2022 CVEs (page 96)
Page 96 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43162 | High | 7.2 | 2022-11-17 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/view_test.php. |
CVE-2022-43142 | Medium | 6.1 | 2022-11-17 | A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2022-44403 | High | 7.2 | 2022-11-17 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=user/manage_user&id=. |
CVE-2022-44402 | High | 7.2 | 2022-11-17 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_transaction. |
CVE-2022-41920 | Medium | 6.3 | 2022-11-17 | Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip… |
CVE-2022-4053 | Low | 2.4 | 2022-11-17 | A vulnerability was found in Student Attendance Management System. It has been classified as problematic. Affected is an unknown function of the file createCla… |
CVE-2022-4052 | Medium | 4.7 | 2022-11-17 | A vulnerability was found in Student Attendance Management System and classified as critical. This issue affects some unknown processing of the file /Admin/cre… |
CVE-2022-4051 | Medium | 6.3 | 2022-11-17 | A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file view-property.php. T… |
CVE-2022-44384 | High | 8.8 | 2022-11-17 | An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-43140 | High | 7.5 | 2022-11-17 | kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile… |
CVE-2022-43138 | Critical | 9.8 | 2022-11-17 | Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. |
CVE-2022-42894 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). An unauthenticated Server-Side Request Forgery (SSRF) vulnerability was iden… |
CVE-2022-42893 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42892 | Medium | 5.3 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42891 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42734 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42733 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42732 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-40751 | Medium | 4.9 | 2022-11-17 | IBM UrbanCode Deploy (UCD) 6.2.7.0 through 6.2.7.17, 7.0.0.0 through 7.0.5.12, 7.1.0.0 through 7.1.2.8, and 7.2.0.0 through 7.2.3.1 could allow a user with ad… |
CVE-2022-38390 | Medium | 5.4 | 2022-11-17 | Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2022-45461 | High | 7.5 | 2022-11-17 | The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been exp… |
CVE-2022-42985 | Medium | 4.8 | 2022-11-17 | The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform… |
CVE-2022-42982 | High | 7.5 | 2022-11-17 | BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (te… |
CVE-2022-42954 | Medium | 5.4 | 2022-11-17 | Keyfactor EJBCA before 7.10.0 allows XSS. |
CVE-2022-39834 | Medium | 5.4 | 2022-11-17 | A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in orde… |
CVE-2022-36432 | Medium | 5.4 | 2022-11-17 | The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks… |
CVE-2022-42246 | High | 8.8 | 2022-11-17 | Doufox 0.0.4 contains a CSRF vulnerability that can add system administrator account. |
CVE-2022-42245 | Critical | 9.8 | 2022-11-17 | Dreamer CMS 4.0.01 is vulnerable to SQL Injection. |
CVE-2022-42187 | Medium | 6.1 | 2022-11-17 | Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php. |
CVE-2022-40881 | Critical | 9.8 | 2022-11-17 | SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php |
CVE-2022-43782 | Critical | 9.8 | 2022-11-17 | Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call pr… |
CVE-2022-43781 | Critical | 9.8 | 2022-11-17 | There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their userna… |
CVE-2022-42960 | Medium | 5.4 | 2022-11-17 | EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of mes… |
CVE-2022-44006 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation or sanitization of upload filenames, an externally reachable, unauthentica… |
CVE-2022-44005 | Medium | 5.3 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to the use of consecutive IDs in verification links, the newsletter sign-up functionality is vuln… |
CVE-2022-44004 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password… |
CVE-2022-44003 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient escaping of user-supplied input, the application is vulnerable to SQL injection a… |
CVE-2022-44002 | Medium | 6.1 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient output encoding of user-supplied data, the web application is vulnerable to cross… |
CVE-2022-44000 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system comma… |
CVE-2022-40752 | Critical | 9.8 | 2022-11-16 | IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements. IBM X-Force ID: 236687. |
CVE-2022-44008 | Medium | 6.5 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation, arbitrary local files can be retrieved by accessing the back-end Tomcat s… |
CVE-2022-44007 | High | 8.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users in… |
CVE-2022-43999 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to exposed CORBA management services, arbitrary system commands can be executed on the server. |
CVE-2022-39319 | Medium | 4.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A mali… |
CVE-2022-39318 | Medium | 4.8 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious serve… |
CVE-2022-39317 | Medium | 4.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A… |
CVE-2022-43135 | Critical | 9.8 | 2022-11-16 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnostic/login.php. |
CVE-2022-41914 | Low | 3.7 | 2022-11-16 | Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Ser… |
CVE-2022-41877 | Medium | 4.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A malicious… |
CVE-2022-39383 | Medium | 4.9 | 2022-11-16 | KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as th… |
CVE-2022-39347 | Low | 2.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` c… |
CVE-2022-39320 | Medium | 5.5 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocatio… |
CVE-2022-39316 | Medium | 4.8 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malic… |
CVE-2022-34354 | Medium | 4.0 | 2022-11-16 | IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM… |
CVE-2022-44073 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts. |
CVE-2022-44071 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile. |
CVE-2022-44070 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles. |
CVE-2022-44069 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module. |
CVE-2022-43264 | High | 7.5 | 2022-11-16 | Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download arbitrary files via a crafted web reque… |
CVE-2022-43263 | Medium | 6.1 | 2022-11-16 | A cross-site scripting (XSS) vulnerability in Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to execute arbitrary web scripts or H… |
CVE-2022-43262 | Critical | 9.8 | 2022-11-16 | Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /hrm/controller/login.php. |
CVE-2022-43256 | Critical | 9.8 | 2022-11-16 | SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php. |
CVE-2022-43234 | Critical | 9.8 | 2022-11-16 | An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-4022 | Medium | 6.4 | 2022-11-16 | The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are not sanitized. While… |
CVE-2022-4021 | High | 8.8 | 2022-11-16 | The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This is due to missing… |
CVE-2022-4018 | Medium | 4.3 | 2022-11-16 | Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6. |
CVE-2022-3980 | Critical | 9.8 | 2022-11-16 | An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between… |
CVE-2022-24036 | High | 8.6 | 2022-11-16 | Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs. |
CVE-2022-45047 | Critical | 9.8 | 2022-11-16 | Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.securi… |
CVE-2022-4015 | Medium | 4.7 | 2022-11-16 | A vulnerability, which was classified as critical, was found in Sports Club Management System 119. This affects an unknown part of the file admin/make_payments… |
CVE-2022-4014 | Medium | 4.3 | 2022-11-16 | A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My… |
CVE-2022-4013 | Medium | 4.3 | 2022-11-16 | A vulnerability classified as problematic was found in Hospital Management Center. Affected by this vulnerability is an unknown functionality of the file appoi… |
CVE-2022-4012 | Medium | 6.3 | 2022-11-16 | A vulnerability classified as critical has been found in Hospital Management Center. Affected is an unknown function of the file patient-info.php. The manipula… |
CVE-2022-4011 | Medium | 6.5 | 2022-11-16 | A vulnerability was found in Simple History Plugin. It has been rated as critical. This issue affects some unknown processing of the component Header Handler… |
CVE-2022-2166 | Critical | 9.8 | 2022-11-16 | Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0. |
CVE-2022-41917 | Medium | 4.3 | 2022-11-16 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to… |
CVE-2022-3920 | Medium | 5.3 | 2022-11-16 | HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the… |
CVE-2022-41918 | Medium | 6.3 | 2022-11-15 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules… |
CVE-2022-41916 | Medium | 5.9 | 2022-11-15 | Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI cer… |
CVE-2022-4006 | Low | 3.7 | 2022-11-15 | A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/fra… |
CVE-2022-30769 | Medium | 4.6 | 2022-11-15 | Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user. |
CVE-2022-30768 | Medium | 5.4 | 2022-11-15 | A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or… |
CVE-2022-29279 | High | 8.2 | 2022-11-15 | Use of a untrusted pointer allows tampering with SMRAM and OS memory in SdHostDriver and SdMmcDevice Use of a untrusted pointer allows tampering with SMRAM and… |
CVE-2022-29278 | High | 8.2 | 2022-11-15 | Incorrect pointer checks within the NvmExpressDxe driver can allow tampering with SMRAM and OS memory Incorrect pointer checks within the NvmExpressDxe driver… |
CVE-2022-29277 | High | 8.8 | 2022-11-15 | Incorrect pointer checks within the the FwBlockServiceSmm driver can allow arbitrary RAM modifications During review of the FwBlockServiceSmm driver, certain i… |
CVE-2022-29276 | High | 8.2 | 2022-11-15 | SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRAM. SMI functions in AhciBusDxe use untrusted inputs leading to corruption of SMRA… |
CVE-2022-43279 | High | 7.2 | 2022-11-15 | LimeSurvey before v5.0.4 was discovered to contain a SQL injection vulnerability via the component /application/views/themeOptions/update.php. |
CVE-2022-43265 | Critical | 9.8 | 2022-11-15 | An arbitrary file upload vulnerability in the component /pages/save_user.php of Canteen Management System v1.0 allows attackers to execute arbitrary code via a… |
CVE-2022-42785 | Critical | 9.8 | 2022-11-15 | Multiple W&T products of the ComServer Series are prone to an authentication bypass. An unathenticated remote attacker, can log in without knowledge of the pas… |
CVE-2022-40753 | Medium | 5.4 | 2022-11-15 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-3377 | High | 7.8 | 2022-11-15 | Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an at… |
CVE-2022-38385 | High | 7.1 | 2022-11-15 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow an authenticated user to obtain highly sensitive information or perform unauthorized a… |
CVE-2022-38201 | Medium | 6.1 | 2022-11-15 | An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker… |
CVE-2022-30772 | High | 8.2 | 2022-11-15 | Manipulation of the input address in PnpSmm function 0x52 could be used by malware to overwrite SMRAM or OS kernel memory. Function 0x52 of the PnpSmm driver i… |
CVE-2022-30771 | High | 8.2 | 2022-11-15 | Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm could lead to SMRAM… |
CVE-2022-30283 | High | 7.5 | 2022-11-15 | In UsbCoreDxe, tampering with the contents of the USB working buffer using DMA while certain USB transactions are in process leads to a TOCTOU problem that cou… |
CVE-2022-29275 | High | 8.2 | 2022-11-15 | In UsbCoreDxe, untrusted input may allow SMRAM or OS memory tampering Use of untrusted pointers could allow OS or SMRAM memory tampering leading to escalation… |
CVE-2022-24942 | Critical | 9.1 | 2022-11-15 | Heap based buffer overflow in HTTP Server functionality in Micrium uC-HTTP 3.01.01 allows remote code execution via HTTP request. |
CVE-2022-20950 | Medium | 5.8 | 2022-11-15 | A vulnerability in the interaction of SIP and Snort 3 for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to caus… |
CVE-2022-20949 | Medium | 6.5 | 2022-11-15 | A vulnerability in the management web server of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, remote attacker with high privilege… |