2022 CVEs (page 86)
Page 86 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-30305 | Low | 3.7 | 2022-12-06 | An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4… |
CVE-2022-46382 | High | 8.8 | 2022-12-06 | RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure Permissions. After signing… |
CVE-2022-44289 | High | 8.8 | 2022-12-06 | Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell. |
CVE-2022-43363 | Medium | 6.1 | 2022-12-06 | Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relati… |
CVE-2022-41325 | High | 7.8 | 2022-12-06 | An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or con… |
CVE-2022-38123 | High | 8.7 | 2022-12-06 | Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager i… |
CVE-2022-46383 | Critical | 9.8 | 2022-12-06 | RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has exposed a privileged token via a pub… |
CVE-2022-40209 | Medium | 6.1 | 2022-12-06 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress. |
CVE-2022-4300 | Medium | 6.3 | 2022-12-06 | A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Tem… |
CVE-2022-4296 | Medium | 6.5 | 2022-12-06 | A vulnerability classified as problematic has been found in TP-Link TL-WR740N. Affected is an unknown function of the component ARP Handler. The manipulation l… |
CVE-2022-42782 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. |
CVE-2022-42781 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42780 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42779 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42778 | High | 7.8 | 2022-12-06 | In windows manager service, there is a missing permission check. This could lead to set up windows manager service with no additional execution privileges need… |
CVE-2022-42777 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-42776 | High | 7.8 | 2022-12-06 | In UscAIEngine service, there is a missing permission check. This could lead to set up UscAIEngine service with no additional execution privileges needed. |
CVE-2022-42775 | Medium | 5.5 | 2022-12-06 | In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel. |
CVE-2022-42774 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42773 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42772 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42771 | Medium | 4.7 | 2022-12-06 | In wlan driver, there is a race condition, This could lead to local denial of service in wlan services. |
CVE-2022-42770 | Medium | 4.7 | 2022-12-06 | In wlan driver, there is a race condition, This could lead to local denial of service in wlan services. |
CVE-2022-42769 | Low | 3.3 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42768 | Medium | 4.3 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42767 | Low | 3.3 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42766 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. |
CVE-2022-42765 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42764 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42763 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42762 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42761 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42760 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42759 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42758 | Low | 3.3 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42757 | Low | 3.3 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42756 | Medium | 5.5 | 2022-12-06 | In sensor driver, there is a possible buffer overflow due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-42755 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42754 | Medium | 5.5 | 2022-12-06 | In npu driver, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel. |
CVE-2022-39134 | Medium | 4.7 | 2022-12-06 | In audio driver, there is a use after free due to a race condition. This could lead to local denial of service in kernel. |
CVE-2022-39133 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-39132 | Medium | 5.5 | 2022-12-06 | In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39131 | Medium | 5.5 | 2022-12-06 | In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel. |
CVE-2022-39130 | Medium | 5.5 | 2022-12-06 | In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39129 | Medium | 5.5 | 2022-12-06 | In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39106 | Medium | 5.5 | 2022-12-06 | In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39102 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39101 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39100 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39099 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39098 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39097 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39096 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39095 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39094 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39093 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39092 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39091 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39090 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-25912 | High | 8.1 | 2022-12-06 | The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clo… |
CVE-2022-24439 | High | 8.1 | 2022-12-06 | All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a mali… |
CVE-2022-40603 | Medium | 4.7 | 2022-12-06 | A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30… |
CVE-2022-34881 | Low | 3.3 | 2022-12-06 | Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information… |
CVE-2022-46151 | Medium | 6.3 | 2022-12-06 | Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/… |
CVE-2022-4173 | High | 7.3 | 2022-12-06 | A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem, to escalate his pr… |
CVE-2022-45283 | High | 7.8 | 2022-12-06 | GPAC MP4box v2.0.0 was discovered to contain a stack overflow in the smil_parse_time_list parameter at /scenegraph/svg_attributes.c. |
CVE-2022-44009 | High | 7.5 | 2022-12-06 | Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of… |
CVE-2022-40918 | Critical | 9.8 | 2022-12-06 | Buffer overflow in firmware lewei_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+ FPV Drone allows attacker to gain remote code execution as root… |
CVE-2022-38337 | Critical | 9.1 | 2022-12-06 | When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can… |
CVE-2022-38336 | High | 8.1 | 2022-12-06 | An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication. |
CVE-2022-45990 | Medium | 6.1 | 2022-12-05 | A cross-site scripting (XSS) vulnerability in the component /signup_script.php of Ecommerce-Website v1.0 allows attackers to execute arbitrary web scripts or H… |
CVE-2022-45769 | Medium | 6.1 | 2022-12-05 | A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter. |
CVE-2022-45020 | High | 8.8 | 2022-12-05 | Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login. T… |
CVE-2022-45019 | High | 7.5 | 2022-12-05 | SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter. |
CVE-2022-43706 | Medium | 5.4 | 2022-12-05 | Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject… |
CVE-2022-45912 | High | 7.2 | 2022-12-05 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An… |
CVE-2022-43557 | Medium | 5.3 | 2022-12-05 | The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, speci… |
CVE-2022-43556 | Medium | 6.1 | 2022-12-05 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output… |
CVE-2022-43553 | High | 8.8 | 2022-12-05 | A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary ad… |
CVE-2022-43549 | Critical | 9.8 | 2022-12-05 | Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms. |
CVE-2022-43548 | High | 8.1 | 2022-12-05 | A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easil… |
CVE-2022-40259 | High | 8.3 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-40242 | High | 7.5 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-35260 | Medium | 6.5 | 2022-12-05 | curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould f… |
CVE-2022-35259 | High | 7.8 | 2022-12-05 | XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorized privileges. |
CVE-2022-35258 | High | 7.5 | 2022-12-05 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R1… |
CVE-2022-35256 | Medium | 6.5 | 2022-12-05 | The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request… |
CVE-2022-35255 | Critical | 9.1 | 2022-12-05 | A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/c… |
CVE-2022-35254 | High | 7.5 | 2022-12-05 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R1… |
CVE-2022-32224 | Critical | 9.8 | 2022-12-05 | A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could al… |
CVE-2022-32221 | Critical | 9.8 | 2022-12-05 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIEL… |
CVE-2022-30123 | Critical | 10.0 | 2022-12-05 | A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger com… |
CVE-2022-30122 | High | 7.5 | 2022-12-05 | A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack. |
CVE-2022-2827 | High | 7.5 | 2022-12-05 | AMI MegaRAC User Enumeration Vulnerability |
CVE-2022-27773 | Critical | 9.8 | 2022-12-05 | A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elevated privileges. |
CVE-2022-23143 | Medium | 6.5 | 2022-12-05 | ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high permissions could use… |
CVE-2022-46169 | Critical | 9.8 | 2022-12-05 | Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a… |
CVE-2022-46164 | Critical | 9.4 | 2022-12-05 | NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payl… |
CVE-2022-45481 | Critical | 9.8 | 2022-12-05 | The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with no prior authorizatio… |
CVE-2022-45479 | Critical | 9.8 | 2022-12-05 | PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authenticati… |