | A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to ar… |
CVE-2022-36354 | Medium | 5.3 | 2022-12-22 | A heap out-of-bounds read vulnerability exists in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, in the way run-… |
CVE-2022-22458 | Medium | 6.3 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 stores user credentials in plain clear text which can be read by a remote authenticated user. IBM X-Fo… |
CVE-2022-22457 | Medium | 5.3 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 stores sensitive information including user credentials in plain clear text which can be read by a loca… |
CVE-2022-22456 | Medium | 4.2 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript c… |
CVE-2022-22184 | High | 7.5 | 2022-12-22 | An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated net… |
CVE-2022-43859 | Medium | 6.3 | 2022-12-22 | IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to obtain sensitive information for an object they are authorized to but not while usin… |
CVE-2022-43858 | Medium | 4.3 | 2022-12-22 | IBM Navigator for i 7.3, 7.4, and 7.5 could allow an authenticated user to access the file system and download files they are authorized to but not while using… |
CVE-2022-43857 | Medium | 4.3 | 2022-12-22 | IBM Navigator for i 7.3, 7.4 and 7.5 could allow an authenticated user to access IBM Navigator for i log files they are authorized to but not while using this… |
CVE-2022-3805 | High | 8.6 | 2022-12-22 | The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and… |
CVE-2022-3794 | Medium | 5.4 | 2022-12-22 | The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticate… |
CVE-2022-46885 | High | 8.8 | 2022-12-22 | Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105. Some of these bugs showed evid… |
CVE-2022-46883 | High | 8.8 | 2022-12-22 | Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 106. Some of t… |
CVE-2022-46882 | Critical | 9.8 | 2022-12-22 | A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thun… |
CVE-2022-46881 | High | 8.8 | 2022-12-22 | An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash. *Note*: This advisory was ad… |
CVE-2022-46880 | Medium | 6.5 | 2022-12-22 | A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13t… |
CVE-2022-46879 | High | 8.8 | 2022-12-22 | Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Fi… |
CVE-2022-46878 | High | 8.8 | 2022-12-22 | Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of th… |
CVE-2022-46877 | Medium | 4.3 | 2022-12-22 | By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vu… |
CVE-2022-46875 | Medium | 6.5 | 2022-12-22 | The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue onl… |
CVE-2022-46874 | High | 8.8 | 2022-12-22 | A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potenti… |
CVE-2022-46873 | High | 8.8 | 2022-12-22 | Because Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject markup into a page otherwise protected by a… |
CVE-2022-46872 | High | 8.6 | 2022-12-22 | An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug… |
CVE-2022-46871 | High | 8.8 | 2022-12-22 | An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108. |
CVE-2022-45421 | High | 8.8 | 2022-12-22 | Mozilla developers Andrew McCreight and Gabriele Svelto reported memory safety bugs present in Thunderbird 102.4. Some of these bugs showed evidence of memory… |
CVE-2022-45420 | Medium | 6.5 | 2022-12-22 | Use tables inside of an iframe, an attacker could have caused iframe contents to be rendered outside the boundaries of the iframe, resulting in potential user… |
CVE-2022-45419 | Medium | 6.5 | 2022-12-22 | If the user added a security exception for an invalid TLS certificate, opened an ongoing TLS connection with a server that used that certificate, and then dele… |
CVE-2022-45418 | Medium | 6.1 | 2022-12-22 | If a custom mouse cursor is specified in CSS, under certain circumstances the cursor could have been drawn over the browser UI, resulting in potential user con… |
CVE-2022-45417 | Medium | 4.3 | 2022-12-22 | Service Workers did not detect Private Browsing Mode correctly in all cases, which could have led to Service Workers being written to disk for websites visited… |
CVE-2022-45416 | Medium | 6.5 | 2022-12-22 | Keyboard events reference strings like "KeyA" that were at fixed, known, and widely-spread addresses. Cache-based timing attacks such as Prime+Probe could have… |
CVE-2022-45415 | High | 7.8 | 2022-12-22 | When downloading an HTML file, if the title of the page was formatted as a filename with a malicious extension, Firefox may have saved the file with that exten… |
CVE-2022-45414 | High | 8.1 | 2022-12-22 | If a Thunderbird user quoted from an HTML email, for example by replying to the email, and the email contained either a VIDEO tag with the POSTER attribute or… |
CVE-2022-45413 | Medium | 6.1 | 2022-12-22 | Using the <code>S.browser_fallback_url parameter</code> parameter, an attacker could redirect a user to a URL and cause SameSite=Strict cookies to be sent.<br>… |
CVE-2022-45412 | High | 8.8 | 2022-12-22 | When resolving a symlink such as <code>file:///proc/self/fd/1</code>, an error message may be produced where the symlink was resolved to a string containing un… |
CVE-2022-45411 | Medium | 6.1 | 2022-12-22 | Cross-Site Tracing occurs when a server will echo a request back via the Trace method, allowing an XSS attack to access to authorization headers and cookies in… |
CVE-2022-45410 | Medium | 6.5 | 2022-12-22 | When a ServiceWorker intercepted a request with <code>FetchEvent</code>, the origin of the request was lost after the ServiceWorker took ownership of it. This… |
CVE-2022-45409 | High | 8.8 | 2022-12-22 | The garbage collector could have been aborted in several states and zones and <code>GCRuntime::finishCollection</code> may not have been called, leading to a u… |
CVE-2022-45408 | Medium | 6.5 | 2022-12-22 | Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in… |
CVE-2022-45407 | High | 7.5 | 2022-12-22 | If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred, leading to a potentially exploitable c… |
CVE-2022-45406 | Critical | 9.8 | 2022-12-22 | If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. Thi… |
CVE-2022-45405 | Medium | 6.5 | 2022-12-22 | Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash. This… |
CVE-2022-45404 | Medium | 6.5 | 2022-12-22 | Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification promp… |
CVE-2022-45403 | Medium | 6.5 | 2022-12-22 | Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range… |
CVE-2022-42932 | High | 8.8 | 2022-12-22 | Mozilla developers Ashley Hale and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105 and Firefox ESR 102.3. Some of these bugs showed… |
CVE-2022-42931 | Low | 3.3 | 2022-12-22 | Logins saved by Firefox should be managed by the Password Manager component which uses encryption to save files on-disk. Instead, the username (not password) w… |
CVE-2022-42930 | High | 7.1 | 2022-12-22 | If two Workers were simultaneously initializing their CacheStorage, a data race could have occurred in the `ThirdPartyUtil` component. This vulnerability affec… |