2022 CVEs (page 83)
Page 83 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43541 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |
CVE-2022-43518 | Medium | 4.9 | 2022-12-12 | An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise web interface. Successful exploitation of this vulnerability results i… |
CVE-2022-42446 | Medium | 6.5 | 2022-12-12 | Starting with Sametime 12, anonymous users are enabled by default. After logging in as an anonymous user, one has the ability to browse the User Directory and… |
CVE-2022-42445 | Medium | 4.9 | 2022-12-12 | HCL Launch could allow a user with administrative privileges, including "Manage Security" permissions, the ability to recover a credential previously saved for… |
CVE-2022-3510 | High | 7.5 | 2022-12-12 | A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 c… |
CVE-2022-3509 | High | 7.5 | 2022-12-12 | A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a… |
CVE-2022-38661 | Medium | 6.2 | 2022-12-12 | HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash. |
CVE-2022-38656 | High | 8.6 | 2022-12-12 | HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes. |
CVE-2022-38395 | High | 7.8 | 2022-12-12 | HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an… |
CVE-2022-37932 | High | 8.8 | 2022-12-12 | A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability co… |
CVE-2022-37930 | Medium | 6.7 | 2022-12-12 | A security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays and HPE Nimble Storage Secondary Flash Arrays which could potentially al… |
CVE-2022-37929 | Medium | 6.7 | 2022-12-12 | Improper Privilege Management vulnerability in Hewlett Packard Enterprise Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary Flash Arrays. |
CVE-2022-37928 | High | 8.0 | 2022-12-12 | Insufficient Verification of Data Authenticity vulnerability in Hewlett Packard Enterprise HPE Nimble Storage Hybrid Flash Arrays and Nimble Storage Secondary… |
CVE-2022-37927 | Medium | 6.1 | 2022-12-12 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Hewlett Packard Enterprise HPE OneView Global Dashboard (OVGD). |
CVE-2022-37926 | Medium | 5.5 | 2022-12-12 | A vulnerability within the web-based management interface of EdgeConnect Enterprise could allow a remote attacker to conduct a stored cross-site scripting (XSS… |
CVE-2022-37925 | Medium | 6.1 | 2022-12-12 | A vulnerability within the web-based management interface of Aruba EdgeConnect Enterprise could allow a remote attacker to conduct a reflected cross-site scrip… |
CVE-2022-37924 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |
CVE-2022-37923 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |
CVE-2022-37922 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |
CVE-2022-37921 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |
CVE-2022-37920 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |
CVE-2022-37919 | High | 7.5 | 2022-12-12 | A vulnerability exists in the API of Aruba EdgeConnect Enterprise. An unauthenticated attacker can exploit this condition via the web-based management interfac… |
CVE-2022-37912 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37911 | Low | 3.8 | 2022-12-12 | Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authe… |
CVE-2022-37910 | Medium | 4.4 | 2022-12-12 | A buffer overflow vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in a denial of service on t… |
CVE-2022-37909 | Medium | 5.3 | 2022-12-12 | Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which dis… |
CVE-2022-37908 | Medium | 5.8 | 2022-12-12 | An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware ch… |
CVE-2022-37907 | Medium | 5.8 | 2022-12-12 | A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A su… |
CVE-2022-37906 | Medium | 6.5 | 2022-12-12 | An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability results in the ability… |
CVE-2022-37905 | Medium | 6.6 | 2022-12-12 | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful expl… |
CVE-2022-37904 | Medium | 6.6 | 2022-12-12 | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful expl… |
CVE-2022-37903 | High | 7.2 | 2022-12-12 | A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful… |
CVE-2022-37902 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37901 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37900 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37899 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37898 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37897 | Critical | 9.8 | 2022-12-12 | There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (… |
CVE-2022-37018 | High | 8.4 | 2022-12-12 | A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is… |
CVE-2022-34318 | Medium | 5.4 | 2022-12-12 | IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote att… |
CVE-2022-32537 | Medium | 4.8 | 2022-12-12 | A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is b… |
CVE-2022-2794 | High | 7.5 | 2022-12-12 | Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack. |
CVE-2022-23511 | High | 7.1 | 2022-12-12 | A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-p… |
CVE-2022-22488 | Medium | 4.9 | 2022-12-12 | IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of t… |
CVE-2022-1038 | High | 7.8 | 2022-12-12 | A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommending that custome… |
CVE-2022-3485 | Critical | 9.8 | 2022-12-12 | In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and… |
CVE-2022-46688 | Medium | 6.5 | 2022-12-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerr… |
CVE-2022-46687 | Medium | 5.4 | 2022-12-12 | Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting… |
CVE-2022-46686 | Medium | 5.4 | 2022-12-12 | Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties an… |
CVE-2022-46685 | Medium | 4.3 | 2022-12-12 | In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them th… |
CVE-2022-46684 | Medium | 5.4 | 2022-12-12 | Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting… |
CVE-2022-46683 | Medium | 6.1 | 2022-12-12 | Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins. |
CVE-2022-46682 | Critical | 9.8 | 2022-12-12 | Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45797 | High | 7.1 | 2022-12-12 | An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a loc… |
CVE-2022-41296 | Medium | 6.5 | 2022-12-12 | IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2022-3641 | High | 8.8 | 2022-12-12 | Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated user to spoof a privil… |
CVE-2022-20968 | High | 8.1 | 2022-12-12 | A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenticated, adjacent att… |
CVE-2022-20691 | Medium | 5.3 | 2022-12-12 | A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Adaptive Telephone Adapter firmware could allow an unauthenticated, adjac… |
CVE-2022-20690 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated… |
CVE-2022-20689 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated… |
CVE-2022-20688 | Medium | 5.3 | 2022-12-12 | A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote… |
CVE-2022-20687 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an una… |
CVE-2022-20686 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an una… |
CVE-2022-4416 | Medium | 6.3 | 2022-12-12 | A vulnerability was found in RainyGao DocSys. It has been declared as critical. This vulnerability affects the function getReposAllUsers of the file /DocSystem… |
CVE-2022-46908 | High | 7.3 | 2022-12-12 | SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechan… |
CVE-2022-31596 | Medium | 6.0 | 2022-12-12 | Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business Intel… |
CVE-2022-25837 | High | 7.5 | 2022-12-12 | Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via ad… |
CVE-2022-25836 | High | 7.5 | 2022-12-12 | Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devi… |
CVE-2022-45760 | High | 8.8 | 2022-12-12 | SENS v1.0 is vulnerable to Incorrect Access Control vulnerability. |
CVE-2022-45759 | High | 8.8 | 2022-12-12 | SENS v1.0 has a file upload vulnerability. |
CVE-2022-45758 | Medium | 5.4 | 2022-12-12 | SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister. |
CVE-2022-45756 | Medium | 6.1 | 2022-12-12 | SENS v1.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-45228 | Low | 3.5 | 2022-12-12 | Dragino Lora LG01 18ed40 IoT v4.3.4 was discovered to contain a Cross-Site Request Forgery in the logout page. |
CVE-2022-45227 | High | 7.5 | 2022-12-12 | The web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/. This address has a backup file which can b… |
CVE-2022-44637 | Medium | 6.1 | 2022-12-12 | Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields… |
CVE-2022-44031 | Medium | 6.1 | 2022-12-12 | Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-for… |
CVE-2022-4414 | Medium | 6.1 | 2022-12-12 | Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13. |
CVE-2022-4413 | Medium | 6.1 | 2022-12-12 | Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13. |
CVE-2022-4409 | High | 7.5 | 2022-12-11 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-4408 | Medium | 5.4 | 2022-12-11 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-4407 | Medium | 6.1 | 2022-12-11 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-4403 | Medium | 6.3 | 2022-12-11 | A vulnerability classified as critical was found in SourceCodester Canteen Management System. This vulnerability affects unknown code of the file ajax_represen… |
CVE-2022-4402 | Medium | 4.7 | 2022-12-11 | A vulnerability classified as critical has been found in RainyGao DocSys 2.02.37. This affects an unknown part of the component ZIP File Decompression Handler… |
CVE-2022-4401 | Low | 3.5 | 2022-12-11 | A vulnerability was found in pallidlight online-course-selection-system. It has been classified as problematic. Affected is an unknown function. The manipulati… |
CVE-2022-4400 | Low | 3.5 | 2022-12-11 | A vulnerability was found in zbl1996 FS-Blog and classified as problematic. This issue affects some unknown processing of the component Title Handler. The mani… |
CVE-2022-4399 | Medium | 5.5 | 2022-12-10 | A vulnerability was found in TicklishHoneyBee nodau. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/db.c… |
CVE-2022-4398 | High | 7.8 | 2022-12-10 | Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0. |
CVE-2022-4397 | Medium | 4.3 | 2022-12-10 | A vulnerability was found in morontt zend-blog-number-2. It has been classified as problematic. Affected is an unknown function of the file application/forms/C… |
CVE-2022-45145 | Critical | 9.8 | 2022-12-10 | egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file. |
CVE-2022-4396 | Low | 3.5 | 2022-12-10 | A vulnerability was found in RDFlib pyrdfa3 and classified as problematic. This issue affects the function _get_option of the file pyRdfa/__init__.py. The mani… |
CVE-2022-23485 | Medium | 6.4 | 2022-12-10 | Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invit… |
CVE-2022-23510 | Critical | 9.6 | 2022-12-09 | cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary S… |
CVE-2022-23497 | Medium | 6.5 | 2022-12-09 | FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configuratio… |
CVE-2022-45292 | Medium | 5.3 | 2022-12-09 | User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted. |
CVE-2022-34297 | Medium | 5.4 | 2022-12-09 | Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field. |
CVE-2022-46166 | High | 8.0 | 2022-12-09 | Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, havi… |
CVE-2022-46157 | High | 8.8 | 2022-12-09 | Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticate… |
CVE-2022-44790 | High | 7.5 | 2022-12-09 | Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extrac… |
CVE-2022-4390 | Critical | 10.0 | 2022-12-09 | A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by def… |
CVE-2022-2993 | High | 8.6 | 2022-12-09 | There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet. |