2022 CVEs (page 97)
Page 97 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20947 | High | 8.6 | 2022-11-15 | A vulnerability in dynamic access policies (DAP) functionality of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software… |
CVE-2022-20946 | High | 8.6 | 2022-11-15 | A vulnerability in the generic routing encapsulation (GRE) tunnel decapsulation feature of Cisco Firepower Threat Defense (FTD) Software could allow an unauthe… |
CVE-2022-20943 | Medium | 5.8 | 2022-11-15 | Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products could allow an unauthe… |
CVE-2022-20941 | Medium | 5.3 | 2022-11-15 | A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to ac… |
CVE-2022-20940 | Medium | 5.3 | 2022-11-15 | A vulnerability in the TLS handler of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to gain access to sensitive… |
CVE-2022-20938 | Medium | 4.3 | 2022-11-15 | A vulnerability in the module import function of the administrative interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated… |
CVE-2022-20936 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20935 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20934 | Medium | 6.0 | 2022-11-15 | A vulnerability in the CLI of Cisco Firepower Threat Defense (FTD) Software and Cisco FXOS Software could allow an authenticated, local attacker to execute arb… |
CVE-2022-20932 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20928 | Medium | 5.8 | 2022-11-15 | A vulnerability in the authentication and authorization flows for VPN connections in Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defe… |
CVE-2022-20927 | High | 7.7 | 2022-11-15 | A vulnerability in the SSL/TLS client of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an auth… |
CVE-2022-20926 | Medium | 6.3 | 2022-11-15 | A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execut… |
CVE-2022-20925 | Medium | 6.3 | 2022-11-15 | A vulnerability in the web management interface of the Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to execut… |
CVE-2022-20924 | High | 7.7 | 2022-11-15 | A vulnerability in the Simple Network Management Protocol (SNMP) feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense… |
CVE-2022-20922 | Medium | 5.8 | 2022-11-15 | Multiple vulnerabilities in the Server Message Block Version 2 (SMB2) processor of the Snort detection engine on multiple Cisco products could allow an unauthe… |
CVE-2022-20918 | High | 7.5 | 2022-11-15 | A vulnerability in the Simple Network Management Protocol (SNMP) access controls for Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER m… |
CVE-2022-20905 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20872 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20854 | High | 7.5 | 2022-11-15 | A vulnerability in the processing of SSH connections of Cisco Firepower Management Center (FMC) and Cisco Firepower Threat Defense (FTD) Software could allow a… |
CVE-2022-20843 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20840 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20839 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20838 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20836 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20835 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20834 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20833 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20832 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20831 | Medium | 4.8 | 2022-11-15 | Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacke… |
CVE-2022-20826 | Medium | 6.4 | 2022-11-15 | A vulnerability in the secure boot implementation of Cisco Secure Firewalls 3100 Series that are running Cisco Adaptive Security Appliance (ASA) Software or Ci… |
CVE-2022-45401 | Medium | 5.4 | 2022-11-15 | Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS) vulnerability exp… |
CVE-2022-45400 | Critical | 9.8 | 2022-11-15 | Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45399 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics. |
CVE-2022-45398 | Medium | 4.3 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster St… |
CVE-2022-45397 | Critical | 9.8 | 2022-11-15 | Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45396 | Critical | 9.8 | 2022-11-15 | Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45395 | Critical | 9.8 | 2022-11-15 | Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45394 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs. |
CVE-2022-45393 | Low | 3.5 | 2022-11-15 | A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs. |
CVE-2022-45392 | Medium | 6.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller whe… |
CVE-2022-45391 | High | 7.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation… |
CVE-2022-45390 | Medium | 4.3 | 2022-11-15 | A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credenti… |
CVE-2022-45389 | Medium | 5.3 | 2022-11-15 | A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-spe… |
CVE-2022-45388 | High | 7.5 | 2022-11-15 | Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read a… |
CVE-2022-45387 | Medium | 5.4 | 2022-11-15 | Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site… |
CVE-2022-45386 | Medium | 5.5 | 2022-11-15 | Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. |
CVE-2022-45385 | High | 7.5 | 2022-11-15 | A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of… |
CVE-2022-45384 | Medium | 6.5 | 2022-11-15 | Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where… |
CVE-2022-45383 | Medium | 6.5 | 2022-11-15 | An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to downlo… |
CVE-2022-45382 | Medium | 5.4 | 2022-11-15 | Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, resulting in a store… |
CVE-2022-45381 | High | 8.1 | 2022-11-15 | Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Confi… |
CVE-2022-45380 | Medium | 5.4 | 2022-11-15 | Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored… |
CVE-2022-45379 | High | 7.5 | 2022-11-15 | Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collisi… |
CVE-2022-38666 | High | 7.5 | 2022-11-15 | Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several f… |
CVE-2022-27895 | Medium | 4.2 | 2022-11-15 | Information Exposure Through Log Files vulnerability discovered in Foundry when logs were captured using an underlying library known as Build2. This issue was… |
CVE-2022-41558 | Critical | 9.0 | 2022-11-15 | The Visualizations component of TIBCO Software Inc.'s TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analyst, TIBCO Spotfire Analytics Platform… |
CVE-2022-43071 | Medium | 5.5 | 2022-11-15 | A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. |
CVE-2022-3998 | Medium | 6.3 | 2022-11-15 | A vulnerability, which was classified as critical, was found in MonikaBrzica scm. This affects an unknown part of the file uredi_korisnika.php. The manipulatio… |
CVE-2022-3997 | Medium | 6.3 | 2022-11-15 | A vulnerability, which was classified as critical, has been found in MonikaBrzica scm. Affected by this issue is some unknown functionality of the file upis_u_… |
CVE-2022-42001 | Low | 3.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceBookshelf extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary… |
CVE-2022-42000 | Low | 3.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceSocialProfile extension of BlueSpice allows user with comment permissions to inject arbitrary HTML into th… |
CVE-2022-41814 | Low | 3.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceFoundation extension of BlueSpice allows user with regular account and edit permissions to inject arbitrar… |
CVE-2022-41789 | Low | 3.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows logged in user with edit permissions to inject arbitrary HTML into the… |
CVE-2022-41611 | Low | 2.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceDiscovery skin of BlueSpice allows user with admin privileges to inject arbitrary HTML into the main navig… |
CVE-2022-3958 | Low | 3.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitra… |
CVE-2022-3895 | Medium | 4.0 | 2022-11-15 | Some UI elements of the Common User Interface Component are not properly sanitizing output and therefore prone to output arbitrary HTML (XSS). |
CVE-2022-3893 | Low | 2.3 | 2022-11-15 | Cross-site Scripting (XSS) vulnerability in BlueSpiceCustomMenu extension of BlueSpice allows user with admin permissions to inject arbitrary HTML into the cus… |
CVE-2022-3240 | High | 8.8 | 2022-11-15 | The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce v… |
CVE-2022-40309 | Medium | 4.3 | 2022-11-15 | Users with write permissions to a repository can delete arbitrary directories. |
CVE-2022-40308 | High | 7.5 | 2022-11-15 | If anonymous read enabled, it's possible to read the database file directly without logging in. |
CVE-2022-3737 | High | 7.8 | 2022-11-15 | In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 memory can be read beyond the intended scope due to insufficient validation of input data… |
CVE-2022-3480 | High | 7.5 | 2022-11-15 | A remote, unauthenticated attacker could cause a denial-of-service of PHOENIX CONTACT FL MGUARD and TC MGUARD devices below version 8.9.0 by sending a larger n… |
CVE-2022-3461 | High | 7.8 | 2022-11-15 | In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could lead to a heap buffer overflow and a read access… |
CVE-2022-33239 | High | 7.5 | 2022-11-15 | Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snapdragon Auto, Snapdragon Compute, Snapdra… |
CVE-2022-33237 | High | 7.5 | 2022-11-15 | Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra… |
CVE-2022-33236 | High | 7.5 | 2022-11-15 | Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon M… |
CVE-2022-33234 | High | 7.3 | 2022-11-15 | Memory corruption in video due to configuration weakness. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon… |
CVE-2022-25743 | High | 8.4 | 2022-11-15 | Memory corruption in graphics due to use-after-free while importing graphics buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon… |
CVE-2022-25742 | High | 7.5 | 2022-11-15 | Denial of service in modem due to infinite loop while parsing IGMPv2 packet from server in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice… |
CVE-2022-25741 | High | 7.5 | 2022-11-15 | Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn… |
CVE-2022-25727 | Critical | 9.8 | 2022-11-15 | Memory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Mus… |
CVE-2022-25724 | High | 8.4 | 2022-11-15 | Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra… |
CVE-2022-25710 | High | 7.5 | 2022-11-15 | Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon… |
CVE-2022-25679 | Medium | 6.2 | 2022-11-15 | Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Sna… |
CVE-2022-25676 | Medium | 6.8 | 2022-11-15 | Information disclosure in video due to buffer over-read while parsing avi files in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Ind… |
CVE-2022-25674 | Medium | 6.5 | 2022-11-15 | Cryptographic issues in WLAN during the group key handshake of the WPA/WPA2 protocol in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice &… |
CVE-2022-25671 | High | 7.5 | 2022-11-15 | Denial of service in MODEM due to reachable assertion in Snapdragon Mobile |
CVE-2022-25667 | High | 7.5 | 2022-11-15 | Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and Networking |
CVE-2022-45402 | Medium | 6.1 | 2022-11-15 | In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. |
CVE-2022-42060 | High | 7.5 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setWanPpoe function. This vulnerability allows attackers… |
CVE-2022-42058 | Critical | 9.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setRemoteWebManage function. This vulnerability allows at… |
CVE-2022-42053 | High | 7.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the PortMappingServer parameter in the setPo… |
CVE-2022-41396 | High | 7.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain multiple command injection vulnerabilities in the function setIPsecTunnelList via… |
CVE-2022-41395 | High | 7.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the dmzHost parameter in the setDMZ function. |
CVE-2022-40846 | Medium | 4.8 | 2022-11-15 | In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) vulnerability exists allowing an attacker to execute JavaScript code… |
CVE-2022-40844 | Medium | 5.4 | 2022-11-15 | In Tenda (Shenzhen Tenda Technology Co., Ltd) AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) issue exists allowing an attack… |
CVE-2022-42132 | Medium | 5.9 | 2022-11-15 | The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix… |
CVE-2022-42131 | Medium | 4.8 | 2022-11-15 | Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Por… |
CVE-2022-42130 | Medium | 4.3 | 2022-11-15 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, a… |