2022 CVEs (page 92)
Page 92 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4089 | Medium | 4.3 | 2022-11-24 | A vulnerability was found in rickxy Stock Management System. It has been declared as problematic. This vulnerability affects unknown code of the file /pages/pr… |
CVE-2022-4088 | High | 7.3 | 2022-11-24 | A vulnerability was found in rickxy Stock Management System and classified as critical. Affected by this issue is some unknown functionality of the file /pages… |
CVE-2022-40977 | High | 7.5 | 2022-11-24 | A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configurat… |
CVE-2022-40976 | Medium | 5.5 | 2022-11-24 | A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to… |
CVE-2022-40266 | Medium | 5.3 | 2022-11-24 | Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 S… |
CVE-2022-4136 | Critical | 9.8 | 2022-11-24 | Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php… |
CVE-2022-44749 | Medium | 5.5 | 2022-11-24 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being over… |
CVE-2022-44748 | High | 7.1 | 2022-11-24 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the s… |
CVE-2022-45873 | Medium | 5.5 | 2022-11-23 | systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object… |
CVE-2022-45872 | Critical | 9.8 | 2022-11-23 | iTerm2 before 3.4.18 mishandles a DECRQSS response. |
CVE-2022-45868 | High | 8.4 | 2022-11-23 | The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to speci… |
CVE-2022-45280 | Medium | 5.4 | 2022-11-23 | A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-45278 | High | 8.8 | 2022-11-23 | Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component. |
CVE-2022-45276 | Critical | 9.8 | 2022-11-23 | An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Administrator account password. |
CVE-2022-44789 | High | 8.8 | 2022-11-23 | A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through me… |
CVE-2022-44120 | Critical | 9.8 | 2022-11-23 | dedecmdv6 6.1.9 is vulnerable to SQL Injection. via sys_sql_query.php. |
CVE-2022-44118 | Critical | 9.8 | 2022-11-23 | dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php. |
CVE-2022-44117 | Critical | 9.8 | 2022-11-23 | Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties because Boa does not ship with any support for SQL. |
CVE-2022-43196 | Critical | 9.1 | 2022-11-23 | dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php. |
CVE-2022-41933 | Medium | 6.2 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset a forgotten password` feature of XWiki… |
CVE-2022-41932 | High | 7.5 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas an… |
CVE-2022-45866 | Medium | 5.3 | 2022-11-23 | qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allows directory traversal via ../ in a .qp… |
CVE-2022-44140 | High | 8.8 | 2022-11-23 | Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component. |
CVE-2022-41946 | Medium | 4.7 | 2022-11-23 | pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `Prepa… |
CVE-2022-41935 | Medium | 5.3 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce t… |
CVE-2022-41934 | Critical | 9.9 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible docum… |
CVE-2022-41931 | Critical | 9.9 | 2022-11-23 | xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on co… |
CVE-2022-41930 | High | 7.5 | 2022-11-23 | org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWik… |
CVE-2022-41929 | Medium | 4.9 | 2022-11-23 | org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script r… |
CVE-2022-41928 | Critical | 9.9 | 2022-11-23 | XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can al… |
CVE-2022-41927 | High | 7.4 | 2022-11-23 | XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The probl… |
CVE-2022-41925 | High | 8.8 | 2022-11-23 | A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment va… |
CVE-2022-41924 | Critical | 9.6 | 2022-11-23 | A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used… |
CVE-2022-41923 | Critical | 9.1 | 2022-11-23 | Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoi… |
CVE-2022-41875 | Critical | 10.0 | 2022-11-23 | A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially… |
CVE-2022-41922 | High | 8.1 | 2022-11-23 | `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has be… |
CVE-2022-40772 | Medium | 6.5 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report mod… |
CVE-2022-40771 | Medium | 4.9 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure. |
CVE-2022-40304 | High | 7.8 | 2022-11-23 | An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic… |
CVE-2022-39833 | High | 7.2 | 2022-11-23 | FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a cr… |
CVE-2022-36111 | Medium | 5.4 | 2022-11-23 | immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof th… |
CVE-2022-23740 | High | 8.8 | 2022-11-23 | CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code exec… |
CVE-2022-38115 | Medium | 5.3 | 2022-11-23 | Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT |
CVE-2022-38114 | Medium | 6.1 | 2022-11-23 | This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS. |
CVE-2022-38113 | Medium | 5.3 | 2022-11-23 | This vulnerability discloses build and services versions in the server response header. |
CVE-2022-35501 | Medium | 5.4 | 2022-11-23 | Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post function. |
CVE-2022-44280 | Medium | 6.5 | 2022-11-23 | Automotive Shop Management System v1.0 is vulnerable to Delete any file via /asms/classes/Master.php?f=delete_img. |
CVE-2022-44278 | High | 7.2 | 2022-11-23 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=user/manage_user&id=. |
CVE-2022-44260 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function. |
CVE-2022-44259 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function. |
CVE-2022-44258 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter command in the setTracerouteCfg function. |
CVE-2022-44257 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function. |
CVE-2022-44256 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function. |
CVE-2022-44255 | Critical | 9.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data. |
CVE-2022-44254 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter text in the setSmsCfg function. |
CVE-2022-44253 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function. |
CVE-2022-44252 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function. |
CVE-2022-44251 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function. |
CVE-2022-44250 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function. |
CVE-2022-44249 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function. |
CVE-2022-44139 | Critical | 9.8 | 2022-11-23 | Apartment Visitor Management System v1.0 is vulnerable to SQL Injection via /avms/index.php. |
CVE-2022-45151 | Medium | 5.4 | 2022-11-23 | The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fiel… |
CVE-2022-45150 | Medium | 6.1 | 2022-11-23 | A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool… |
CVE-2022-45149 | Medium | 5.4 | 2022-11-23 | A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unne… |
CVE-2022-42896 | High | 8.0 | 2022-11-23 | There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow co… |
CVE-2022-42895 | Medium | 5.1 | 2022-11-23 | There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers r… |
CVE-2022-45462 | Critical | 9.8 | 2022-11-23 | Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to versio… |
CVE-2022-4045 | Low | 3.1 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which co… |
CVE-2022-4044 | Medium | 4.3 | 2022-11-23 | A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. |
CVE-2022-4019 | Medium | 4.3 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the… |
CVE-2022-45472 | Medium | 5.4 | 2022-11-23 | CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup. |
CVE-2022-43213 | Critical | 9.8 | 2022-11-23 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editorder.php. |
CVE-2022-41446 | Medium | 5.4 | 2022-11-23 | An access control issue in /Admin/dashboard.php of Record Management System using CodeIgniter v1.0 allows attackers to access and modify user data. |
CVE-2022-40770 | High | 7.2 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users. |
CVE-2022-38147 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3). |
CVE-2022-37421 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/cms through 4.11.0 allows XSS. |
CVE-2022-36337 | High | 8.2 | 2022-11-23 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow vulnerability in the MebxConfiguration driver leads to arbitra… |
CVE-2022-34830 | High | 7.5 | 2022-11-23 | An Arm product family through 2022-06-29 has a TOCTOU Race Condition that allows non-privileged user to make improper GPU processing operations to gain access… |
CVE-2022-42095 | Medium | 4.8 | 2022-11-23 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content. |
CVE-2022-38145 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and ge… |
CVE-2022-37772 | High | 7.5 | 2022-11-23 | Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose responses from the application. An unau… |
CVE-2022-37430 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2). |
CVE-2022-37429 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL… |
CVE-2022-35500 | Medium | 5.4 | 2022-11-23 | Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality. |
CVE-2022-43751 | High | 7.8 | 2022-11-23 | McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirec… |
CVE-2022-40870 | High | 8.1 | 2022-11-23 | The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbi… |
CVE-2022-40303 | High | 7.5 | 2022-11-23 | An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer cou… |
CVE-2022-38724 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS. |
CVE-2022-37774 | Medium | 5.3 | 2022-11-23 | There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (pdf, email) from an archive, a preview i… |
CVE-2022-37773 | Medium | 6.5 | 2022-11-23 | An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disc… |
CVE-2022-45536 | Medium | 4.9 | 2022-11-22 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the id parameter at \admin\post_comments.php. This vulnerability allows attackers to… |
CVE-2022-45535 | Medium | 4.9 | 2022-11-22 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the edit parameter at \admin\categories.php. This vulnerability allows attackers to… |
CVE-2022-45529 | Medium | 4.9 | 2022-11-22 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the post_category_id parameter at \admin\includes\edit_post.php. This vulnerability… |
CVE-2022-45331 | High | 7.5 | 2022-11-22 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p_id parameter at \post.php. This vulnerability allows attackers to access datab… |
CVE-2022-45330 | High | 7.5 | 2022-11-22 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \category.php. This vulnerability allows attackers to acce… |
CVE-2022-39397 | Medium | 5.6 | 2022-11-22 | aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This i… |
CVE-2022-41919 | Medium | 4.2 | 2022-11-22 | Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking… |
CVE-2022-39199 | Medium | 5.8 | 2022-11-22 | immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between different server instance… |
CVE-2022-2791 | Medium | 5.9 | 2022-11-22 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any… |
CVE-2022-4116 | Critical | 9.8 | 2022-11-22 | A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote co… |