2022 CVEs (page 85)
Page 85 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39903 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in RCS call prior to SMR Dec-2022 Release 1 allows local attackers to access RCS incoming call number. |
CVE-2022-39902 | Medium | 6.5 | 2022-12-08 | Improper authorization in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to get sensitive information including IMEI via emergency call. |
CVE-2022-39901 | Medium | 6.5 | 2022-12-08 | Improper authentication in Exynos baseband prior to SMR DEC-2022 Release 1 allows remote attacker to disable the network traffic encryption between UE and gNod… |
CVE-2022-39900 | Medium | 4.6 | 2022-12-08 | Improper access control vulnerability in Nice Catch prior to SMR Dec-2022 Release 1 allows physical attackers to access contents of all toast generated in the… |
CVE-2022-39899 | Medium | 5.7 | 2022-12-08 | Improper authentication vulnerability in Samsung WindowManagerService prior to SMR Dec-2022 Release 1 allows attacker to send the input event using S Pen gestu… |
CVE-2022-39898 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in IIccPhoneBook prior to SMR Dec-2022 Release 1 allows attackers to access some information of usim. |
CVE-2022-39897 | Medium | 4.4 | 2022-12-08 | Exposure of Sensitive Information vulnerability in kernel prior to SMR Dec-2022 Release 1 allows attackers to access the kernel address information via log. |
CVE-2022-39896 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerabilities in Contacts prior to SMR Dec-2022 Release 1 allows to access sensitive information via implicit intent. |
CVE-2022-39895 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in ContactListUtils in Phone prior to SMR Dec-2022 Release 1 allows to access contact group information via implicit inte… |
CVE-2022-39894 | Medium | 4.0 | 2022-12-08 | Improper access control vulnerability in ContactListStartActivityHelper in Phone prior to SMR Dec-2022 Release 1 allows to access sensitive information via imp… |
CVE-2022-38754 | High | 8.0 | 2022-12-08 | A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticat… |
CVE-2022-37918 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-37917 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-37916 | High | 8.1 | 2022-12-08 | Vulnerabilities in the AirWave Management Platform web-based management interface exist which expose some URLs to a lack of proper access controls. These vulne… |
CVE-2022-4364 | High | 7.3 | 2022-12-08 | A vulnerability has been found in Teledyne FLIR AX8 up to 1.46.16. Affected by this issue is some unknown functionality of the file palette.php of the componen… |
CVE-2022-4354 | Medium | 4.3 | 2022-12-08 | A vulnerability was found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /blog/comme… |
CVE-2022-4353 | Low | 3.5 | 2022-12-08 | A vulnerability has been found in LinZhaoguan pb-cms 2.0 and classified as problematic. Affected by this vulnerability is the function IpUtil.getIpAddr. The ma… |
CVE-2022-4350 | Low | 3.5 | 2022-12-08 | A vulnerability, which was classified as problematic, was found in Mingsoft MCMS 5.2.8. Affected is an unknown function of the file search.do. The manipulation… |
CVE-2022-4349 | Medium | 4.3 | 2022-12-08 | A vulnerability classified as problematic has been found in CTF-hacker pwn. This affects an unknown part of the file delete.html. The manipulation leads to cro… |
CVE-2022-4348 | Low | 3.5 | 2022-12-08 | A vulnerability was found in y_project RuoYi-Cloud. It has been rated as problematic. Affected by this issue is some unknown functionality of the component JSO… |
CVE-2022-4347 | Low | 3.5 | 2022-12-08 | A vulnerability was found in xiandafu beetl-bbs. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file We… |
CVE-2022-46792 | High | 8.8 | 2022-12-08 | Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.1… |
CVE-2022-23476 | High | 7.5 | 2022-12-08 | Nokogiri is an open source XML and HTML library for the Ruby programming language. Nokogiri `1.13.8` and `1.13.9` fail to check the return value from `xmlTextR… |
CVE-2022-23492 | High | 7.5 | 2022-12-08 | go-libp2p is the offical libp2p implementation in the Go programming language. Version `0.18.0` and older of go-libp2p are vulnerable to targeted resource exha… |
CVE-2022-4291 | High | 7.7 | 2022-12-08 | The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass… |
CVE-2022-4261 | Medium | 4.4 | 2022-12-08 | Rapid7 Nexpose and InsightVM versions prior to 6.6.172 failed to reliably validate the authenticity of update contents. This failure could allow an attacker to… |
CVE-2022-3092 | High | 7.8 | 2022-12-08 | GE CIMPICITY versions 2022 and prior is vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code. |
CVE-2022-3084 | High | 7.8 | 2022-12-08 | GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could a… |
CVE-2022-2952 | High | 7.8 | 2022-12-07 | GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could… |
CVE-2022-2948 | High | 7.8 | 2022-12-07 | GE CIMPICITY versions 2022 and prior is vulnerable to a heap-based buffer overflow, which could allow an attacker to execute arbitrary code. |
CVE-2022-2002 | High | 7.8 | 2022-12-07 | GE CIMPICITY versions 2022 and prior is vulnerable when data from faulting address controls code flow starting at gmmiObj!CGmmiOptionContainer, which could… |
CVE-2022-23471 | Medium | 5.7 | 2022-12-07 | containerd is an open source container runtime. A bug was found in containerd's CRI implementation where a user can exhaust memory on the host. In the CRI stre… |
CVE-2022-23491 | Medium | 6.8 | 2022-12-07 | Certifi is a curated collection of Root Certificates for validating the trustworthiness of SSL certificates while verifying the identity of TLS hosts. Certifi… |
CVE-2022-4341 | Low | 3.5 | 2022-12-07 | A vulnerability has been found in csliuwy coder-chain_gdut and classified as problematic. Affected by this vulnerability is an unknown functionality of the fil… |
CVE-2022-23487 | High | 7.5 | 2022-12-07 | js-libp2p is the official javascript Implementation of libp2p networking stack. Versions older than `v0.38.0` of js-libp2p are vulnerable to targeted resource… |
CVE-2022-23486 | High | 7.5 | 2022-12-07 | libp2p-rust is the official rust language Implementation of the libp2p networking stack. In versions prior to 0.45.1 an attacker node can cause a victim node t… |
CVE-2022-46770 | High | 7.5 | 2022-12-07 | qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of for… |
CVE-2022-45550 | Critical | 9.8 | 2022-12-07 | AyaCMS 3.1.2 is vulnerable to Remote Code Execution (RCE). |
CVE-2022-44373 | High | 8.8 | 2022-12-07 | A stack overflow vulnerability exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (Version v1.0R, firmware version 1.01.B01) which may result in remote cod… |
CVE-2022-44351 | Critical | 9.8 | 2022-12-07 | Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php. |
CVE-2022-43581 | High | 7.5 | 2022-12-07 | IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to missing authorization a… |
CVE-2022-44393 | High | 7.2 | 2022-12-07 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=. |
CVE-2022-44371 | Critical | 9.8 | 2022-12-07 | hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE). |
CVE-2022-44361 | Medium | 5.4 | 2022-12-07 | An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php. |
CVE-2022-41735 | Medium | 5.4 | 2022-12-07 | IBM Business Process Manager 21.0.1 through 21.0.3.1, 20.0.0.1 through 20.0.0.2 19.0.0.1 through 19.0.0.3 is vulnerable to cross-site scripting. This vulnerabi… |
CVE-2022-41720 | High | 7.5 | 2022-12-07 | On Windows, restricted files can be accessed via os.DirFS and http.Dir. The os.DirFS function and http.Dir type provide access to a tree of files rooted at a g… |
CVE-2022-45217 | Medium | 5.4 | 2022-12-07 | A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2022-45910 | Medium | 5.3 | 2022-12-07 | Improper neutralization of special elements used in an LDAP query ('LDAP Injection') vulnerability in ActiveDirectory and Sharepoint ActiveDirectory authority… |
CVE-2022-42458 | Critical | 9.8 | 2022-12-07 | Authentication bypass using an alternate path or channel vulnerability in bingo!CMS version1.7.4.1 and earlier allows a remote unauthenticated attacker to uplo… |
CVE-2022-40966 | High | 8.8 | 2022-12-07 | Authentication bypass vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to bypass authentication and access the device. The… |
CVE-2022-39044 | Medium | 6.8 | 2022-12-07 | Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitr… |
CVE-2022-34840 | Medium | 6.5 | 2022-12-07 | Use of hard-coded credentials vulnerability in multiple Buffalo network devices allows a network-adjacent attacker to alter?configuration settings of the devic… |
CVE-2022-46742 | Critical | 10.0 | 2022-12-07 | Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution. |
CVE-2022-46741 | High | 7.1 | 2022-12-07 | Out-of-bounds read in gather_tree in PaddlePaddle before 2.4. |
CVE-2022-4322 | Medium | 6.3 | 2022-12-07 | A vulnerability, which was classified as critical, was found in maku-boot up to 2.2.0. This affects the function doExecute of the file AbstractScheduleJob.java… |
CVE-2022-45122 | Medium | 6.1 | 2022-12-07 | Cross-site scripting vulnerability in Movable Type Movable Type 7 r.5301 and earlier (Movable Type 7 Series), Movable Type Advanced 7 r.5301 and earlier (Movab… |
CVE-2022-45113 | Medium | 6.5 | 2022-12-07 | Improper validation of syntactic correctness of input vulnerability exist in Movable Type series. Having a user to access a specially crafted URL may allow a r… |
CVE-2022-44620 | High | 8.8 | 2022-12-07 | Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attack… |
CVE-2022-44608 | High | 7.5 | 2022-12-07 | Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, w… |
CVE-2022-44606 | High | 8.8 | 2022-12-07 | OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker… |
CVE-2022-43668 | Medium | 6.1 | 2022-12-07 | Typora versions prior to 1.4.4 fails to properly neutralize JavaScript code, which may result in executing JavaScript code contained in the file when opening a… |
CVE-2022-43667 | High | 7.8 | 2022-12-07 | Stack-based buffer overflow vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution… |
CVE-2022-43660 | High | 7.2 | 2022-12-07 | Improper neutralization of Server-Side Includes (SSW) within a web page in Movable Type series allows a remote authenticated attacker with Privilege of 'Manage… |
CVE-2022-43509 | High | 7.8 | 2022-12-07 | Out-of-bounds write vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by havin… |
CVE-2022-43508 | High | 7.8 | 2022-12-07 | Use-after free vulnerability exists in CX-Programmer v.9.77 and earlier, which may lead to information disclosure and/or arbitrary code execution by having a u… |
CVE-2022-43468 | High | 7.5 | 2022-12-07 | External initialization of trusted variables or data stores vulnerability exists in WordPress Popular Posts 6.0.5 and earlier, therefore the vulnerable product… |
CVE-2022-43464 | High | 8.8 | 2022-12-07 | Hidden functionality vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker… |
CVE-2022-42486 | Medium | 4.8 | 2022-12-07 | Stored cross-site scripting vulnerability in User group management of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administr… |
CVE-2022-41994 | Medium | 4.8 | 2022-12-07 | Stored cross-site scripting vulnerability in Permission Settings of baserCMS versions prior to 4.7.2 allows a remote authenticated attacker with an administrat… |
CVE-2022-41800 | High | 8.7 | 2022-12-07 | In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrict… |
CVE-2022-41783 | Medium | 5.5 | 2022-12-07 | tdpServer of TP-Link RE300 V1 improperly processes its input, which may allow an attacker to cause a denial-of-service (DoS) condition of the product's OneMesh… |
CVE-2022-41622 | High | 8.8 | 2022-12-07 | In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. Note: Software versions which have r… |
CVE-2022-37406 | Medium | 4.8 | 2022-12-07 | Cross-site scripting vulnerability in Aficio SP 4210N firmware versions prior to Web Support 1.05 allows a remote authenticated attacker with an administrative… |
CVE-2022-44849 | High | 8.8 | 2022-12-07 | A Cross-Site Request Forgery (CSRF) in the Administrator List of MetInfo v7.7 allows attackers to arbitrarily add Super Administrator account. |
CVE-2022-45026 | Critical | 9.8 | 2022-12-07 | An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process. |
CVE-2022-45025 | Critical | 9.8 | 2022-12-07 | Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function. |
CVE-2022-45010 | Critical | 9.8 | 2022-12-07 | Simple Phone Book/Directory Web App v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /PhoneBook/edit.php. |
CVE-2022-45009 | High | 7.2 | 2022-12-07 | Online Leave Management System v1.0 was discovered to contain an arbitrary file upload vulnerability at /leave_system/classes/SystemSettings.php?f=update_setti… |
CVE-2022-45008 | Medium | 4.8 | 2022-12-07 | Online Leave Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /leave_system/admin/?page=main… |
CVE-2022-44942 | High | 8.1 | 2022-12-07 | Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function. |
CVE-2022-44153 | Medium | 6.1 | 2022-12-07 | Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-45918 | Medium | 6.5 | 2022-12-07 | ILIAS before 7.16 allows External Control of File Name or Path. |
CVE-2022-45917 | Medium | 6.1 | 2022-12-07 | ILIAS before 7.16 has an Open Redirect. |
CVE-2022-45916 | Medium | 5.4 | 2022-12-07 | ILIAS before 7.16 allows XSS. |
CVE-2022-45915 | High | 8.8 | 2022-12-07 | ILIAS before 7.16 allows OS Command Injection. |
CVE-2022-42329 | Medium | 5.5 | 2022-12-07 | Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr… |
CVE-2022-42328 | Medium | 5.5 | 2022-12-07 | Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities corr… |
CVE-2022-3643 | Medium | 6.5 | 2022-12-07 | Guests can trigger NIC interface reset/abort/crash via netback It is possible for a guest to trigger a NIC interface reset/abort/crash in a Linux based network… |
CVE-2022-44030 | High | 7.5 | 2022-12-06 | Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configura… |
CVE-2022-42699 | Critical | 9.1 | 2022-12-06 | Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. |
CVE-2022-45833 | Medium | 6.8 | 2022-12-06 | Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress. |
CVE-2022-45829 | High | 8.7 | 2022-12-06 | Auth. Path Traversal vulnerability in Easy WP SMTP plugin <= 1.5.1 at WordPress. |
CVE-2022-45816 | Medium | 4.8 | 2022-12-06 | Auth. Stored Cross-Site Scripting (XSS) vulnerability in GD bbPress Attachments plugin <= 4.3.1 on WordPress. |
CVE-2022-41910 | Medium | 4.8 | 2022-12-06 | TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and output… |
CVE-2022-41902 | High | 7.1 | 2022-12-06 | TensorFlow is an open source platform for machine learning. The function MakeGrapplerFunctionItem takes arguments that determine the sizes of inputs and output… |
CVE-2022-45848 | Medium | 6.1 | 2022-12-06 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Contest Gallery plugin <= 13.1.0.9 on WordPress. |
CVE-2022-45359 | Critical | 9.8 | 2022-12-06 | Unauth. Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress. |
CVE-2022-42888 | Critical | 9.8 | 2022-12-06 | Unauth. Privilege Escalation vulnerability in ARMember premium plugin <= 5.5.1 on WordPress. |
CVE-2022-46333 | High | 7.2 | 2022-12-06 | The admin user interface in Proofpoint Enterprise Protection (PPS/PoD) contains a command injection vulnerability that enables an admin to execute commands bey… |
CVE-2022-46332 | Critical | 9.6 | 2022-12-06 | The Admin Smart Search feature in Proofpoint Enterprise Protection (PPS/PoD) contains a stored cross-site scripting vulnerability that enables an anonymous ema… |