2022 CVEs (page 93)
Page 93 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37772 | High | 7.5 | 2022-11-23 | Maarch RM 2.8.3 solution contains an improper restriction of excessive authentication attempts due to excessive verbose responses from the application. An unau… |
CVE-2022-37430 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/framework through 4.11 allows XSS vulnerability via href attribute of a link (issue 2 of 2). |
CVE-2022-37429 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 2) via JavaScript payload to the href attribute of a link by splitting a javascript URL… |
CVE-2022-35500 | Medium | 5.4 | 2022-11-23 | Amasty Blog 2.10.3 is vulnerable to Cross Site Scripting (XSS) via leave comment functionality. |
CVE-2022-43751 | High | 7.8 | 2022-11-23 | McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirec… |
CVE-2022-40870 | High | 8.1 | 2022-11-23 | The Web Client of Parallels Remote Application Server v18.0 is vulnerable to Host Header Injection attacks. This vulnerability allows attackers to execute arbi… |
CVE-2022-40303 | High | 7.5 | 2022-11-23 | An issue was discovered in libxml2 before 2.10.3. When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer cou… |
CVE-2022-38724 | Medium | 5.4 | 2022-11-23 | Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS. |
CVE-2022-37774 | Medium | 5.3 | 2022-11-23 | There is a broken access control vulnerability in the Maarch RM 2.8.3 solution. When accessing some specific document (pdf, email) from an archive, a preview i… |
CVE-2022-37773 | Medium | 6.5 | 2022-11-23 | An authenticated SQL Injection vulnerability in the statistics page (/statistics/retrieve) of Maarch RM 2.8, via the filter parameter, allows the complete disc… |
CVE-2022-45536 | Medium | 4.9 | 2022-11-22 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the id parameter at \admin\post_comments.php. This vulnerability allows attackers to… |
CVE-2022-45535 | Medium | 4.9 | 2022-11-22 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the edit parameter at \admin\categories.php. This vulnerability allows attackers to… |
CVE-2022-45529 | Medium | 4.9 | 2022-11-22 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the post_category_id parameter at \admin\includes\edit_post.php. This vulnerability… |
CVE-2022-45331 | High | 7.5 | 2022-11-22 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the p_id parameter at \post.php. This vulnerability allows attackers to access datab… |
CVE-2022-45330 | High | 7.5 | 2022-11-22 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Category parameter at \category.php. This vulnerability allows attackers to acce… |
CVE-2022-39397 | Medium | 5.6 | 2022-11-22 | aliyun-oss-client is a rust client for Alibaba Cloud OSS. Users of this library will be affected, the incoming secret will be disclosed unintentionally. This i… |
CVE-2022-41919 | Medium | 4.2 | 2022-11-22 | Fastify is a web framework with minimal overhead and plugin architecture. The attacker can use the incorrect `Content-Type` to bypass the `Pre-Flight` checking… |
CVE-2022-39199 | Medium | 5.8 | 2022-11-22 | immudb is a database with built-in cryptographic proof and verification. immudb client SDKs use server's UUID to distinguish between different server instance… |
CVE-2022-2791 | Medium | 5.9 | 2022-11-22 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-434 Unrestricted Upload of File with Dangerous Type, and will upload any… |
CVE-2022-4116 | Critical | 9.8 | 2022-11-22 | A vulnerability was found in quarkus. This security flaw happens in Dev UI Config Editor which is vulnerable to drive-by localhost attacks leading to remote co… |
CVE-2022-41943 | Critical | 9.0 | 2022-11-22 | sourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `customGitFetch`… |
CVE-2022-41942 | High | 7.9 | 2022-11-22 | Sourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present in all Sour… |
CVE-2022-40228 | Low | 3.7 | 2022-11-22 | IBM DataPower Gateway 10.0.3.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.9, 2018.4.1.0 through 2018.4.1.22, and 10.5.0.0 through 10.5.0.2 does not invalidat… |
CVE-2022-3500 | Medium | 5.1 | 2022-11-22 | A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibilit… |
CVE-2022-43212 | Critical | 9.8 | 2022-11-22 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php. |
CVE-2022-41950 | Medium | 6.4 | 2022-11-22 | super-xray is the GUI alternative for vulnerability scanning tool xray. In 0.2-beta, a privilege escalation vulnerability was discovered. This caused inaccurat… |
CVE-2022-39070 | Critical | 9.8 | 2022-11-22 | There is an access control vulnerability in some ZTE PON OLT products. Due to improper access control settings, remote attackers could use the vulnerability to… |
CVE-2022-39067 | Medium | 6.5 | 2022-11-22 | There is a buffer overflow vulnerability in ZTE MF286R. Due to lack of input validation on parameters of the wifi interface, an authenticated attacker could us… |
CVE-2022-39066 | High | 8.8 | 2022-11-22 | There is a SQL injection vulnerability in ZTE MF286R. Due to insufficient validation of the input parameters of the phonebook interface, an authenticated attac… |
CVE-2022-44737 | Medium | 6.5 | 2022-11-22 | Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress. |
CVE-2022-41952 | Medium | 6.5 | 2022-11-22 | Synapse before 1.52.0 with URL preview functionality enabled will attempt to generate URL previews for media stream URLs without properly limiting connection t… |
CVE-2022-44808 | Critical | 9.8 | 2022-11-22 | A command injection vulnerability has been found on D-Link DIR-823G devices with firmware version 1.02B03 that allows an attacker to execute arbitrary operatin… |
CVE-2022-44807 | Critical | 9.8 | 2022-11-22 | D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow via webGetVarString. |
CVE-2022-44806 | Critical | 9.8 | 2022-11-22 | D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow. |
CVE-2022-44804 | Critical | 9.8 | 2022-11-22 | D-Link DIR-882 1.10B02 and1.20B06 is vulnerable to Buffer Overflow via the websRedirect function. |
CVE-2022-44801 | Critical | 9.8 | 2022-11-22 | D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control. |
CVE-2022-44202 | Critical | 9.8 | 2022-11-22 | D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow. |
CVE-2022-44201 | Critical | 9.8 | 2022-11-22 | D-Link DIR823G 1.02B05 is vulnerable to Commad Injection. |
CVE-2022-44184 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_sec. |
CVE-2022-44200 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8, V1.3.1.64 is vulnerable to Buffer Overflow via parameters: stamode_dns1_pri and stamode_dns1_sec. |
CVE-2022-44199 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_server_ip. |
CVE-2022-44198 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_push1. |
CVE-2022-44197 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_server_ip. |
CVE-2022-44196 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_push1. |
CVE-2022-44194 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode_dns1_pri and apmode_dns1_sec. |
CVE-2022-44193 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameters: starthour, startminute , endhour, and endminute. |
CVE-2022-44191 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameters KEY1 and KEY2. |
CVE-2022-44190 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable_band_steering. |
CVE-2022-44188 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter enable_band_steering. |
CVE-2022-44187 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via wan_dns1_pri. |
CVE-2022-44186 | Critical | 9.8 | 2022-11-22 | Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_pri. |
CVE-2022-42989 | Critical | 9.0 | 2022-11-22 | ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada. |
CVE-2022-41445 | Medium | 4.8 | 2022-11-22 | A cross-site scripting (XSS) vulnerability in Record Management System using CodeIgniter 1.0 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2022-33012 | High | 8.8 | 2022-11-22 | Microweber v1.2.15 was discovered to allow attackers to perform an account takeover via a host header injection attack. |
CVE-2022-42098 | High | 8.8 | 2022-11-22 | KLiK SocialMediaWebsite version v1.0.1 is vulnerable to SQL Injection via the profile.php. |
CVE-2022-42097 | Medium | 4.8 | 2022-11-22 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via 'Comment.' . |
CVE-2022-42094 | Medium | 4.8 | 2022-11-22 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the 'Card' content. |
CVE-2022-3910 | High | 7.8 | 2022-11-22 | Use After Free vulnerability in Linux Kernel allows Privilege Escalation. An improper Update of Reference Count in io_uring leads to Use-After-Free and Local P… |
CVE-2022-38462 | Medium | 6.1 | 2022-11-22 | Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request. |
CVE-2022-0222 | High | 7.5 | 2022-11-22 | A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending… |
CVE-2022-37301 | High | 7.5 | 2022-11-22 | A CWE-191: Integer Underflow (Wrap or Wraparound) vulnerability exists that could cause a denial of service of the controller due to memory access violations w… |
CVE-2022-2513 | High | 7.1 | 2022-11-22 | A vulnerability exists in the Intelligent Electronic Device (IED) Connectivity Package (ConnPack) credential storage function in Hitachi Energy’s PCM600 produc… |
CVE-2022-41131 | High | 7.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Hive Provider, Apache Airflow allows… |
CVE-2022-40954 | Medium | 5.5 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Spark Provider, Apache Airflow allow… |
CVE-2022-40189 | Critical | 9.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pig Provider, Apache Airflow allows… |
CVE-2022-38649 | Critical | 9.8 | 2022-11-22 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allow… |
CVE-2022-45363 | Medium | 5.4 | 2022-11-22 | Auth. (subscriber+) Stored Cross-Site Scripting (XSS) in Muffingroup Betheme theme <= 26.6.1 on WordPress. |
CVE-2022-37931 | High | 7.3 | 2022-11-22 | A vulnerability in NetBatch-Plus software allows unauthorized access to the application. HPE has provided a workaround and fix. Please refer to HPE Security… |
CVE-2022-4111 | Medium | 6.5 | 2022-11-22 | Unrestricted file size limit can lead to DoS in tooljet/tooljet <1.27 by allowing a logged in attacker to upload profile pictures over 2MB. |
CVE-2022-40602 | Critical | 9.8 | 2022-11-22 | A flaw in the Zyxel LTE3301-M209 firmware verisons prior to V1.00(ABLG.6)C0 could allow a remote attacker to access the device using an improper pre-configured… |
CVE-2022-36227 | Critical | 9.8 | 2022-11-22 | In libarchive before 3.6.2, the software does not check for an error after calling calloc function that can return with a NULL pointer if the function fails, w… |
CVE-2022-35407 | High | 7.8 | 2022-11-22 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow leads to arbitrary code execution in the SetupUtility driver o… |
CVE-2022-43685 | High | 8.8 | 2022-11-22 | CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an exi… |
CVE-2022-43215 | Critical | 9.8 | 2022-11-22 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php. |
CVE-2022-43214 | Critical | 9.8 | 2022-11-22 | Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php. |
CVE-2022-41940 | High | 7.1 | 2022-11-22 | Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP reques… |
CVE-2022-41937 | Critical | 9.6 | 2022-11-22 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modi… |
CVE-2022-41936 | Medium | 5.3 | 2022-11-22 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out… |
CVE-2022-41326 | Critical | 9.8 | 2022-11-22 | The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authoriza… |
CVE-2022-41223 | Medium | 6.8 | 2022-11-22 | The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via cra… |
CVE-2022-40842 | Critical | 9.1 | 2022-11-22 | ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Server-side request forgery (SSRF) via rotateimg.php. |
CVE-2022-40765 | Medium | 6.8 | 2022-11-22 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network… |
CVE-2022-36180 | Critical | 9.6 | 2022-11-22 | Fusiondirectory 1.3 is vulnerable to Cross Site Scripting (XSS) via /fusiondirectory/index.php?message=[injection], /fusiondirectory/index.php?message=invalidp… |
CVE-2022-36179 | Critical | 9.8 | 2022-11-22 | Fusiondirectory 1.3 suffers from Improper Session Handling. |
CVE-2022-30529 | High | 7.2 | 2022-11-22 | File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/… |
CVE-2022-43709 | Medium | 4.9 | 2022-11-22 | MyBB 1.8.31 has a SQL injection vulnerability in the Admin CP's Users module allows remote authenticated users to modify the query string via direct user input… |
CVE-2022-43708 | Medium | 6.1 | 2022-11-22 | MyBB 1.8.31 has a (issue 2 of 2) cross-site scripting (XSS) vulnerabilities in the post Attachments interface allow attackers to inject HTML by persuading the… |
CVE-2022-43707 | Medium | 6.1 | 2022-11-22 | MyBB 1.8.31 has a Cross-site scripting (XSS) vulnerability in the visual MyCode editor (SCEditor) allows remote attackers to inject HTML via user input or stor… |
CVE-2022-44788 | Medium | 6.5 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. It allows Session Fixation. When a user logs in providing a JSESSIONID cookie that is issued by the serv… |
CVE-2022-44787 | Medium | 6.1 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. The web applications are vulnerable to a Reflected Cross-Site Scripting issue. The idPagina parameter is… |
CVE-2022-44786 | High | 7.5 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to spec… |
CVE-2022-44785 | Critical | 9.8 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executa… |
CVE-2022-44784 | High | 8.8 | 2022-11-21 | An issue was discovered in Appalti & Contratti 9.12.2. The target web applications LFS and DL229 expose a set of services provided by the Axis 1.4 instance, em… |
CVE-2022-41945 | Medium | 6.5 | 2022-11-21 | super-xray is a vulnerability scanner (xray) GUI launcher. In version 0.1-beta, the URL is not filtered and directly spliced into the command, resulting in a… |
CVE-2022-30258 | Critical | 9.8 | 2022-11-21 | An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V2 of unintended domain name resolution. A revoked domain name can still be… |
CVE-2022-30257 | Critical | 9.8 | 2022-11-21 | An issue was discovered in Technitium DNS Server through 8.0.2 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be… |
CVE-2022-43143 | Critical | 9.6 | 2022-11-21 | A cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2022-42096 | Medium | 4.8 | 2022-11-21 | Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via Post content. |
CVE-2022-4105 | Medium | 5.4 | 2022-11-21 | A stored XSS in a kiwi Test Plan can run malicious javascript which could be chained with an HTML injection to perform a UI redressing attack (clickjacking) an… |
CVE-2022-3388 | High | 8.8 | 2022-11-21 | An input validation vulnerability exists in the Monitor Pro interface of MicroSCADA Pro and MicroSCADA X SYS600. An authenticated user can launch an administra… |