2022 CVEs (page 73)
Page 73 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22736 | High | 7.0 | 2022-12-22 | If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system librari… |
CVE-2022-22461 | Medium | 5.9 | 2022-12-22 | IBM Security Verify Governance, Identity Manager 10.0.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sens… |
CVE-2022-1887 | Critical | 9.8 | 2022-12-22 | The search term could have been specified externally to trigger SQL injection. This vulnerability affects Firefox for iOS < 101. |
CVE-2022-1834 | Medium | 6.5 | 2022-12-22 | When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displaye… |
CVE-2022-1802 | High | 8.8 | 2022-12-22 | If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-control… |
CVE-2022-1529 | High | 8.8 | 2022-12-22 | An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype polluti… |
CVE-2022-1520 | Medium | 4.3 | 2022-12-22 | When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encr… |
CVE-2022-1197 | Medium | 5.4 | 2022-12-22 | When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet r… |
CVE-2022-1196 | Medium | 6.5 | 2022-12-22 | After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnera… |
CVE-2022-1097 | Medium | 6.5 | 2022-12-22 | <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-fre… |
CVE-2022-0843 | High | 8.8 | 2022-12-22 | Mozilla developers Kershaw Chang, Ryan VanderMeulen, and Randell Jesup reported memory safety bugs present in Firefox 97. Some of these bugs showed evidence of… |
CVE-2022-0566 | High | 8.8 | 2022-12-22 | It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message… |
CVE-2022-0517 | High | 7.8 | 2022-12-22 | Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitr… |
CVE-2022-0511 | High | 8.8 | 2022-12-22 | Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen, and the Mozilla Fuzzing Team reported m… |
CVE-2022-46170 | High | 8.6 | 2022-12-22 | CodeIgniter is a PHP full-stack web framework. When an application uses (1) multiple session cookies (e.g., one for user pages and one for admin pages) and (2)… |
CVE-2022-23556 | High | 7.0 | 2022-12-22 | CodeIgniter is a PHP full-stack web framework. This vulnerability may allow attackers to spoof their IP address when the server is behind a reverse proxy. This… |
CVE-2022-23540 | Medium | 6.4 | 2022-12-22 | In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to def… |
CVE-2022-47926 | Critical | 9.8 | 2022-12-22 | AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php |
CVE-2022-46102 | Critical | 9.8 | 2022-12-22 | AyaCMS 3.1.2 is vulnerable to Arbitrary file upload via /aya/module/admin/fst_down.inc.php |
CVE-2022-46101 | High | 8.8 | 2022-12-22 | AyaCMS v3.1.2 was found to have a code flaw in the ust_sql.inc.php file, which allows attackers to cause command execution by inserting malicious code. |
CVE-2022-23541 | Medium | 5.0 | 2022-12-22 | jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented k… |
CVE-2022-44510 | Medium | 5.4 | 2022-12-22 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-45966 | Critical | 9.8 | 2022-12-22 | here is an arbitrary file upload vulnerability in the file management function module of Classcms3.5. |
CVE-2022-47896 | Medium | 5.0 | 2022-12-22 | In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks. |
CVE-2022-47895 | Medium | 4.7 | 2022-12-22 | In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files. |
CVE-2022-45347 | Critical | 9.8 | 2022-12-22 | Apache ShardingSphere-Proxy prior to 5.3.0 when using MySQL as database backend didn't cleanup the database session completely after client authentication fail… |
CVE-2022-41697 | Medium | 5.3 | 2022-12-22 | A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request can lead to a disclosure o… |
CVE-2022-41654 | Medium | 4.3 | 2022-12-22 | An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. A specially-crafted HTTP request ca… |
CVE-2022-25948 | Medium | 5.3 | 2022-12-22 | The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in leaking properties o… |
CVE-2022-4647 | Medium | 6.1 | 2022-12-22 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-4646 | Medium | 6.5 | 2022-12-22 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4. |
CVE-2022-43271 | Medium | 5.4 | 2022-12-22 | Inhabit Systems Pty Ltd Move CRM version 4, build 260 was discovered to contain a cross-site scripting (XSS) vulnerability via the User profile component. |
CVE-2022-4644 | Medium | 6.1 | 2022-12-22 | Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.4. |
CVE-2022-3189 | Medium | 5.3 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to… |
CVE-2022-3188 | Medium | 5.3 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages without authentication an… |
CVE-2022-3187 | Medium | 5.3 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate when a valid connection is established wit… |
CVE-2022-3186 | High | 8.6 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main manage… |
CVE-2022-3185 | Medium | 5.3 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensitive data concerning the device. |
CVE-2022-3184 | Critical | 9.8 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated users to access an o… |
CVE-2022-3183 | Critical | 9.8 | 2022-12-21 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provided by the user, whic… |
CVE-2022-4643 | Medium | 6.3 | 2022-12-21 | A vulnerability was found in docconv up to 1.2.0. It has been declared as critical. This vulnerability affects the function ConvertPDFImages of the file pdf_oc… |
CVE-2022-4642 | Low | 3.5 | 2022-12-21 | A vulnerability was found in tatoeba2. It has been classified as problematic. This affects an unknown part of the component Profile Name Handler. The manipulat… |
CVE-2022-4641 | Low | 2.5 | 2022-12-21 | A vulnerability was found in pig-vector and classified as problematic. Affected by this issue is the function LogisticRegression of the file src/main/java/org/… |
CVE-2022-4640 | Low | 3.5 | 2022-12-21 | A vulnerability has been found in Mingsoft MCMS 5.2.9 and classified as problematic. Affected by this vulnerability is the function save of the component Artic… |
CVE-2022-4639 | Medium | 5.6 | 2022-12-21 | A vulnerability, which was classified as critical, has been found in sslh. This issue affects the function hexdump of the file probe.c of the component Packet… |
CVE-2022-4638 | Low | 3.5 | 2022-12-21 | A vulnerability classified as problematic was found in collective.contact.widget up to 1.12. This vulnerability affects the function title of the file src/coll… |
CVE-2022-4637 | Low | 3.5 | 2022-12-21 | A vulnerability classified as problematic has been found in ep3-bs up to 1.7.x. This affects an unknown part. The manipulation leads to cross site scripting. I… |
CVE-2022-46334 | High | 7.8 | 2022-12-21 | Proofpoint Enterprise Protection (PPS/PoD) contains a vulnerability which allows the pps user to escalate to root privileges due to unnecessary permissions. Th… |
CVE-2022-23551 | Medium | 5.3 | 2022-12-21 | aad-pod-identity assigns Azure Active Directory identities to Kubernetes applications and has now been deprecated as of 24 October 2022. The NMI component in A… |
CVE-2022-4633 | Medium | 4.3 | 2022-12-21 | A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src… |
CVE-2022-4632 | Low | 3.5 | 2022-12-21 | A vulnerability has been found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The… |
CVE-2022-4631 | Low | 3.5 | 2022-12-21 | A vulnerability, which was classified as problematic, was found in WP-Ban. Affected is an unknown function of the file ban-options.php. The manipulation leads… |
CVE-2022-46096 | Medium | 6.1 | 2022-12-21 | A Cross site scripting (XSS) vulnerability in Sourcecodester Online Covid-19 Directory on Vaccination System v1.0 allows attackers to execute arbitrary code vi… |
CVE-2022-46095 | Medium | 6.1 | 2022-12-21 | Sourcecodester Covid-19 Directory on Vaccination System 1.0 was discovered to contain a Cross-Site Scripting (XSS) vulnerability via verification.php because t… |
CVE-2022-36222 | High | 8.4 | 2022-12-21 | Nokia Fastmile 3tg00118abad52 devices shipped by Optus are shipped with a default hardcoded admin account of admin:Nq+L5st7o This account can be used locally t… |
CVE-2022-36221 | Medium | 6.5 | 2022-12-21 | Nokia Fastmile 3tg00118abad52 is affected by an authenticated path traversal vulnerability which allows attackers to read any named pipe file on the system. |
CVE-2022-4630 | Medium | 5.3 | 2022-12-21 | Sensitive Cookie Without 'HttpOnly' Flag in GitHub repository lirantal/daloradius prior to master. |
CVE-2022-40841 | Medium | 6.1 | 2022-12-21 | A cross-site scripting (XSS) vulnerability in NdkAdvancedCustomizationFields v3.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted pay… |
CVE-2022-4287 | High | 8.8 | 2022-12-21 | Authentication bypass in local application lock feature in Devolutions Remote Desktop Manager 2022.3.26 and earlier on Windows allows malicious user to access… |
CVE-2022-47581 | High | 7.5 | 2022-12-21 | Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request. |
CVE-2022-44756 | Medium | 6.4 | 2022-12-21 | Insights for Vulnerability Remediation (IVR) is vulnerable to improper input validation. This may lead to information disclosure. This requires privileged ac… |
CVE-2022-42454 | Medium | 6.4 | 2022-12-21 | Insights for Vulnerability Remediation (IVR) is vulnerable to man-in-the-middle attacks that may lead to information disclosure. This requires privileged netw… |
CVE-2022-38655 | Medium | 6.4 | 2022-12-21 | BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES S… |
CVE-2022-40145 | Critical | 9.8 | 2022-12-21 | This vulnerable is about a potential code injection when an attacker has control of the target LDAP server using in the JDBC JNDI URL. The function jaas.modul… |
CVE-2022-38065 | High | 8.8 | 2022-12-21 | A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality wit… |
CVE-2022-38060 | High | 8.8 | 2022-12-21 | A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a con… |
CVE-2022-46662 | Medium | 6.7 | 2022-12-21 | Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious e… |
CVE-2022-46330 | High | 7.8 | 2022-12-21 | Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by… |
CVE-2022-46282 | High | 7.8 | 2022-12-21 | Use after free vulnerability in CX-Drive V3.00 and earlier allows a local attacker to execute arbitrary code by having a user to open a specially crafted file, |
CVE-2022-44449 | Medium | 4.8 | 2022-12-21 | Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to i… |
CVE-2022-43543 | Medium | 5.4 | 2022-12-21 | KDDI +Message App, NTT DOCOMO +Message App, and SoftBank +Message App contain a vulnerability caused by improper handling of Unicode control characters. +Messa… |
CVE-2022-47635 | Critical | 9.8 | 2022-12-21 | Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via ZohoClient.php. |
CVE-2022-25929 | Medium | 5.4 | 2022-12-21 | The package smoothie from 1.31.0 and before 1.36.1 are vulnerable to Cross-site Scripting (XSS) due to improper user input sanitization in strokeStyle and tool… |
CVE-2022-25895 | High | 7.5 | 2022-12-21 | All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url use… |
CVE-2022-25893 | Critical | 9.8 | 2022-12-21 | The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting… |
CVE-2022-24431 | High | 7.4 | 2022-12-21 | All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization. |
CVE-2022-38546 | Medium | 5.3 | 2022-12-21 | A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker to access the DNS s… |
CVE-2022-4617 | Medium | 6.1 | 2022-12-21 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-42949 | High | 7.5 | 2022-12-21 | Silverstripe silverstripe/subsites through 2.6.0 has Insecure Permissions. |
CVE-2022-47629 | Critical | 9.8 | 2022-12-20 | Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. |
CVE-2022-42046 | High | 7.8 | 2022-12-20 | wfshbr64.sys and wfshbr32.sys specially crafted IOCTL allows arbitrary user to perform local privilege escalation |
CVE-2022-46328 | High | 7.5 | 2022-12-20 | Some smartphones have the input validation vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-46327 | Critical | 9.8 | 2022-12-20 | Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause privilege escalation, which results in system service excep… |
CVE-2022-46326 | Critical | 9.8 | 2022-12-20 | Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions. |
CVE-2022-46325 | Critical | 9.8 | 2022-12-20 | Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions. |
CVE-2022-46324 | Critical | 9.8 | 2022-12-20 | Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions. |
CVE-2022-46323 | Critical | 9.8 | 2022-12-20 | Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause system service exceptions. |
CVE-2022-46322 | High | 7.5 | 2022-12-20 | Some smartphones have the out-of-bounds write vulnerability. Successful exploitation of this vulnerability may cause system service exceptions. |
CVE-2022-46321 | High | 7.5 | 2022-12-20 | The Wi-Fi module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-46320 | Critical | 9.8 | 2022-12-20 | The kernel module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may cause memory overwriting. |
CVE-2022-46319 | Critical | 9.8 | 2022-12-20 | Fingerprint calibration has a vulnerability of lacking boundary judgment. Successful exploitation of this vulnerability may cause out-of-bounds write. |
CVE-2022-46318 | Medium | 5.3 | 2022-12-20 | The HAware module has a function logic error. Successful exploitation of this vulnerability will affect the account removal function in Settings. |
CVE-2022-46317 | High | 7.5 | 2022-12-20 | The power consumption module has an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-46316 | Critical | 9.8 | 2022-12-20 | A thread security vulnerability exists in the authentication process. Successful exploitation of this vulnerability may affect data integrity, confidentiality… |
CVE-2022-46315 | High | 7.5 | 2022-12-20 | The ProfileSDK has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-46314 | High | 7.5 | 2022-12-20 | The IPC module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-46313 | Medium | 5.3 | 2022-12-20 | The sensor privacy module has an authentication vulnerability. Successful exploitation of this vulnerability may cause unavailability of the smartphone's camer… |
CVE-2022-46312 | High | 7.5 | 2022-12-20 | The application management module has a vulnerability in permission verification. Successful exploitation of this vulnerability causes unexpected clear of devi… |
CVE-2022-46311 | High | 7.5 | 2022-12-20 | The contacts component has a free (undefined) provider vulnerability. Successful exploitation of this vulnerability may affect data integrity. |
CVE-2022-46310 | High | 7.5 | 2022-12-20 | The TelephonyProvider module has a vulnerability in obtaining values.Successful exploitation of this vulnerability may affect data confidentiality. |