2022 CVEs (page 86)
Page 86 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44900 | Critical | 9.1 | 2022-12-06 | A directory traversal vulnerability in the SevenZipFile.extractall() function of the python library py7zr v0.20.0 and earlier allows attackers to write arbitra… |
CVE-2022-23475 | High | 8.8 | 2022-12-06 | daloRADIUS is an open source RADIUS web management application. daloRadius 1.3 and prior are vulnerable to a combination cross site scripting (XSS) and cross s… |
CVE-2022-4147 | High | 7.5 | 2022-12-06 | Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which… |
CVE-2022-46161 | Critical | 10.0 | 2022-12-06 | pdfmake is an open source client/server side PDF printing in pure JavaScript. In versions up to and including 0.2.5 pdfmake contains an unsafe evaluation of us… |
CVE-2022-46154 | High | 8.6 | 2022-12-06 | Kodexplorer is a chinese language web based file manager and browser based code editor. Versions prior to 4.50 did not prevent unauthenticated users from reque… |
CVE-2022-45548 | High | 8.8 | 2022-12-06 | AyaCMS v3.1.2 has an Arbitrary File Upload vulnerability. |
CVE-2022-43867 | High | 7.8 | 2022-12-06 | IBM Spectrum Scale 5.1.0.1 through 5.1.4.1 could allow a local attacker to execute arbitrary commands in the container. IBM X-Force ID: 239437. |
CVE-2022-43369 | Medium | 6.1 | 2022-12-06 | AutoTaxi Stand Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component search.php. |
CVE-2022-41560 | Medium | 6.5 | 2022-12-06 | The Statement Set Upload via the Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows a low priv… |
CVE-2022-41559 | Critical | 9.3 | 2022-12-06 | The Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows an unauthenticated attacker with networ… |
CVE-2022-34361 | Medium | 5.9 | 2022-12-06 | IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X… |
CVE-2022-23472 | Medium | 5.9 | 2022-12-06 | Passeo is an open source python password generator. Versions prior to 1.0.5 rely on the python `random` library for random value selection. The python `random`… |
CVE-2022-23470 | High | 8.6 | 2022-12-06 | Galaxy is an open-source platform for data analysis. An arbitrary file read exists in Galaxy 22.01 and Galaxy 22.05 due to the switch to Gunicorn, which can be… |
CVE-2022-23466 | Medium | 5.4 | 2022-12-06 | teler is an real-time intrusion detection and threat alert dashboard. teler prior to version 2.0.0-rc.4 is vulnerable to DOM-based cross-site scripting (XSS) i… |
CVE-2022-45326 | Medium | 4.9 | 2022-12-06 | An XML external entity (XXE) injection vulnerability in Kwoksys Kwok Information Server before v2.9.5.SP31 allows remote authenticated users to conduct server-… |
CVE-2022-40680 | Medium | 4.0 | 2022-12-06 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7… |
CVE-2022-38379 | Low | 3.5 | 2022-12-06 | Improper neutralization of input during web page generation [CWE-79] in FortiSOAR 7.0.0 through 7.0.3 and 7.2.0 may allow an authenticated attacker to inject H… |
CVE-2022-35843 | High | 8.1 | 2022-12-06 | An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0, 7.0.0 through 7.0.7, 6.4.0 through 6.4.9… |
CVE-2022-33876 | Medium | 5.4 | 2022-12-06 | Multiple instances of improper input validation vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through 7.0.2 and version 6.2.4 and below allow… |
CVE-2022-33875 | Medium | 5.4 | 2022-12-06 | An improper neutralization of special elements used in an SQL Command ('SQL Injection') vulnerability in Fortinet FortiADC version 7.1.0, version 7.0.0 through… |
CVE-2022-30305 | Low | 3.7 | 2022-12-06 | An insufficient logging [CWE-778] vulnerability in FortiSandbox versions 4.0.0 to 4.0.2, 3.2.0 to 3.2.3 and 3.1.0 to 3.1.5 and FortiDeceptor versions 4.2.0, 4… |
CVE-2022-46382 | High | 8.8 | 2022-12-06 | RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has Insecure Permissions. After signing… |
CVE-2022-44289 | High | 8.8 | 2022-12-06 | Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell. |
CVE-2022-43363 | Medium | 6.1 | 2022-12-06 | Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. NOTE: some third parties have been unable to discern any relati… |
CVE-2022-41325 | High | 7.8 | 2022-12-06 | An integer overflow in the VNC module in VideoLAN VLC Media Player through 3.0.17.4 allows attackers, by tricking a user into opening a crafted playlist or con… |
CVE-2022-38123 | High | 8.7 | 2022-12-06 | Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager i… |
CVE-2022-46383 | Critical | 9.8 | 2022-12-06 | RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has exposed a privileged token via a pub… |
CVE-2022-40209 | Medium | 6.1 | 2022-12-06 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Xylus Themes WP Smart Import plugin <= 1.0.2 on WordPress. |
CVE-2022-4300 | Medium | 6.3 | 2022-12-06 | A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Tem… |
CVE-2022-4296 | Medium | 6.5 | 2022-12-06 | A vulnerability classified as problematic has been found in TP-Link TL-WR740N. Affected is an unknown function of the component ARP Handler. The manipulation l… |
CVE-2022-42782 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. |
CVE-2022-42781 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42780 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42779 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42778 | High | 7.8 | 2022-12-06 | In windows manager service, there is a missing permission check. This could lead to set up windows manager service with no additional execution privileges need… |
CVE-2022-42777 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-42776 | High | 7.8 | 2022-12-06 | In UscAIEngine service, there is a missing permission check. This could lead to set up UscAIEngine service with no additional execution privileges needed. |
CVE-2022-42775 | Medium | 5.5 | 2022-12-06 | In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel. |
CVE-2022-42774 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42773 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42772 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42771 | Medium | 4.7 | 2022-12-06 | In wlan driver, there is a race condition, This could lead to local denial of service in wlan services. |
CVE-2022-42770 | Medium | 4.7 | 2022-12-06 | In wlan driver, there is a race condition, This could lead to local denial of service in wlan services. |
CVE-2022-42769 | Low | 3.3 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42768 | Medium | 4.3 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42767 | Low | 3.3 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42766 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing permission check, This could lead to local information disclosure. |
CVE-2022-42765 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42764 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42763 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42762 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42761 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42760 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42759 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42758 | Low | 3.3 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42757 | Low | 3.3 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42756 | Medium | 5.5 | 2022-12-06 | In sensor driver, there is a possible buffer overflow due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-42755 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-42754 | Medium | 5.5 | 2022-12-06 | In npu driver, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel. |
CVE-2022-39134 | Medium | 4.7 | 2022-12-06 | In audio driver, there is a use after free due to a race condition. This could lead to local denial of service in kernel. |
CVE-2022-39133 | Medium | 5.5 | 2022-12-06 | In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. |
CVE-2022-39132 | Medium | 5.5 | 2022-12-06 | In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39131 | Medium | 5.5 | 2022-12-06 | In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel. |
CVE-2022-39130 | Medium | 5.5 | 2022-12-06 | In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39129 | Medium | 5.5 | 2022-12-06 | In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39106 | Medium | 5.5 | 2022-12-06 | In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel. |
CVE-2022-39102 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39101 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39100 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39099 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39098 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39097 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39096 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39095 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39094 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39093 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39092 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39091 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-39090 | High | 7.8 | 2022-12-06 | In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges ne… |
CVE-2022-25912 | High | 8.1 | 2022-12-06 | The package simple-git before 3.15.0 are vulnerable to Remote Code Execution (RCE) when enabling the ext transport protocol, which makes it exploitable via clo… |
CVE-2022-24439 | High | 8.1 | 2022-12-06 | All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a mali… |
CVE-2022-40603 | Medium | 4.7 | 2022-12-06 | A cross-site scripting (XSS) vulnerability in the CGI program of Zyxel ZyWALL/USG series firmware versions 4.30 through 4.72, VPN series firmware versions 4.30… |
CVE-2022-34881 | Low | 3.3 | 2022-12-06 | Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information… |
CVE-2022-46151 | Medium | 6.3 | 2022-12-06 | Querybook is an open source data querying UI. In affected versions user provided data is not escaped in the error field of the auth callback url in `querybook/… |
CVE-2022-4173 | High | 7.3 | 2022-12-06 | A vulnerability within the malware removal functionality of Avast and AVG Antivirus allowed an attacker with write access to the filesystem, to escalate his pr… |
CVE-2022-45283 | High | 7.8 | 2022-12-06 | GPAC MP4box v2.0.0 was discovered to contain a stack overflow in the smil_parse_time_list parameter at /scenegraph/svg_attributes.c. |
CVE-2022-44009 | High | 7.5 | 2022-12-06 | Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of… |
CVE-2022-40918 | Critical | 9.8 | 2022-12-06 | Buffer overflow in firmware lewei_cam binary version 2.0.10 in Force 1 Discovery Wifi U818A HD+ FPV Drone allows attacker to gain remote code execution as root… |
CVE-2022-38337 | Critical | 9.1 | 2022-12-06 | When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can… |
CVE-2022-38336 | High | 8.1 | 2022-12-06 | An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication. |
CVE-2022-45990 | Medium | 6.1 | 2022-12-05 | A cross-site scripting (XSS) vulnerability in the component /signup_script.php of Ecommerce-Website v1.0 allows attackers to execute arbitrary web scripts or H… |
CVE-2022-45769 | Medium | 6.1 | 2022-12-05 | A cross-site scripting (XSS) vulnerability in ClicShopping_V3 v3.402 allows attackers to execute arbitrary web scripts or HTML via a crafted URL parameter. |
CVE-2022-45020 | High | 8.8 | 2022-12-05 | Rukovoditel v3.2.1 was discovered to contain a DOM-based cross-site scripting (XSS) vulnerability in the component /rukovoditel/index.php?module=users/login. T… |
CVE-2022-45019 | High | 7.5 | 2022-12-05 | SLiMS 9 Bulian v9.5.0 was discovered to contain a SQL injection vulnerability via the keywords parameter. |
CVE-2022-43706 | Medium | 5.4 | 2022-12-05 | Cross-site scripting (XSS) vulnerability in the Web UI of StackStorm versions prior to 3.8.0 allowed logged in users with write access to pack rules to inject… |
CVE-2022-45912 | High | 7.2 | 2022-12-05 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. Remote code execution can occur through ClientUploader by an authenticated admin user. An… |
CVE-2022-43557 | Medium | 5.3 | 2022-12-05 | The BD BodyGuard™ infusion pumps specified allow for access through the RS-232 (serial) port interface. If exploited, threat actors with physical access, speci… |
CVE-2022-43556 | Medium | 6.1 | 2022-12-05 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XSS in the text input field since the result dashboard page output… |
CVE-2022-43553 | High | 8.8 | 2022-12-05 | A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary ad… |
CVE-2022-43549 | Critical | 9.8 | 2022-12-05 | Improper authentication in Veeam Backup for Google Cloud v1.0 and v3.0 allows attackers to bypass authentication mechanisms. |