2022 CVEs (page 83)
Page 83 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37920 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |
CVE-2022-37919 | High | 7.5 | 2022-12-12 | A vulnerability exists in the API of Aruba EdgeConnect Enterprise. An unauthenticated attacker can exploit this condition via the web-based management interfac… |
CVE-2022-37912 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37911 | Low | 3.8 | 2022-12-12 | Due to improper restrictions on XML entities multiple vulnerabilities exist in the command line interface of ArubaOS. A successful exploit could allow an authe… |
CVE-2022-37910 | Medium | 4.4 | 2022-12-12 | A buffer overflow vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability results in a denial of service on t… |
CVE-2022-37909 | Medium | 5.3 | 2022-12-12 | Aruba has identified certain configurations of ArubaOS that can lead to sensitive information disclosure from the configured ESSIDs. The scenarios in which dis… |
CVE-2022-37908 | Medium | 5.8 | 2022-12-12 | An authenticated attacker can impact the integrity of the ArubaOS bootloader on 7xxx series controllers. Successful exploitation can compromise the hardware ch… |
CVE-2022-37907 | Medium | 5.8 | 2022-12-12 | A vulnerability exists in the ArubaOS bootloader on 7xxx series controllers which can result in a denial of service (DoS) condition on an impacted system. A su… |
CVE-2022-37906 | Medium | 6.5 | 2022-12-12 | An authenticated path traversal vulnerability exists in the ArubaOS command line interface. Successful exploitation of the vulnerability results in the ability… |
CVE-2022-37905 | Medium | 6.6 | 2022-12-12 | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful expl… |
CVE-2022-37904 | Medium | 6.6 | 2022-12-12 | Vulnerabilities in ArubaOS running on 7xxx series controllers exist that allows an attacker to execute arbitrary code during the boot sequence. Successful expl… |
CVE-2022-37903 | High | 7.2 | 2022-12-12 | A vulnerability exists that allows an authenticated attacker to overwrite an arbitrary file with attacker-controlled content via the web interface. Successful… |
CVE-2022-37902 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37901 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37900 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37899 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37898 | High | 7.2 | 2022-12-12 | Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities results in the ab… |
CVE-2022-37897 | Critical | 9.8 | 2022-12-12 | There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (… |
CVE-2022-37018 | High | 8.4 | 2022-12-12 | A potential vulnerability has been identified in the system BIOS for certain HP PC products which may allow escalation of privileges and code execution. HP is… |
CVE-2022-34318 | Medium | 5.4 | 2022-12-12 | IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote att… |
CVE-2022-32537 | Medium | 4.8 | 2022-12-12 | A vulnerability exists which could allow an unauthorized user to learn aspects of the communication protocol used to pair system components while the pump is b… |
CVE-2022-2794 | High | 7.5 | 2022-12-12 | Certain HP PageWide Pro Printers may be vulnerable to a potential denial of service attack. |
CVE-2022-23511 | High | 7.1 | 2022-12-12 | A privilege escalation issue exists within the Amazon CloudWatch Agent for Windows, software for collecting metrics and logs from Amazon EC2 instances and on-p… |
CVE-2022-22488 | Medium | 4.9 | 2022-12-12 | IBM OpenBMC OP910 and OP940 could allow a privileged user to cause a denial of service by uploading or deleting too many CA certificates in a short period of t… |
CVE-2022-1038 | High | 7.8 | 2022-12-12 | A potential security vulnerability has been identified in the HP Jumpstart software, which might allow escalation of privilege. HP is recommending that custome… |
CVE-2022-3485 | Critical | 9.8 | 2022-12-12 | In IFM Moneo Appliance with version up to 1.9.3 an unauthenticated remote attacker can reset the administrator password by only supplying the serial number and… |
CVE-2022-46688 | Medium | 6.5 | 2022-12-12 | A cross-site request forgery (CSRF) vulnerability in Jenkins Sonar Gerrit Plugin 377.v8f3808963dc5 and earlier allows attackers to have Jenkins connect to Gerr… |
CVE-2022-46687 | Medium | 5.4 | 2022-12-12 | Jenkins Spring Config Plugin 2.0.0 and earlier does not escape build display names shown on the Spring Config view, resulting in a stored cross-site scripting… |
CVE-2022-46686 | Medium | 5.4 | 2022-12-12 | Jenkins Custom Build Properties Plugin 2.79.vc095ccc85094 and earlier does not escape property values and build display names on the Custom Build Properties an… |
CVE-2022-46685 | Medium | 4.3 | 2022-12-12 | In Jenkins Gitea Plugin 1.4.4 and earlier, the implementation of Gitea personal access tokens did not support credentials masking, potentially exposing them th… |
CVE-2022-46684 | Medium | 5.4 | 2022-12-12 | Jenkins Checkmarx Plugin 2022.3.3 and earlier does not escape values returned from the Checkmarx service API before inserting them into HTML reports, resulting… |
CVE-2022-46683 | Medium | 6.1 | 2022-12-12 | Jenkins Google Login Plugin 1.4 through 1.6 (both inclusive) improperly determines that a redirect URL after login is legitimately pointing to Jenkins. |
CVE-2022-46682 | Critical | 9.8 | 2022-12-12 | Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45797 | High | 7.1 | 2022-12-12 | An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a loc… |
CVE-2022-41296 | Medium | 6.5 | 2022-12-12 | IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2022-3641 | High | 8.8 | 2022-12-12 | Elevation of privilege in the Azure SQL Data Source in Devolutions Remote Desktop Manager 2022.3.13 to 2022.3.24 allows an authenticated user to spoof a privil… |
CVE-2022-20968 | High | 8.1 | 2022-12-12 | A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenticated, adjacent att… |
CVE-2022-20691 | Medium | 5.3 | 2022-12-12 | A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Adaptive Telephone Adapter firmware could allow an unauthenticated, adjac… |
CVE-2022-20690 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated… |
CVE-2022-20689 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated… |
CVE-2022-20688 | Medium | 5.3 | 2022-12-12 | A vulnerability in the Cisco Discovery Protocol functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an unauthenticated, remote… |
CVE-2022-20687 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an una… |
CVE-2022-20686 | Medium | 5.3 | 2022-12-12 | Multiple vulnerabilities in the Link Layer Discovery Protocol (LLDP) functionality of Cisco ATA 190 Series Analog Telephone Adapter firmware could allow an una… |
CVE-2022-4416 | Medium | 6.3 | 2022-12-12 | A vulnerability was found in RainyGao DocSys. It has been declared as critical. This vulnerability affects the function getReposAllUsers of the file /DocSystem… |
CVE-2022-46908 | High | 7.3 | 2022-12-12 | SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechan… |
CVE-2022-31596 | Medium | 6.0 | 2022-12-12 | Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business Intel… |
CVE-2022-25837 | High | 7.5 | 2022-12-12 | Bluetooth® Pairing in Bluetooth Core Specification v1.0B through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devices via ad… |
CVE-2022-25836 | High | 7.5 | 2022-12-12 | Bluetooth® Low Energy Pairing in Bluetooth Core Specification v4.0 through v5.3 may permit an unauthenticated MITM to acquire credentials with two pairing devi… |
CVE-2022-45760 | High | 8.8 | 2022-12-12 | SENS v1.0 is vulnerable to Incorrect Access Control vulnerability. |
CVE-2022-45759 | High | 8.8 | 2022-12-12 | SENS v1.0 has a file upload vulnerability. |
CVE-2022-45758 | Medium | 5.4 | 2022-12-12 | SENS v1.0 is vulnerable to Cross Site Scripting (XSS) via com.liuyanzhao.sens.web.controller.admin, getRegister. |
CVE-2022-45756 | Medium | 6.1 | 2022-12-12 | SENS v1.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-45228 | Low | 3.5 | 2022-12-12 | Dragino Lora LG01 18ed40 IoT v4.3.4 was discovered to contain a Cross-Site Request Forgery in the logout page. |
CVE-2022-45227 | High | 7.5 | 2022-12-12 | The web portal of Dragino Lora LG01 18ed40 IoT v4.3.4 has the directory listing at the URL https://10.10.20.74/lib/. This address has a backup file which can b… |
CVE-2022-44637 | Medium | 6.1 | 2022-12-12 | Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields… |
CVE-2022-44031 | Medium | 6.1 | 2022-12-12 | Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-for… |
CVE-2022-4414 | Medium | 6.1 | 2022-12-12 | Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13. |
CVE-2022-4413 | Medium | 6.1 | 2022-12-12 | Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13. |
CVE-2022-4409 | High | 7.5 | 2022-12-11 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-4408 | Medium | 5.4 | 2022-12-11 | Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-4407 | Medium | 6.1 | 2022-12-11 | Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9. |
CVE-2022-4403 | Medium | 6.3 | 2022-12-11 | A vulnerability classified as critical was found in SourceCodester Canteen Management System. This vulnerability affects unknown code of the file ajax_represen… |
CVE-2022-4402 | Medium | 4.7 | 2022-12-11 | A vulnerability classified as critical has been found in RainyGao DocSys 2.02.37. This affects an unknown part of the component ZIP File Decompression Handler… |
CVE-2022-4401 | Low | 3.5 | 2022-12-11 | A vulnerability was found in pallidlight online-course-selection-system. It has been classified as problematic. Affected is an unknown function. The manipulati… |
CVE-2022-4400 | Low | 3.5 | 2022-12-11 | A vulnerability was found in zbl1996 FS-Blog and classified as problematic. This issue affects some unknown processing of the component Title Handler. The mani… |
CVE-2022-4399 | Medium | 5.5 | 2022-12-10 | A vulnerability was found in TicklishHoneyBee nodau. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/db.c… |
CVE-2022-4398 | High | 7.8 | 2022-12-10 | Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0. |
CVE-2022-4397 | Medium | 4.3 | 2022-12-10 | A vulnerability was found in morontt zend-blog-number-2. It has been classified as problematic. Affected is an unknown function of the file application/forms/C… |
CVE-2022-45145 | Critical | 9.8 | 2022-12-10 | egg-compile.scm in CHICKEN 5.x before 5.3.1 allows arbitrary OS command execution during package installation via escape characters in a .egg file. |
CVE-2022-4396 | Low | 3.5 | 2022-12-10 | A vulnerability was found in RDFlib pyrdfa3 and classified as problematic. This issue affects the function _get_option of the file pyRdfa/__init__.py. The mani… |
CVE-2022-23485 | Medium | 6.4 | 2022-12-10 | Sentry is an error tracking and performance monitoring platform. In versions of the sentry python library prior to 22.11.0 an attacker with a known valid invit… |
CVE-2022-23510 | Critical | 9.6 | 2022-12-09 | cube-js is a headless business intelligence platform. In version 0.31.23 all authenticated Cube clients could bypass SQL row-level security and run arbitrary S… |
CVE-2022-23497 | Medium | 6.5 | 2022-12-09 | FreshRSS is a free, self-hostable RSS aggregator. User configuration files can be accessed by a remote user. In addition to user preferences, such configuratio… |
CVE-2022-45292 | Medium | 5.3 | 2022-12-09 | User invites for Funkwhale v1.2.8 do not permanently expire after being used for signup and can be used again after an account has been deleted. |
CVE-2022-34297 | Medium | 5.4 | 2022-12-09 | Yii Yii2 Gii through 2.2.4 allows stored XSS by injecting a payload into any field. |
CVE-2022-46166 | High | 8.0 | 2022-12-09 | Spring boot admins is an open source administrative user interface for management of spring boot applications. All users who run Spring Boot Admin Server, havi… |
CVE-2022-46157 | High | 8.8 | 2022-12-09 | Akeneo PIM is an open source Product Information Management (PIM). Akeneo PIM Community Edition versions before v5.0.119 and v6.0.53 allows remote authenticate… |
CVE-2022-44790 | High | 7.5 | 2022-12-09 | Interspire Email Marketer through 6.5.1 allows SQL Injection via the surveys module. An unauthenticated attacker could successfully perform an attack to extrac… |
CVE-2022-4390 | Critical | 10.0 | 2022-12-09 | A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by def… |
CVE-2022-2993 | High | 8.6 | 2022-12-09 | There is an error in the condition of the last if-statement in the function smp_check_keys. It was rejecting current keys if all requirements were unmet. |
CVE-2022-45290 | Critical | 9.1 | 2022-12-09 | Kbase Doc v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /web/IndexController.java. |
CVE-2022-41299 | Medium | 4.4 | 2022-12-09 | IBM Cloud Transformation Advisor 2.0.1 through 3.3.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code… |
CVE-2022-4336 | Medium | 5.4 | 2022-12-09 | In BAOTA linux panel there exists a stored xss vulnerability attackers can use to obtain sensitive information via the log analysis feature. |
CVE-2022-4170 | Critical | 9.8 | 2022-12-09 | The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user'… |
CVE-2022-3724 | Medium | 6.3 | 2022-12-09 | Crash in the USB HID protocol dissector in Wireshark 3.6.0 to 3.6.8 allows denial of service via packet injection or crafted capture file on Windows |
CVE-2022-3259 | High | 7.4 | 2022-12-09 | Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks. |
CVE-2022-29839 | Medium | 4.1 | 2022-12-09 | Insufficiently Protected Credentials vulnerability in the remote backups application on Western Digital My Cloud devices that could allow an attacker who has g… |
CVE-2022-29838 | Medium | 4.3 | 2022-12-09 | Improper Authentication vulnerability in the encrypted volumes and auto mount features of Western Digital My Cloud devices allows insecure direct access to the… |
CVE-2022-25630 | Medium | 5.4 | 2022-12-09 | An authenticated user can embed malicious content with XSS into the admin group policy page. |
CVE-2022-25629 | Medium | 5.4 | 2022-12-09 | An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotation… |
CVE-2022-23493 | Critical | 9.1 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out… |
CVE-2022-23484 | High | 8.2 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Inte… |
CVE-2022-23483 | High | 7.5 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out… |
CVE-2022-23482 | Unrated | | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out… |
CVE-2022-23481 | Unrated | | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out… |
CVE-2022-23480 | Critical | 9.1 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buff… |
CVE-2022-23479 | Critical | 9.1 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buff… |
CVE-2022-23478 | Critical | 9.1 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a Out… |
CVE-2022-23477 | Critical | 9.1 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buff… |
CVE-2022-23468 | Medium | 6.5 | 2022-12-09 | xrdp is an open source project which provides a graphical login to remote machines using Microsoft Remote Desktop Protocol (RDP). xrdp < v0.9.21 contain a buff… |