2022 CVEs (page 92)
Page 92 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2721 | High | 7.5 | 2022-11-25 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verb… |
CVE-2022-45888 | Medium | 6.4 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of… |
CVE-2022-45887 | Medium | 4.7 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_deta… |
CVE-2022-45886 | High | 7.0 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads… |
CVE-2022-45885 | High | 7.0 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-after-free when a de… |
CVE-2022-45884 | High | 7.0 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically all… |
CVE-2022-4135 | Critical | 9.6 | 2022-11-25 | Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2022-29833 | Medium | 6.8 | 2022-11-25 | Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthenticated attac… |
CVE-2022-29832 | Low | 3.7 | 2022-11-25 | Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versio… |
CVE-2022-29831 | High | 7.5 | 2022-11-25 | Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker t… |
CVE-2022-29830 | Critical | 9.1 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related… |
CVE-2022-29829 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions fro… |
CVE-2022-29828 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-29827 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-29826 | Medium | 6.8 | 2022-11-25 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 r… |
CVE-2022-29825 | Medium | 5.6 | 2022-11-25 | Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C… |
CVE-2022-25164 | High | 8.6 | 2022-11-25 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Modu… |
CVE-2022-2650 | Critical | 9.8 | 2022-11-24 | Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. |
CVE-2022-26885 | High | 7.5 | 2022-11-24 | When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher. |
CVE-2022-4090 | Medium | 4.3 | 2022-11-24 | A vulnerability was found in rickxy Stock Management System and classified as problematic. This issue affects some unknown processing of the file us_transac.ph… |
CVE-2022-4089 | Medium | 4.3 | 2022-11-24 | A vulnerability was found in rickxy Stock Management System. It has been declared as problematic. This vulnerability affects unknown code of the file /pages/pr… |
CVE-2022-4088 | High | 7.3 | 2022-11-24 | A vulnerability was found in rickxy Stock Management System and classified as critical. Affected by this issue is some unknown functionality of the file /pages… |
CVE-2022-40977 | High | 7.5 | 2022-11-24 | A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, malicious configurat… |
CVE-2022-40976 | Medium | 5.5 | 2022-11-24 | A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious configuration file to… |
CVE-2022-40266 | Medium | 5.3 | 2022-11-24 | Improper Input Validation vulnerability in Mitsubishi Electric GOT2000 Series GT27 model FTP server versions 01.39.000 and prior, Mitsubishi Electric GOT2000 S… |
CVE-2022-4136 | Critical | 9.8 | 2022-11-24 | Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php… |
CVE-2022-44749 | Medium | 5.5 | 2022-11-24 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being over… |
CVE-2022-44748 | High | 7.1 | 2022-11-24 | A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the s… |
CVE-2022-45873 | Medium | 5.5 | 2022-11-23 | systemd 250 and 251 allows local users to achieve a systemd-coredump deadlock by triggering a crash that has a long backtrace. This occurs in parse_elf_object… |
CVE-2022-45872 | Critical | 9.8 | 2022-11-23 | iTerm2 before 3.4.18 mishandles a DECRQSS response. |
CVE-2022-45868 | High | 8.4 | 2022-11-23 | The web-based admin console in H2 Database Engine before 2.2.220 can be started via the CLI with the argument -webAdminPassword, which allows the user to speci… |
CVE-2022-45280 | Medium | 5.4 | 2022-11-23 | A cross-site scripting (XSS) vulnerability in the Url parameter in /login.php of EyouCMS v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-45278 | High | 8.8 | 2022-11-23 | Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /index.php/admins/Fields/get_fields.html component. |
CVE-2022-45276 | Critical | 9.8 | 2022-11-23 | An issue in the /index/user/user_edit.html component of YJCMS v1.0.9 allows unauthenticated attackers to obtain the Administrator account password. |
CVE-2022-44789 | High | 8.8 | 2022-11-23 | A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through me… |
CVE-2022-44120 | Critical | 9.8 | 2022-11-23 | dedecmdv6 6.1.9 is vulnerable to SQL Injection. via sys_sql_query.php. |
CVE-2022-44118 | Critical | 9.8 | 2022-11-23 | dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php. |
CVE-2022-44117 | Critical | 9.8 | 2022-11-23 | Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties because Boa does not ship with any support for SQL. |
CVE-2022-43196 | Critical | 9.1 | 2022-11-23 | dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php. |
CVE-2022-41933 | Medium | 6.2 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When the `reset a forgotten password` feature of XWiki… |
CVE-2022-41932 | High | 7.5 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to make XWiki create many new schemas an… |
CVE-2022-45866 | Medium | 5.3 | 2022-11-23 | qpress before PierreLvx/qpress 20220819 and before version 11.3, as used in Percona XtraBackup and other products, allows directory traversal via ../ in a .qp… |
CVE-2022-44140 | High | 8.8 | 2022-11-23 | Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component. |
CVE-2022-41946 | Medium | 4.7 | 2022-11-23 | pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `Prepa… |
CVE-2022-41935 | Medium | 5.3 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Users without the right to view documents can deduce t… |
CVE-2022-41934 | Critical | 9.9 | 2022-11-23 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any user with view rights on commonly accessible docum… |
CVE-2022-41931 | Critical | 9.9 | 2022-11-23 | xwiki-platform-icon-ui is vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection'). Any user with view rights on co… |
CVE-2022-41930 | High | 7.5 | 2022-11-23 | org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWik… |
CVE-2022-41929 | Medium | 4.9 | 2022-11-23 | org.xwiki.platform:xwiki-platform-oldcore is missing authorization in User#setDisabledStatus, which may allow an incorrectly authorized user with only Script r… |
CVE-2022-41928 | Critical | 9.9 | 2022-11-23 | XWiki Platform vulnerable to Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in AttachmentSelector.xml. The issue can al… |
CVE-2022-41927 | High | 7.4 | 2022-11-23 | XWiki Platform is vulnerable to Cross-Site Request Forgery (CSRF) that may allow attackers to delete or rename tags without needing any confirmation. The probl… |
CVE-2022-41925 | High | 8.8 | 2022-11-23 | A vulnerability identified in the Tailscale client allows a malicious website to access the peer API, which can then be used to access Tailscale environment va… |
CVE-2022-41924 | Critical | 9.6 | 2022-11-23 | A vulnerability identified in the Tailscale Windows client allows a malicious website to reconfigure the Tailscale daemon `tailscaled`, which can then be used… |
CVE-2022-41923 | Critical | 9.1 | 2022-11-23 | Grails Spring Security Core plugin is vulnerable to privilege escalation. The vulnerability allows an attacker access to one endpoint (i.e. the targeted endpoi… |
CVE-2022-41875 | Critical | 10.0 | 2022-11-23 | A remote code execution (RCE) vulnerability in Optica allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. Specially… |
CVE-2022-41922 | High | 8.1 | 2022-11-23 | `yiisoft/yii` before version 1.1.27 are vulnerable to Remote Code Execution (RCE) if the application calls `unserialize()` on arbitrary user input. This has be… |
CVE-2022-40772 | Medium | 6.5 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to a validation bypass that allows users to access sensitive data via the report mod… |
CVE-2022-40771 | Medium | 4.9 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to an XML External Entity attack that leads to Information Disclosure. |
CVE-2022-40304 | High | 7.8 | 2022-11-23 | An issue was discovered in libxml2 before 2.10.3. Certain invalid XML entity definitions can corrupt a hash table key, potentially leading to subsequent logic… |
CVE-2022-39833 | High | 7.2 | 2022-11-23 | FileCloud Versions 20.2 and later allows remote attackers to potentially cause unauthorized remote code execution and access to reported API endpoints via a cr… |
CVE-2022-36111 | Medium | 5.4 | 2022-11-23 | immudb is a database with built-in cryptographic proof and verification. In versions prior to 1.4.1, a malicious immudb server can provide a falsified proof th… |
CVE-2022-23740 | High | 8.8 | 2022-11-23 | CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code exec… |
CVE-2022-38115 | Medium | 5.3 | 2022-11-23 | Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT |
CVE-2022-38114 | Medium | 6.1 | 2022-11-23 | This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS. |
CVE-2022-38113 | Medium | 5.3 | 2022-11-23 | This vulnerability discloses build and services versions in the server response header. |
CVE-2022-35501 | Medium | 5.4 | 2022-11-23 | Stored Cross-site Scripting (XSS) exists in the Amasty Blog Pro 2.10.3 and 2.10.4 plugin for Magento 2 because of the duplicate post function. |
CVE-2022-44280 | Medium | 6.5 | 2022-11-23 | Automotive Shop Management System v1.0 is vulnerable to Delete any file via /asms/classes/Master.php?f=delete_img. |
CVE-2022-44278 | High | 7.2 | 2022-11-23 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=user/manage_user&id=. |
CVE-2022-44260 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function. |
CVE-2022-44259 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function. |
CVE-2022-44258 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter command in the setTracerouteCfg function. |
CVE-2022-44257 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function. |
CVE-2022-44256 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function. |
CVE-2022-44255 | Critical | 9.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data. |
CVE-2022-44254 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter text in the setSmsCfg function. |
CVE-2022-44253 | High | 8.8 | 2022-11-23 | TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function. |
CVE-2022-44252 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function. |
CVE-2022-44251 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function. |
CVE-2022-44250 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function. |
CVE-2022-44249 | Critical | 9.8 | 2022-11-23 | TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function. |
CVE-2022-44139 | Critical | 9.8 | 2022-11-23 | Apartment Visitor Management System v1.0 is vulnerable to SQL Injection via /avms/index.php. |
CVE-2022-45151 | Medium | 5.4 | 2022-11-23 | The stored-XSS vulnerability was discovered in Moodle which exists due to insufficient sanitization of user-supplied data in several "social" user profile fiel… |
CVE-2022-45150 | Medium | 6.1 | 2022-11-23 | A reflected cross-site scripting vulnerability was discovered in Moodle. This flaw exists due to insufficient sanitization of user-supplied data in policy tool… |
CVE-2022-45149 | Medium | 5.4 | 2022-11-23 | A vulnerability was found in Moodle which exists due to insufficient validation of the HTTP request origin in course redirect URL. A user's CSRF token was unne… |
CVE-2022-42896 | High | 8.0 | 2022-11-23 | There are use-after-free vulnerabilities in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_connect and l2cap_le_connect_req functions which may allow co… |
CVE-2022-42895 | Medium | 5.1 | 2022-11-23 | There is an infoleak vulnerability in the Linux kernel's net/bluetooth/l2cap_core.c's l2cap_parse_conf_req function which can be used to leak kernel pointers r… |
CVE-2022-45462 | Critical | 9.8 | 2022-11-23 | Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to versio… |
CVE-2022-4045 | Low | 3.1 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which co… |
CVE-2022-4044 | Medium | 4.3 | 2022-11-23 | A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages. |
CVE-2022-4019 | Medium | 4.3 | 2022-11-23 | A denial-of-service vulnerability in the Mattermost Playbooks plugin allows an authenticated user to crash the server via multiple large requests to one of the… |
CVE-2022-45472 | Medium | 5.4 | 2022-11-23 | CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup. |
CVE-2022-43213 | Critical | 9.8 | 2022-11-23 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editorder.php. |
CVE-2022-41446 | Medium | 5.4 | 2022-11-23 | An access control issue in /Admin/dashboard.php of Record Management System using CodeIgniter v1.0 allows attackers to access and modify user data. |
CVE-2022-40770 | High | 7.2 | 2022-11-23 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. This can be exploited by high-privileged users. |
CVE-2022-38147 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3). |
CVE-2022-37421 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/cms through 4.11.0 allows XSS. |
CVE-2022-36337 | High | 8.2 | 2022-11-23 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow vulnerability in the MebxConfiguration driver leads to arbitra… |
CVE-2022-34830 | High | 7.5 | 2022-11-23 | An Arm product family through 2022-06-29 has a TOCTOU Race Condition that allows non-privileged user to make improper GPU processing operations to gain access… |
CVE-2022-42095 | Medium | 4.8 | 2022-11-23 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content. |
CVE-2022-38145 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and ge… |