2022 CVEs (page 85)
Page 85 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4347 | Low | 3.5 | 2022-12-08 | A vulnerability was found in xiandafu beetl-bbs. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file We… |
CVE-2022-46792 | High | 8.8 | 2022-12-08 | Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.1… |
CVE-2022-23476 | High | 7.5 | 2022-12-08 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextR… |
CVE-2022-23492 | High | 7.5 | 2022-12-08 | go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exha… |
CVE-2022-4291 | High | 7.7 | 2022-12-08 | The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass… |
CVE-2022-4261 | Medium | 4.4 | 2022-12-08 | Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to… |
CVE-2022-3092 | High | 7.8 | 2022-12-08 | GE CIMPICITY versions 2022 and prior is vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code. |
CVE-2022-3084 | High | 7.8 | 2022-12-08 | GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could a… |
CVE-2022-2952 | High | 7.8 | 2022-12-07 | GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could… |
CVE-2022-2948 | High | 7.8 | 2022-12-07 | GE CIMPICITY versions 2022 and prior is vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code. |
CVE-2022-2002 | High | 7.8 | 2022-12-07 | GE CIMPICITY versions 2022 and prior is vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could… |
CVE-2022-23471 | Medium | 5.7 | 2022-12-07 | containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stre… |
CVE-2022-23491 | Medium | 6.8 | 2022-12-07 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi… |
CVE-2022-4341 | Low | 3.5 | 2022-12-07 | A vulnerability has been found in csliuwy coder-chain_gdut and classified as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2022-23487 | High | 7.5 | 2022-12-07 | js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource… |
CVE-2022-23486 | High | 7.5 | 2022-12-07 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node t… |
CVE-2022-46770 | High | 7.5 | 2022-12-07 | qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of for… |
CVE-2022-45550 | Critical | 9.8 | 2022-12-07 | AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE). |
CVE-2022-44373 | High | 8.8 | 2022-12-07 | A stack overflow vulnerability exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (Version v1.0R, firmware version 1.01.B01) which may result in remote cod… |
CVE-2022-44351 | Critical | 9.8 | 2022-12-07 | Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php. |
CVE-2022-43581 | High | 7.5 | 2022-12-07 | IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to missing authorization a… |
CVE-2022-44393 | High | 7.2 | 2022-12-07 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=. |
CVE-2022-44371 | Critical | 9.8 | 2022-12-07 | hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE). |
CVE-2022-44361 | Medium | 5.4 | 2022-12-07 | An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php. |
CVE-2022-41735 | Medium | 5.4 | 2022-12-07 | IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerabi… |
CVE-2022-41720 | High | 7.5 | 2022-12-07 | On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a g… |
CVE-2022-45217 | Medium | 5.4 | 2022-12-07 | A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2022-45910 | Medium | 5.3 | 2022-12-07 | Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority… |
CVE-2022-42458 | Critical | 9.8 | 2022-12-07 | Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to uplo… |
CVE-2022-40966 | High | 8.8 | 2022-12-07 | Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass authentication and access the device. The… |
CVE-2022-39044 | Medium | 6.8 | 2022-12-07 | Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitr… |
CVE-2022-34840 | Medium | 6.5 | 2022-12-07 | Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the devic… |
CVE-2022-46742 | Critical | 10.0 | 2022-12-07 | Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution. |
CVE-2022-46741 | High | 7.1 | 2022-12-07 | Out-of-bounds read in gather_tree in PaddlePaddle before 2.4. |
CVE-2022-4322 | Medium | 6.3 | 2022-12-07 | A vulnerability, which was classified as critical, was found in maku-boot up to 2.2.0. This affects the function doExecute of the file AbstractScheduleJob.java… |
CVE-2022-45122 | Medium | 6.1 | 2022-12-07 | Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movab… |
CVE-2022-45113 | Medium | 6.5 | 2022-12-07 | Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a r… |
CVE-2022-44620 | High | 8.8 | 2022-12-07 | Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attack… |
CVE-2022-44608 | High | 7.5 | 2022-12-07 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, w… |
CVE-2022-44606 | High | 8.8 | 2022-12-07 | OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker… |
CVE-2022-43668 | Medium | 6.1 | 2022-12-07 | Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a… |
CVE-2022-43667 | High | 7.8 | 2022-12-07 | Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution… |
CVE-2022-43660 | High | 7.2 | 2022-12-07 | Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage… |
CVE-2022-43509 | High | 7.8 | 2022-12-07 | Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by havin… |
CVE-2022-43508 | High | 7.8 | 2022-12-07 | Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a u… |
CVE-2022-43468 | High | 7.5 | 2022-12-07 | External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product… |
CVE-2022-43464 | High | 8.8 | 2022-12-07 | Hidden functionality vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker… |
CVE-2022-42486 | Medium | 4.8 | 2022-12-07 | Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administr… |
CVE-2022-41994 | Medium | 4.8 | 2022-12-07 | Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrat… |
CVE-2022-41800 | High | 8.7 | 2022-12-07 | In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrict… |
CVE-2022-41783 | Medium | 5.5 | 2022-12-07 | tdpServer of TP-Link RE300 V1 improperly processes its input, which may allow an attacker to cause a denial-of-service (DoS) condition of the product's OneMesh… |
CVE-2022-41622 | High | 8.8 | 2022-12-07 | In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have r… |
CVE-2022-37406 | Medium | 4.8 | 2022-12-07 | Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker with an administrative… |
CVE-2022-44849 | High | 8.8 | 2022-12-07 | A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account. |
CVE-2022-45026 | Critical | 9.8 | 2022-12-07 | An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process. |
CVE-2022-45025 | Critical | 9.8 | 2022-12-07 | Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function. |
CVE-2022-45010 | Critical | 9.8 | 2022-12-07 | Simple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /PhoneBook/edit.php. |
CVE-2022-45009 | High | 7.2 | 2022-12-07 | Online Leave Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /leave_system/classes/SystemSettings.php?f=update_setti… |
CVE-2022-45008 | Medium | 4.8 | 2022-12-07 | Online Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /leave_system/admin/?page=main… |
CVE-2022-44942 | High | 8.1 | 2022-12-07 | Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function. |
CVE-2022-44153 | Medium | 6.1 | 2022-12-07 | Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-45918 | Medium | 6.5 | 2022-12-07 | ILIAS before 7.16 allows External Control of File Name or Path. |
CVE-2022-45917 | Medium | 6.1 | 2022-12-07 | ILIAS before 7.16 has an Open Redirect. |
CVE-2022-45916 | Medium | 5.4 | 2022-12-07 | ILIAS before 7.16 allows XSS. |
CVE-2022-45915 | High | 8.8 | 2022-12-07 | ILIAS before 7.16 allows OS Command Injection. |
CVE-2022-42329 | Medium | 5.5 | 2022-12-07 | Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr… |
CVE-2022-42328 | Medium | 5.5 | 2022-12-07 | Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr… |
CVE-2022-3643 | Medium | 6.5 | 2022-12-07 | Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network… |
CVE-2022-44030 | High | 7.5 | 2022-12-06 | Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configura… |
CVE-2022-42699 | Critical | 9.1 | 2022-12-06 | Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. |
CVE-2022-45833 | Medium | 6.8 | 2022-12-06 | Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. |
CVE-2022-45829 | High | 8.7 | 2022-12-06 | Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 at WordPress. |
CVE-2022-45816 | Medium | 4.8 | 2022-12-06 | Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress. |
CVE-2022-41910 | Medium | 4.8 | 2022-12-06 | TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and output… |
CVE-2022-41902 | High | 7.1 | 2022-12-06 | TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and output… |
CVE-2022-45848 | Medium | 6.1 | 2022-12-06 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress. |
CVE-2022-45359 | Critical | 9.8 | 2022-12-06 | Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress. |
CVE-2022-42888 | Critical | 9.8 | 2022-12-06 | Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress. |
CVE-2022-46333 | High | 7.2 | 2022-12-06 | The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands bey… |
CVE-2022-46332 | Critical | 9.6 | 2022-12-06 | The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous ema… |
CVE-2022-44900 | Critical | 9.1 | 2022-12-06 | A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitra… |
CVE-2022-23475 | High | 8.8 | 2022-12-06 | daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross s… |
CVE-2022-4147 | High | 7.5 | 2022-12-06 | Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which… |
CVE-2022-46161 | Critical | 10.0 | 2022-12-06 | pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of us… |
CVE-2022-46154 | High | 8.6 | 2022-12-06 | Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from reque… |
CVE-2022-45548 | High | 8.8 | 2022-12-06 | AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability. |
CVE-2022-43867 | High | 7.8 | 2022-12-06 | IBM Spectrum Scale 5.1.0.1 through 5.1.4.1 could allow a local attacker to execute arbitrary commands in the container. IBM X-Force ID: 239437. |
CVE-2022-43369 | Medium | 6.1 | 2022-12-06 | AutoTaxi Stand Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component search.php. |
CVE-2022-41560 | Medium | 6.5 | 2022-12-06 | The Statement Set Upload via the Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows a low priv… |
CVE-2022-41559 | Critical | 9.3 | 2022-12-06 | The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows an unauthenticated attacker with networ… |
CVE-2022-34361 | Medium | 5.9 | 2022-12-06 | IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X… |
CVE-2022-23472 | Medium | 5.9 | 2022-12-06 | Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random`… |
CVE-2022-23470 | High | 8.6 | 2022-12-06 | Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be… |
CVE-2022-23466 | Medium | 5.4 | 2022-12-06 | teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) i… |
CVE-2022-45326 | Medium | 4.9 | 2022-12-06 | An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-… |
CVE-2022-40680 | Medium | 4.0 | 2022-12-06 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7… |
CVE-2022-38379 | Low | 3.5 | 2022-12-06 | Improper neutralization of input during web page generation [CWE-79] in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated attacker to inject H… |
CVE-2022-35843 | High | 8.1 | 2022-12-06 | An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9… |
CVE-2022-33876 | Medium | 5.4 | 2022-12-06 | Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allow… |
CVE-2022-33875 | Medium | 5.4 | 2022-12-06 | An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through… |