2022 CVEs (page 74)
Page 74 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43382 | Medium | 6.2 | 2022-12-20 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a local user with elevated privileges to exploit a vulnerability in the lpd daemon to cause a denial of service… |
CVE-2022-41599 | High | 7.5 | 2022-12-20 | The system service has a vulnerability that causes incorrect return values. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-41596 | High | 7.5 | 2022-12-20 | The system tool has inconsistent serialization and deserialization. Successful exploitation of this vulnerability will cause unauthorized startup of components. |
CVE-2022-41591 | High | 7.5 | 2022-12-20 | The backup module has a path traversal vulnerability. Successful exploitation of this vulnerability causes unauthorized access to other system files. |
CVE-2022-41590 | Medium | 5.5 | 2022-12-20 | Some smartphones have authentication-related (including session management) vulnerabilities as the setup wizard is bypassed. Successful exploitation of this vu… |
CVE-2022-39166 | Medium | 4.4 | 2022-12-20 | IBM Security Guardium 11.4 could allow a privileged user to obtain sensitive information inside of an HTTP response. IBM X-Force ID: 235405. |
CVE-2022-38733 | High | 8.6 | 2022-12-20 | OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component. |
CVE-2022-38391 | Medium | 5.1 | 2022-12-20 | IBM Spectrum Control 5.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force… |
CVE-2022-23542 | High | 7.7 | 2022-12-20 | OpenFGA is an authorization/permission engine built for developers and inspired by Google Zanzibar. During an internal security assessment, it was discovered t… |
CVE-2022-46914 | High | 8.8 | 2022-12-20 | An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to execute arbitrary code or cause a Denial… |
CVE-2022-46912 | High | 8.8 | 2022-12-20 | An issue in the firmware update process of TP-Link TL-WR841N / TL-WA841ND V7 3.13.9 and earlier allows attackers to execute arbitrary code or cause a Denial of… |
CVE-2022-46910 | High | 8.8 | 2022-12-20 | An issue in the firmware update process of TP-Link TL-WA901ND V1 up to v3.11.2 and TL-WA901N V2 up to v3.12.16 allows attackers to execute arbitrary code or ca… |
CVE-2022-46771 | Medium | 4.6 | 2022-12-20 | IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.18, 7.0.5.0 through 7.0.5.13, 7.1.0.0 through 7.1.2.9, 7.2.0.0 through 7.2.3.2 and 7.3.0.0 is vulnerable to c… |
CVE-2022-46435 | High | 8.8 | 2022-12-20 | An issue in the firmware update process of TP-Link TL-WR941ND V2/V3 up to 3.13.9 and TL-WR941ND V4 up to 3.12.8 allows attackers to execute arbitrary code or c… |
CVE-2022-46434 | High | 7.5 | 2022-12-20 | An issue in the firmware update process of TP-Link TL-WA7510N v1 v3.12.6 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (D… |
CVE-2022-46432 | High | 7.5 | 2022-12-20 | An exploitable firmware modification vulnerability was discovered on TP-Link TL-WR743ND V1. An attacker can conduct a MITM (Man-in-the-Middle) attack to modify… |
CVE-2022-46430 | Medium | 4.8 | 2022-12-20 | TP-Link TL-WR740N V1 and V2 v3.12.4 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a cra… |
CVE-2022-46428 | Medium | 4.8 | 2022-12-20 | TP-Link TL-WR1043ND V1 3.13.15 and earlier allows authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted… |
CVE-2022-46424 | High | 8.1 | 2022-12-20 | An exploitable firmware modification vulnerability was discovered on the Netgear XWN5001 Powerline 500 WiFi Access Point. An attacker can conduct a MITM (Man-i… |
CVE-2022-46423 | High | 8.1 | 2022-12-20 | An exploitable firmware modification vulnerability was discovered on the Netgear WNR2000v1 router. An attacker can conduct a MITM (Man-in-the-Middle) attack to… |
CVE-2022-46422 | Medium | 4.8 | 2022-12-20 | An issue in Netgear WNR2000 v1 1.2.3.7 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image dur… |
CVE-2022-46139 | Medium | 6.5 | 2022-12-20 | TP-Link TL-WR940N V4 3.16.9 and earlier allows authenticated attackers to cause a Denial of Service (DoS) via uploading a crafted firmware image during the fir… |
CVE-2022-39304 | Medium | 5.0 | 2022-12-20 | ghinstallation provides transport, which implements http.RoundTripper to provide authentication as an installation for GitHub Apps. In ghinstallation version 1… |
CVE-2022-38873 | High | 7.5 | 2022-12-20 | D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1… |
CVE-2022-4515 | High | 7.8 | 2022-12-20 | A flaw was found in Exuberant Ctags in the way it handles the "-o" option. This option specifies the tag filename. A crafted tag filename specified in the comm… |
CVE-2022-43875 | Medium | 6.2 | 2022-12-20 | IBM Financial Transaction Manager for SWIFT Services for Multiplatforms 3.2.4 could allow an authenticated user to lock additional RM authorizations, resulting… |
CVE-2022-43872 | Medium | 5.3 | 2022-12-20 | IBM Financial Transaction Manager 3.2.4 authorization checks are done incorrectly for some HTTP requests which allows getting unauthorized technical informati… |
CVE-2022-23537 | Medium | 6.5 | 2022-12-20 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2022-46076 | High | 7.5 | 2022-12-20 | D-Link DIR-869 DIR869Ax_FW102B15 is vulnerable to Authentication Bypass via phpcgi. |
CVE-2022-4619 | Medium | 5.5 | 2022-12-20 | The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and… |
CVE-2022-46020 | Critical | 9.8 | 2022-12-20 | WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. |
CVE-2022-46551 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the time parameter at /goform/saveParentControlInfo. |
CVE-2022-46550 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the urls parameter at /goform/saveParentControlInfo. |
CVE-2022-46549 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/saveParentControlInfo. |
CVE-2022-46548 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/DhcpListClient. |
CVE-2022-46547 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/VirtualSer. |
CVE-2022-46546 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/RouteStatic. |
CVE-2022-46545 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting. |
CVE-2022-46544 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the cmdinput parameter at /goform/exeCommand. |
CVE-2022-46543 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mitInterface parameter at /goform/addressNat. |
CVE-2022-46542 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/addressNat. |
CVE-2022-46541 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the ssid parameter at /goform/fast_setting_wifi_set. |
CVE-2022-46540 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/addressNat. |
CVE-2022-46539 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security_5g parameter at /goform/WifiBasicSet. |
CVE-2022-46538 | Critical | 9.8 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a command injection vulnerability via the mac parameter at /goform/WriteFacMac. |
CVE-2022-46537 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security parameter at /goform/WifiBasicSet. |
CVE-2022-46536 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeedUp parameter at /goform/SetClientState. |
CVE-2022-46535 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/SetClientState. |
CVE-2022-46534 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the speed_dir parameter at /goform/SetSpeedWan. |
CVE-2022-46533 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeed parameter at /goform/SetClientState. |
CVE-2022-46532 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceMac parameter at /goform/addWifiMacFilter. |
CVE-2022-46531 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/addWifiMacFilter. |
CVE-2022-46530 | High | 7.5 | 2022-12-20 | Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mac parameter at /goform/GetParentControlInfo. |
CVE-2022-45666 | High | 7.5 | 2022-12-20 | Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDset function. |
CVE-2022-45665 | High | 7.5 | 2022-12-20 | Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the funcpara1 parameter in the formSetCfm function. |
CVE-2022-44643 | Medium | 5.7 | 2022-12-20 | A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy… |
CVE-2022-40624 | Critical | 9.8 | 2022-12-20 | pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than… |
CVE-2022-45942 | High | 8.8 | 2022-12-20 | A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4. |
CVE-2022-46421 | Critical | 9.8 | 2022-12-20 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.Th… |
CVE-2022-25940 | High | 7.5 | 2022-12-20 | All versions of package lite-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes control characters that the d… |
CVE-2022-25931 | High | 7.5 | 2022-12-20 | All versions of package easy-static-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employed to the req.url… |
CVE-2022-25904 | High | 7.5 | 2022-12-20 | All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.prototype.Consolidat… |
CVE-2022-25171 | High | 7.4 | 2022-12-20 | The package p4 before 0.0.7 are vulnerable to Command Injection via the run() function due to improper input sanitization |
CVE-2022-47578 | High | 7.1 | 2022-12-20 | An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on US… |
CVE-2022-47577 | High | 7.1 | 2022-12-20 | An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on US… |
CVE-2022-47551 | Medium | 6.5 | 2022-12-20 | Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman pro… |
CVE-2022-46403 | High | 8.6 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) mishandles reject messages. |
CVE-2022-46402 | Medium | 6.5 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PairCon_rmSend with incorrect values. |
CVE-2022-46401 | Medium | 5.4 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) accepts PauseEncReqPlainText before pairing is complete. |
CVE-2022-46400 | Medium | 5.4 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) allows attackers to bypass passkey entry in legacy pairi… |
CVE-2022-46399 | High | 7.5 | 2022-12-19 | The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero. |
CVE-2022-44109 | Critical | 9.8 | 2022-12-19 | pdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream::makeFilter(char*, Stream*, Object*, int). |
CVE-2022-44108 | Critical | 9.8 | 2022-12-19 | pdftojson commit 94204bb was discovered to contain a stack overflow via the component Object::copy(Object*):Object.cc. |
CVE-2022-3752 | High | 8.6 | 2022-12-19 | An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-of-service conditio… |
CVE-2022-44940 | Critical | 9.1 | 2022-12-19 | Patchelf v0.9 was discovered to contain an out-of-bounds read via the function modifyRPath at src/patchelf.cc. |
CVE-2022-40434 | Critical | 9.8 | 2022-12-19 | Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page. |
CVE-2022-23543 | Medium | 6.3 | 2022-12-19 | Silverware Games is a social network where people can play games online. Users can attach URLs to YouTube videos, the site will generate related `<iframe>` whe… |
CVE-2022-23536 | Medium | 6.5 | 2022-12-19 | Cortex provides multi-tenant, long term storage for Prometheus. A local file inclusion vulnerability exists in Cortex versions 1.13.0, 1.13.1 and 1.14.0, where… |
CVE-2022-45041 | High | 7.5 | 2022-12-19 | SQL Injection exits in xinhu < 2.5.0 |
CVE-2022-43887 | Medium | 5.3 | 2022-12-19 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to sensitive information exposure by passing API keys to log files. If these keys contain… |
CVE-2022-43883 | Medium | 6.5 | 2022-12-19 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by constructing URLs from user-controlled data. This could enabl… |
CVE-2022-39160 | Medium | 6.1 | 2022-12-19 | IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2022-38708 | Medium | 6.5 | 2022-12-19 | IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-contro… |
CVE-2022-4615 | Medium | 6.1 | 2022-12-19 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4614 | Medium | 5.4 | 2022-12-19 | Cross-site Scripting (XSS) - Stored in GitHub repository alagrede/znote-app prior to 1.7.11. |
CVE-2022-44488 | Low | 3.5 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authe… |
CVE-2022-44474 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44471 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44470 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44467 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44466 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44465 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44463 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42365 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42364 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42362 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42357 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42356 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42354 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42352 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |