2022 CVEs (page 78)
Page 78 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20523 | Medium | 5.5 | 2022-12-16 | In IncFs_GetFilledRangesStartingFrom of incfs.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information d… |
CVE-2022-20522 | High | 7.8 | 2022-12-16 | In getSlice of ProviderModelSlice.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no addit… |
CVE-2022-20521 | Medium | 5.0 | 2022-12-16 | In sdpu_find_most_specific_service_uuid of sdp_utils.cc, there is a possible way to crash Bluetooth due to a missing null check. This could lead to local denia… |
CVE-2022-20520 | High | 7.8 | 2022-12-16 | In onCreate of various files, there is a possible tapjacking/overlay attack. This could lead to local escalation of privilege or denial of server with User exe… |
CVE-2022-20519 | Low | 3.3 | 2022-12-16 | In onCreate of AddAppNetworksActivity.java, there is a possible way for a guest user to configure WiFi networks due to a missing permission check. This could l… |
CVE-2022-20518 | Medium | 5.5 | 2022-12-16 | In query of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with Use… |
CVE-2022-20517 | Medium | 5.5 | 2022-12-16 | In getMessagesByPhoneNumber of MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information… |
CVE-2022-20516 | High | 7.5 | 2022-12-16 | In rw_t3t_act_handle_check_ndef_rsp of rw_t3t.cc, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disc… |
CVE-2022-20515 | Medium | 5.5 | 2022-12-16 | In onPreferenceClick of AccountTypePreferenceLoader.java, there is a possible way to retrieve protected files from the Settings app due to a confused deputy. T… |
CVE-2022-20514 | Medium | 6.7 | 2022-12-16 | In acquireFabricatedOverlayIterator, nextFabricatedOverlayInfos, and releaseFabricatedOverlayIterator of Idmap2Service.cpp, there is a possible out of bounds w… |
CVE-2022-20513 | Medium | 5.5 | 2022-12-16 | In decrypt_1_2 of CryptoPlugin.cpp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with… |
CVE-2022-20512 | High | 7.8 | 2022-12-16 | In navigateUpTo of Task.java, there is a possible way to launch an intent handler with a mismatched intent due to improper input validation. This could lead to… |
CVE-2022-20511 | Medium | 5.5 | 2022-12-16 | In getNearbyAppStreamingPolicy of DevicePolicyManagerService.java, there is a missing permission check. This could lead to local information disclosure with no… |
CVE-2022-20510 | Medium | 5.5 | 2022-12-16 | In getNearbyNotificationStreamingPolicy of DevicePolicyManagerService.java, there is a possible way to learn about the notification streaming policy of other u… |
CVE-2022-20509 | Medium | 6.7 | 2022-12-16 | In mapGrantorDescr of MessageQueueBase.h, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privile… |
CVE-2022-20508 | High | 7.8 | 2022-12-16 | In onAttach of ConfigureWifiSettings.java, there is a possible way for a guest user to change WiFi settings due to a permissions bypass. This could lead to loc… |
CVE-2022-20507 | High | 7.8 | 2022-12-16 | In onMulticastListUpdateNotificationReceived of UwbEventManager.java, there is a possible arbitrary code execution due to a missing bounds check. This could le… |
CVE-2022-20506 | High | 7.8 | 2022-12-16 | In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of privilege from a guest user with no additio… |
CVE-2022-20505 | Medium | 6.7 | 2022-12-16 | In openFile of CallLogProvider.java, there is a possible permission bypass due to a path traversal error. This could lead to local escalation of privilege with… |
CVE-2022-20504 | Medium | 6.7 | 2022-12-16 | In multiple locations of DreamManagerService.java, there is a missing permission check. This could lead to local escalation of privilege and dismissal of syste… |
CVE-2022-20503 | High | 7.8 | 2022-12-16 | In onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration due to a missing permission check. This c… |
CVE-2022-20199 | Medium | 5.5 | 2022-12-16 | In multiple locations of NfcService.java, there is a possible disclosure of NFC tags due to a confused deputy. This could lead to local information disclosure… |
CVE-2022-47377 | Critical | 9.8 | 2022-12-16 | Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the… |
CVE-2022-3109 | High | 7.5 | 2022-12-16 | An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null… |
CVE-2022-4555 | Medium | 6.5 | 2022-12-16 | The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in ve… |
CVE-2022-41963 | Low | 2.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but… |
CVE-2022-36223 | Medium | 6.1 | 2022-12-16 | In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the… |
CVE-2022-46870 | Medium | 5.4 | 2022-12-16 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbi… |
CVE-2022-41962 | Low | 2.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status… |
CVE-2022-41961 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple… |
CVE-2022-41960 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in D… |
CVE-2022-46393 | Critical | 9.8 | 2022-12-15 | An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS… |
CVE-2022-46392 | Medium | 5.3 | 2022-12-15 | An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically… |
CVE-2022-45969 | Critical | 9.8 | 2022-12-15 | Alist v3.4.0 is vulnerable to Directory Traversal, |
CVE-2022-45338 | High | 7.8 | 2022-12-15 | An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 b… |
CVE-2022-40004 | Critical | 9.6 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log. |
CVE-2022-46634 | Critical | 9.8 | 2022-12-15 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiWpsCfg f… |
CVE-2022-46631 | Critical | 9.8 | 2022-12-15 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiSignalCf… |
CVE-2022-4527 | Low | 3.5 | 2022-12-15 | A vulnerability was found in collective.task up to 3.0.8. It has been classified as problematic. This affects the function renderCell/AssignedGroupColumn of th… |
CVE-2022-4526 | Low | 3.5 | 2022-12-15 | A vulnerability was found in django-photologue up to 3.15.1 and classified as problematic. Affected by this issue is some unknown functionality of the file pho… |
CVE-2022-4525 | Low | 3.5 | 2022-12-15 | A vulnerability has been found in National Sleep Research Resource sleepdata.org up to 58.x and classified as problematic. Affected by this vulnerability is an… |
CVE-2022-4524 | Low | 3.5 | 2022-12-15 | A vulnerability, which was classified as problematic, was found in Roots soil Plugin up to 4.0.x. Affected is the function language_attributes of the file src/… |
CVE-2022-4523 | Low | 3.5 | 2022-12-15 | A vulnerability, which was classified as problematic, has been found in vexim2. This issue affects some unknown processing. The manipulation leads to cross sit… |
CVE-2022-4522 | Low | 3.5 | 2022-12-15 | A vulnerability classified as problematic was found in CalendarXP up to 10.0.1. This vulnerability affects unknown code. The manipulation leads to cross site s… |
CVE-2022-4521 | Low | 3.5 | 2022-12-15 | A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request Parameter H… |
CVE-2022-4520 | Low | 3.5 | 2022-12-15 | A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2022-4519 | Medium | 5.5 | 2022-12-15 | The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insuffic… |
CVE-2022-4514 | Low | 3.5 | 2022-12-15 | A vulnerability, which was classified as problematic, was found in Opencaching Deutschland oc-server3. Affected is an unknown function of the file htdocs/lang/… |
CVE-2022-4513 | Low | 3.5 | 2022-12-15 | A vulnerability, which was classified as problematic, has been found in European Environment Agency eionet.contreg. This issue affects some unknown processing… |
CVE-2022-4511 | Medium | 5.3 | 2022-12-15 | A vulnerability has been found in RainyGao DocSys and classified as critical. Affected by this vulnerability is an unknown functionality of the component com.D… |
CVE-2022-46702 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to disclose kernel memory. |
CVE-2022-46701 | High | 7.8 | 2022-12-15 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious… |
CVE-2022-46700 | High | 8.8 | 2022-12-15 | A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadO… |
CVE-2022-46699 | High | 8.8 | 2022-12-15 | A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS… |
CVE-2022-46698 | Medium | 6.5 | 2022-12-15 | A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPad… |
CVE-2022-46697 | High | 7.8 | 2022-12-15 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary c… |
CVE-2022-46696 | High | 8.8 | 2022-12-15 | A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS… |
CVE-2022-46695 | Medium | 6.5 | 2022-12-15 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1… |
CVE-2022-46694 | High | 7.8 | 2022-12-15 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS… |
CVE-2022-46693 | High | 7.8 | 2022-12-15 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 1… |
CVE-2022-46692 | Medium | 5.5 | 2022-12-15 | A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7… |
CVE-2022-46691 | High | 8.8 | 2022-12-15 | A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadO… |
CVE-2022-46690 | High | 7.8 | 2022-12-15 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watc… |
CVE-2022-46689 | High | 7.0 | 2022-12-15 | A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, i… |
CVE-2022-45033 | Medium | 5.4 | 2022-12-15 | A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2022-44588 | Critical | 9.9 | 2022-12-15 | Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress. |
CVE-2022-44236 | Critical | 9.8 | 2022-12-15 | Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability. |
CVE-2022-44235 | Medium | 6.1 | 2022-12-15 | Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-42867 | High | 8.8 | 2022-12-15 | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16… |
CVE-2022-42866 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app m… |
CVE-2022-42865 | Medium | 5.5 | 2022-12-15 | This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may… |
CVE-2022-42864 | High | 7.0 | 2022-12-15 | A race condition was addressed with improved state handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2… |
CVE-2022-42863 | High | 8.8 | 2022-12-15 | A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS… |
CVE-2022-42862 | Medium | 5.5 | 2022-12-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to bypass Pri… |
CVE-2022-42861 | High | 8.8 | 2022-12-15 | This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadO… |
CVE-2022-42859 | Medium | 5.5 | 2022-12-15 | Multiple issues were addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, watchOS 9.2. An app may be… |
CVE-2022-42856 | High | 8.8 | 2022-12-15 | A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15… |
CVE-2022-42855 | High | 7.1 | 2022-12-15 | A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS… |
CVE-2022-42854 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1. An app may be able to disclose kernel… |
CVE-2022-42853 | Medium | 5.5 | 2022-12-15 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may be able to modify protected parts of the… |
CVE-2022-42852 | Medium | 6.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16… |
CVE-2022-42851 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2. Parsing a maliciously crafted TIFF file may… |
CVE-2022-42850 | High | 7.8 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to execute arbitrary code with kerne… |
CVE-2022-42849 | High | 7.8 | 2022-12-15 | An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS… |
CVE-2022-42848 | High | 7.8 | 2022-12-15 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2. An app may be able… |
CVE-2022-42847 | High | 7.8 | 2022-12-15 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary c… |
CVE-2022-42846 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2. Parsing a maliciously cra… |
CVE-2022-42845 | High | 7.2 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 1… |
CVE-2022-42844 | High | 8.6 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to break out of its sandbox. |
CVE-2022-42843 | Medium | 5.5 | 2022-12-15 | This issue was addressed with improved data protection. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. A user may… |
CVE-2022-42842 | Critical | 9.8 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 1… |
CVE-2022-42841 | High | 7.8 | 2022-12-15 | A type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2. Processing a… |
CVE-2022-42840 | High | 7.8 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and i… |
CVE-2022-42837 | Critical | 9.8 | 2022-12-15 | An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventur… |
CVE-2022-42821 | Medium | 5.5 | 2022-12-15 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatek… |
CVE-2022-42805 | High | 7.8 | 2022-12-15 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to e… |
CVE-2022-40373 | Medium | 5.4 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file. |
CVE-2022-40002 | Medium | 5.4 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify. |
CVE-2022-40001 | Medium | 5.4 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page. |
CVE-2022-40000 | Medium | 5.4 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page. |