2022 CVEs (page 89)
Page 89 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4270 | Low | 2.0 | 2022-12-02 | Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally. |
CVE-2022-2808 | High | 8.8 | 2022-12-02 | Authorization Bypass Through User-Controlled Key vulnerability in Algan Software Prens Student Information System allows Object Relational Mapping Injection. … |
CVE-2022-2807 | Critical | 9.8 | 2022-12-02 | SQL Injection vulnerability in Algan Software Prens Student Information System allows SQL Injection. This issue affects Prens Student Information System: befo… |
CVE-2022-45562 | High | 8.8 | 2022-12-02 | Insecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdoor account low privi… |
CVE-2022-44930 | Critical | 9.8 | 2022-12-02 | D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function. |
CVE-2022-44929 | Critical | 9.8 | 2022-12-02 | An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SIB profiles. |
CVE-2022-44928 | Critical | 9.8 | 2022-12-02 | D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function. |
CVE-2022-43325 | Critical | 9.8 | 2022-12-02 | An unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.* - 1.4.* allows attackers t… |
CVE-2022-44212 | Medium | 5.9 | 2022-12-01 | In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel. |
CVE-2022-44211 | High | 7.4 | 2022-12-01 | In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings. |
CVE-2022-43333 | Critical | 9.8 | 2022-12-01 | Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution (RCE) vulnerability in the component action_export_control.php. |
CVE-2022-35120 | High | 8.8 | 2022-12-01 | IXPdata EasyInstall 6.6.14725 contains an access control issue. |
CVE-2022-42718 | High | 7.8 | 2022-12-01 | Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to potentially enable esca… |
CVE-2022-41971 | Medium | 4.8 | 2022-12-01 | Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to recei… |
CVE-2022-41970 | Low | 2.6 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview im… |
CVE-2022-41969 | Low | 2.4 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user… |
CVE-2022-41968 | Low | 3.5 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a dat… |
CVE-2022-23737 | Medium | 6.5 | 2022-12-01 | An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages… |
CVE-2022-43901 | Medium | 5.7 | 2022-12-01 | IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.3 could disclose sensitive information. An authenticated local attacker could exploit this vul… |
CVE-2022-43900 | Medium | 5.3 | 2022-12-01 | IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.2 could provide a weaker than expected security. A local attacker can create an outbound netwo… |
CVE-2022-41297 | Medium | 4.3 | 2022-12-01 | IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2022-3713 | High | 8.8 | 2022-12-01 | A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-3711 | Medium | 4.3 | 2022-12-01 | A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall rele… |
CVE-2022-3710 | Low | 2.7 | 2022-12-01 | A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Fire… |
CVE-2022-3709 | Medium | 6.8 | 2022-12-01 | A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version… |
CVE-2022-3696 | High | 7.2 | 2022-12-01 | A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-3226 | High | 7.2 | 2022-12-01 | An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-2969 | High | 8.1 | 2022-12-01 | Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory l… |
CVE-2022-29837 | Medium | 4.7 | 2022-12-01 | A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate inst… |
CVE-2022-4257 | Medium | 6.3 | 2022-12-01 | A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto… |
CVE-2022-37017 | High | 7.5 | 2022-12-01 | Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a typ… |
CVE-2022-37016 | Critical | 9.8 | 2022-12-01 | Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attem… |
CVE-2022-30528 | Critical | 9.8 | 2022-12-01 | SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via th… |
CVE-2022-28607 | High | 7.5 | 2022-12-01 | An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the ac… |
CVE-2022-3270 | Critical | 9.8 | 2022-12-01 | In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confide… |
CVE-2022-1471 | High | 8.3 | 2022-12-01 | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker ca… |
CVE-2022-4221 | Critical | 9.8 | 2022-12-01 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Asus NAS-M25 allows an unauthenticated attacker to… |
CVE-2022-45050 | Medium | 6.1 | 2022-12-01 | A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The title parameter on the twitt… |
CVE-2022-4253 | Low | 3.5 | 2022-12-01 | A vulnerability was found in SourceCodester Canteen Management System. It has been declared as problematic. This vulnerability affects the function builtin_ech… |
CVE-2022-4252 | Low | 3.5 | 2022-12-01 | A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function builtin_echo of the fil… |
CVE-2022-4251 | Low | 2.4 | 2022-12-01 | A vulnerability was found in Movie Ticket Booking System and classified as problematic. Affected by this issue is some unknown functionality of the file editBo… |
CVE-2022-4250 | Low | 3.5 | 2022-12-01 | A vulnerability has been found in Movie Ticket Booking System and classified as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-4249 | Low | 3.5 | 2022-12-01 | A vulnerability, which was classified as problematic, was found in Movie Ticket Booking System. Affected is an unknown function of the component POST Request H… |
CVE-2022-4248 | Medium | 5.0 | 2022-12-01 | A vulnerability, which was classified as critical, has been found in Movie Ticket Booking System. This issue affects some unknown processing of the file editBo… |
CVE-2022-4247 | Medium | 6.3 | 2022-12-01 | A vulnerability classified as critical was found in Movie Ticket Booking System. This vulnerability affects unknown code of the file booking.php. The manipulat… |
CVE-2022-4246 | Medium | 4.3 | 2022-12-01 | A vulnerability classified as problematic has been found in Kakao PotPlayer. This affects an unknown part of the component MID File Handler. The manipulation l… |
CVE-2022-36431 | Critical | 9.8 | 2022-12-01 | An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted J… |
CVE-2022-45640 | High | 7.5 | 2022-12-01 | Tenda Tenda AC6V1.0 V15.03.05.19 is affected by buffer overflow. Causes a denial of service (local). |
CVE-2022-45045 | High | 8.8 | 2022-12-01 | Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authentica… |
CVE-2022-44262 | Critical | 9.8 | 2022-12-01 | ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE). |
CVE-2022-40849 | Medium | 5.4 | 2022-12-01 | ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XS… |
CVE-2022-40489 | High | 8.8 | 2022-12-01 | ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrati… |
CVE-2022-40204 | Medium | 4.1 | 2022-12-01 | A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in undisclosed pages aft… |
CVE-2022-46162 | High | 8.8 | 2022-11-30 | discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discou… |
CVE-2022-46156 | High | 7.2 | 2022-11-30 | The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote ta… |
CVE-2022-23746 | High | 7.5 | 2022-11-30 | The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password… |
CVE-2022-44296 | High | 7.2 | 2022-11-30 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manage_remark.php?id=. |
CVE-2022-44295 | High | 7.2 | 2022-11-30 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=. |
CVE-2022-44294 | High | 7.2 | 2022-11-30 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manage_service&id=. |
CVE-2022-4234 | Low | 3.5 | 2022-11-30 | A vulnerability was found in SourceCodester Canteen Management System. It has been rated as problematic. This issue affects the function builtin_echo of the fi… |
CVE-2022-46149 | Medium | 5.4 | 2022-11-30 | Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as vers… |
CVE-2022-44151 | Critical | 9.8 | 2022-11-30 | Simple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php. |
CVE-2022-44136 | Critical | 9.8 | 2022-11-30 | Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE). |
CVE-2022-1911 | Medium | 5.3 | 2022-11-30 | Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the under… |
CVE-2022-1606 | Low | 2.4 | 2022-11-30 | Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects. |
CVE-2022-38803 | Medium | 6.8 | 2022-11-30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local f… |
CVE-2022-38802 | Medium | 6.2 | 2022-11-30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holid… |
CVE-2022-38801 | Medium | 5.4 | 2022-11-30 | In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting. |
CVE-2022-45842 | Medium | 5.3 | 2022-11-30 | Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores. |
CVE-2022-26366 | Medium | 5.4 | 2022-11-30 | Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress. |
CVE-2022-24441 | Medium | 5.8 | 2022-11-30 | The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can… |
CVE-2022-22984 | Medium | 5.0 | 2022-11-30 | The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plu… |
CVE-2022-4233 | Low | 2.4 | 2022-11-30 | A vulnerability has been found in SourceCodester Event Registration System 1.0 and classified as problematic. Affected by this vulnerability is an unknown func… |
CVE-2022-4232 | Medium | 4.7 | 2022-11-30 | A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation… |
CVE-2022-4231 | Medium | 4.2 | 2022-11-30 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the… |
CVE-2022-4229 | High | 7.3 | 2022-11-30 | A vulnerability classified as critical was found in SourceCodester Book Store Management System 1.0. This vulnerability affects unknown code of the file /bsms_… |
CVE-2022-4228 | Medium | 5.3 | 2022-11-30 | A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsms_ci/… |
CVE-2022-3859 | Medium | 6.7 | 2022-11-30 | An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. This allows an attacker with admin access, whic… |
CVE-2022-4222 | Medium | 5.0 | 2022-11-30 | A vulnerability was found in SourceCodester Canteen Management System. It has been rated as critical. This issue affects the function query of the file ajax_in… |
CVE-2022-46338 | Medium | 6.5 | 2022-11-30 | g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowin… |
CVE-2022-45869 | Medium | 5.5 | 2022-11-30 | A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memo… |
CVE-2022-44097 | Critical | 9.8 | 2022-11-30 | Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel. |
CVE-2022-44096 | Critical | 9.8 | 2022-11-30 | Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel. |
CVE-2022-41413 | Medium | 4.3 | 2022-11-30 | perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted input into the Searc… |
CVE-2022-41412 | High | 8.6 | 2022-11-30 | An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery (SSRF)… |
CVE-2022-45337 | High | 7.5 | 2022-11-30 | Tenda TX9 Pro v22.03.02.10 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind. |
CVE-2022-45332 | High | 7.8 | 2022-11-30 | LibreDWG v0.12.4.4643 was discovered to contain a heap buffer overflow via the function decode_preR13_section_hdr at decode_r11.c. |
CVE-2022-45328 | High | 7.2 | 2022-11-30 | Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_members.php. |
CVE-2022-40265 | High | 8.6 | 2022-11-30 | Improper Input Validation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series RJ71EN71 Firmware version "65" and prior and Mitsubishi Electric… |
CVE-2022-4195 | Medium | 4.3 | 2022-11-30 | Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malic… |
CVE-2022-4194 | High | 8.8 | 2022-11-30 | Use after free in Accessibility in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2022-4193 | High | 8.8 | 2022-11-30 | Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a c… |
CVE-2022-4192 | High | 8.8 | 2022-11-30 | Use after free in Live Caption in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to p… |
CVE-2022-4191 | High | 8.8 | 2022-11-30 | Use after free in Sign-In in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potent… |
CVE-2022-4190 | High | 8.8 | 2022-11-30 | Insufficient data validation in Directory in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HT… |
CVE-2022-4189 | Medium | 4.3 | 2022-11-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2022-4188 | Medium | 4.3 | 2022-11-30 | Insufficient validation of untrusted input in CORS in Google Chrome on Android prior to 108.0.5359.71 allowed a remote attacker to bypass same origin policy vi… |
CVE-2022-4187 | Medium | 6.5 | 2022-11-30 | Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via… |
CVE-2022-4186 | Medium | 4.3 | 2022-11-30 | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious… |
CVE-2022-4185 | Medium | 4.3 | 2022-11-30 | Inappropriate implementation in Navigation in Google Chrome on iOS prior to 108.0.5359.71 allowed a remote attacker to spoof the contents of the modal dialogue… |