2022 CVEs (page 93)
Page 93 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41943 | Critical | 9.0 | 2022-11-22 | sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch`… |
CVE-2022-41942 | High | 7.9 | 2022-11-22 | Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sour… |
CVE-2022-40228 | Low | 3.7 | 2022-11-22 | IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidat… |
CVE-2022-3500 | Medium | 5.1 | 2022-11-22 | A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibilit… |
CVE-2022-43212 | Critical | 9.8 | 2022-11-22 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php. |
CVE-2022-41950 | Medium | 6.4 | 2022-11-22 | super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. This caused inaccurat… |
CVE-2022-39070 | Critical | 9.8 | 2022-11-22 | There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to… |
CVE-2022-39067 | Medium | 6.5 | 2022-11-22 | There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the wifi interface, an authenticated attacker could us… |
CVE-2022-39066 | High | 8.8 | 2022-11-22 | There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attac… |
CVE-2022-44737 | Medium | 6.5 | 2022-11-22 | Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress. |
CVE-2022-41952 | Medium | 6.5 | 2022-11-22 | Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection t… |
CVE-2022-44808 | Critical | 9.8 | 2022-11-22 | A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute arbitrary operatin… |
CVE-2022-44807 | Critical | 9.8 | 2022-11-22 | D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow via webGetVarString. |
CVE-2022-44806 | Critical | 9.8 | 2022-11-22 | D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow. |
CVE-2022-44804 | Critical | 9.8 | 2022-11-22 | D-Link DIR-882 1.10B02 and1.20B06 is vulnerable to Buffer Overflow via the websRedirect function. |
CVE-2022-44801 | Critical | 9.8 | 2022-11-22 | D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control. |
CVE-2022-44202 | Critical | 9.8 | 2022-11-22 | D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow. |
CVE-2022-44201 | Critical | 9.8 | 2022-11-22 | D-Link DIR823G 1.02B05 is vulnerable to Commad Injection. |
CVE-2022-44184 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_sec. |
CVE-2022-44200 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8, V1.3.1.64 is vulnerable to Buffer Overflow via parameters: stamode_dns1_pri and stamode_dns1_sec. |
CVE-2022-44199 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_server_ip. |
CVE-2022-44198 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_push1. |
CVE-2022-44197 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_server_ip. |
CVE-2022-44196 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_push1. |
CVE-2022-44194 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode_dns1_pri and apmode_dns1_sec. |
CVE-2022-44193 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameters: starthour, startminute , endhour, and endminute. |
CVE-2022-44191 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameters KEY1 and KEY2. |
CVE-2022-44190 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable_band_steering. |
CVE-2022-44188 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter enable_band_steering. |
CVE-2022-44187 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via wan_dns1_pri. |
CVE-2022-44186 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_pri. |
CVE-2022-42989 | Critical | 9.0 | 2022-11-22 | ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada. |
CVE-2022-41445 | Medium | 4.8 | 2022-11-22 | A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2022-33012 | High | 8.8 | 2022-11-22 | Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. |
CVE-2022-42098 | High | 8.8 | 2022-11-22 | KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php. |
CVE-2022-42097 | Medium | 4.8 | 2022-11-22 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . |
CVE-2022-42094 | Medium | 4.8 | 2022-11-22 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content. |
CVE-2022-3910 | High | 7.8 | 2022-11-22 | Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local P… |
CVE-2022-38462 | Medium | 6.1 | 2022-11-22 | Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request. |
CVE-2022-0222 | High | 7.5 | 2022-11-22 | A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending… |
CVE-2022-37301 | High | 7.5 | 2022-11-22 | A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations w… |
CVE-2022-2513 | High | 7.1 | 2022-11-22 | A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 produc… |
CVE-2022-41131 | High | 7.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows… |
CVE-2022-40954 | Medium | 5.5 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allow… |
CVE-2022-40189 | Critical | 9.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows… |
CVE-2022-38649 | Critical | 9.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allow… |
CVE-2022-45363 | Medium | 5.4 | 2022-11-22 | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) in Muffingroup Betheme theme <= 26.6.1 on WordPress. |
CVE-2022-37931 | High | 7.3 | 2022-11-22 | A vulnerability in NetBatch-Plus software allows unauthorized access to the application. HPE has provided a workaround and fix. Please refer to HPE Security… |
CVE-2022-4111 | Medium | 6.5 | 2022-11-22 | Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB. |
CVE-2022-40602 | Critical | 9.8 | 2022-11-22 | A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured… |
CVE-2022-36227 | Critical | 9.8 | 2022-11-22 | In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, w… |
CVE-2022-35407 | High | 7.8 | 2022-11-22 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow leads to arbitrary code execution in the SetupUtility driver o… |
CVE-2022-43685 | High | 8.8 | 2022-11-22 | CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an exi… |
CVE-2022-43215 | Critical | 9.8 | 2022-11-22 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php. |
CVE-2022-43214 | Critical | 9.8 | 2022-11-22 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php. |
CVE-2022-41940 | High | 7.1 | 2022-11-22 | Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP reques… |
CVE-2022-41937 | Critical | 9.6 | 2022-11-22 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modi… |
CVE-2022-41936 | Medium | 5.3 | 2022-11-22 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out… |
CVE-2022-41326 | Critical | 9.8 | 2022-11-22 | The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authoriza… |
CVE-2022-41223 | Medium | 6.8 | 2022-11-22 | The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via cra… |
CVE-2022-40842 | Critical | 9.1 | 2022-11-22 | ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php. |
CVE-2022-40765 | Medium | 6.8 | 2022-11-22 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network… |
CVE-2022-36180 | Critical | 9.6 | 2022-11-22 | Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidp… |
CVE-2022-36179 | Critical | 9.8 | 2022-11-22 | Fusiondirectory 1.3 suffers from Improper Session Handling. |
CVE-2022-30529 | High | 7.2 | 2022-11-22 | File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/… |
CVE-2022-43709 | Medium | 4.9 | 2022-11-22 | MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input… |
CVE-2022-43708 | Medium | 6.1 | 2022-11-22 | MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the… |
CVE-2022-43707 | Medium | 6.1 | 2022-11-22 | MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stor… |
CVE-2022-44788 | Medium | 6.5 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESSIONID cookie that is issued by the serv… |
CVE-2022-44787 | Medium | 6.1 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. The web applications are vulnerable to a Reflected Cross-Site Scripting issue. The idPagina parameter is… |
CVE-2022-44786 | High | 7.5 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to spec… |
CVE-2022-44785 | Critical | 9.8 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executa… |
CVE-2022-44784 | High | 8.8 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the Axis 1.4 instance, em… |
CVE-2022-41945 | Medium | 6.5 | 2022-11-21 | super-xray is a vulnerability scanner (xray) GUI launcher. In version 0.1-beta, the URL is not filtered and directly spliced into the command, resulting in a… |
CVE-2022-30258 | Critical | 9.8 | 2022-11-21 | An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be… |
CVE-2022-30257 | Critical | 9.8 | 2022-11-21 | An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be… |
CVE-2022-43143 | Critical | 9.6 | 2022-11-21 | A cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2022-42096 | Medium | 4.8 | 2022-11-21 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content. |
CVE-2022-4105 | Medium | 5.4 | 2022-11-21 | A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) an… |
CVE-2022-3388 | High | 8.8 | 2022-11-21 | An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An authenticated user can launch an administra… |
CVE-2022-44830 | High | 7.8 | 2022-11-21 | Sourcecodester Event Registration App v1.0 was discovered to contain multiple CSV injection vulnerabilities via the First Name, Contact and Remarks fields. The… |
CVE-2022-44183 | Critical | 9.8 | 2022-11-21 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic. |
CVE-2022-44180 | Critical | 9.8 | 2022-11-21 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter. |
CVE-2022-44178 | Critical | 9.8 | 2022-11-21 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow. via function formWifiWpsOOB. |
CVE-2022-44177 | Critical | 9.8 | 2022-11-21 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart. |
CVE-2022-44176 | Critical | 9.8 | 2022-11-21 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function fromSetRouteStatic. |
CVE-2022-44175 | Critical | 9.8 | 2022-11-21 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetMacFilterCfg. |
CVE-2022-44174 | Critical | 9.8 | 2022-11-21 | Tenda AC18 V15.03.05.05 is vulnerable to Buffer Overflow via function formSetDeviceName. |
CVE-2022-44172 | Critical | 9.8 | 2022-11-21 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler. |
CVE-2022-44171 | Critical | 9.8 | 2022-11-21 | Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set. |
CVE-2022-43117 | Medium | 5.4 | 2022-11-21 | Sourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Name… |
CVE-2022-40746 | High | 7.2 | 2022-11-21 | IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused… |
CVE-2022-45422 | High | 7.8 | 2022-11-21 | When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005. |
CVE-2022-38755 | Medium | 5.3 | 2022-11-21 | A vulnerability has been identified in Micro Focus Filr in versions prior to 4.3.1.1. The vulnerability could be exploited to allow a remote unauthenticated at… |
CVE-2022-35897 | Medium | 6.8 | 2022-11-21 | An stack buffer overflow vulnerability leads to arbitrary code execution issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. If the attacker… |
CVE-2022-45470 | High | 7.5 | 2022-11-21 | missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issue… |
CVE-2022-44163 | High | 7.5 | 2022-11-21 | Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg. |
CVE-2022-44158 | High | 7.5 | 2022-11-21 | Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name. |
CVE-2022-44156 | High | 7.5 | 2022-11-21 | Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind. |
CVE-2022-40470 | Medium | 4.8 | 2022-11-21 | Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature. |