2022 CVEs (page 98)
Page 98 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-25741 | High | 7.5 | 2022-11-15 | Denial of service in WLAN due to potential null pointer dereference while accessing the memory location in Snapdragon Auto, Snapdragon Compute, Snapdragon Conn… |
CVE-2022-25727 | Critical | 9.8 | 2022-11-15 | Memory Corruption in modem due to improper length check while copying into memory in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice & Mus… |
CVE-2022-25724 | High | 8.4 | 2022-11-15 | Memory corruption in graphics due to buffer overflow while validating the user address in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdra… |
CVE-2022-25710 | High | 7.5 | 2022-11-15 | Denial of service due to null pointer dereference when GATT is disconnected in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon… |
CVE-2022-25679 | Medium | 6.2 | 2022-11-15 | Denial of service in video due to improper access control in broadcast receivers in Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Sna… |
CVE-2022-25676 | Medium | 6.8 | 2022-11-15 | Information disclosure in video due to buffer over-read while parsing avi files in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Ind… |
CVE-2022-25674 | Medium | 6.5 | 2022-11-15 | Cryptographic issues in WLAN during the group key handshake of the WPA/WPA2 protocol in Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Voice &… |
CVE-2022-25671 | High | 7.5 | 2022-11-15 | Denial of service in MODEM due to reachable assertion in Snapdragon Mobile |
CVE-2022-25667 | High | 7.5 | 2022-11-15 | Information disclosure in kernel due to improper handling of ICMP requests in Snapdragon Wired Infrastructure and Networking |
CVE-2022-45402 | Medium | 6.1 | 2022-11-15 | In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. |
CVE-2022-42060 | High | 7.5 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setWanPpoe function. This vulnerability allows attackers… |
CVE-2022-42058 | Critical | 9.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a stack overflow via the setRemoteWebManage function. This vulnerability allows at… |
CVE-2022-42053 | High | 7.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the PortMappingServer parameter in the setPo… |
CVE-2022-41396 | High | 7.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain multiple command injection vulnerabilities in the function setIPsecTunnelList via… |
CVE-2022-41395 | High | 7.8 | 2022-11-15 | Tenda AC1200 Router Model W15Ev2 V15.11.0.10(1576) was discovered to contain a command injection vulnerability via the dmzHost parameter in the setDMZ function. |
CVE-2022-40846 | Medium | 4.8 | 2022-11-15 | In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) vulnerability exists allowing an attacker to execute JavaScript code… |
CVE-2022-40844 | Medium | 5.4 | 2022-11-15 | In Tenda (Shenzhen Tenda Technology Co., Ltd) AC1200 Router model W15Ev2 V15.11.0.10(1576), a Stored Cross Site Scripting (XSS) issue exists allowing an attack… |
CVE-2022-42132 | Medium | 5.9 | 2022-11-15 | The Test LDAP Users functionality in Liferay Portal 7.0.0 through 7.4.3.4, and Liferay DXP 7.0 fix pack 102 and earlier, 7.1 before fix pack 27, 7.2 before fix… |
CVE-2022-42131 | Medium | 4.8 | 2022-11-15 | Certain Liferay products are affected by: Missing SSL Certificate Validation in the Dynamic Data Mapping module's REST data providers. This affects Liferay Por… |
CVE-2022-42130 | Medium | 4.3 | 2022-11-15 | The Dynamic Data Mapping module in Liferay Portal 7.1.0 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 19, 7.3 before update 4, a… |
CVE-2022-42129 | Medium | 4.3 | 2022-11-15 | An Insecure direct object reference (IDOR) vulnerability in the Dynamic Data Mapping module in Liferay Portal 7.3.2 through 7.4.3.4, and Liferay DXP 7.3 before… |
CVE-2022-40847 | High | 7.8 | 2022-11-15 | In Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576), there exists a command injection vulnerability in the function formSetFixTools. This vulnerability allow… |
CVE-2022-40845 | Medium | 6.5 | 2022-11-15 | The Tenda AC1200 Router model W15Ev2 V15.11.0.10(1576) is affected by a password exposure vulnerability. When combined with the improper authorization/improper… |
CVE-2022-40843 | Medium | 4.9 | 2022-11-15 | The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to b… |
CVE-2022-42978 | High | 7.5 | 2022-11-15 | In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remot… |
CVE-2022-42977 | High | 7.5 | 2022-11-15 | The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During… |
CVE-2022-42128 | Medium | 5.3 | 2022-11-15 | The Hypermedia REST APIs module in Liferay Portal 7.4.1 through 7.4.3.4, and Liferay DXP 7.4 GA does not properly check permissions, which allows remote attack… |
CVE-2022-42127 | Medium | 5.3 | 2022-11-15 | The Friendly Url module in Liferay Portal 7.4.3.5 through 7.4.3.36, and Liferay DXP 7.4 update 1 though 36 does not properly check user permissions, which allo… |
CVE-2022-42126 | Medium | 4.3 | 2022-11-15 | The Asset Libraries module in Liferay Portal 7.3.5 through 7.4.3.28, and Liferay DXP 7.3 before update 8, and DXP 7.4 before update 29 does not properly check… |
CVE-2022-42125 | High | 7.5 | 2022-11-15 | Zip slip vulnerability in FileUtil.unzip in Liferay Portal 7.4.3.5 through 7.4.3.35 and Liferay DXP 7.4 update 1 through update 34 allows attackers to create o… |
CVE-2022-42124 | High | 7.5 | 2022-11-15 | ReDoS vulnerability in LayoutPageTemplateEntryUpgradeProcess in Liferay Portal 7.3.2 through 7.4.3.4 and Liferay DXP 7.2 fix pack 9 through fix pack 18, 7.3 be… |
CVE-2022-42123 | High | 7.5 | 2022-11-15 | A Zip slip vulnerability in the Elasticsearch Connector in Liferay Portal 7.3.3 through 7.4.3.18, and Liferay DXP 7.3 before update 6, and 7.4 before update 19… |
CVE-2022-42122 | Critical | 9.8 | 2022-11-15 | A SQL injection vulnerability in the Friendly Url module in Liferay Portal 7.3.7, and Liferay DXP 7.3 fix pack 2 through update 4 allows attackers to execute a… |
CVE-2022-42121 | High | 8.8 | 2022-11-15 | A SQL injection vulnerability in the Layout module in Liferay Portal 7.1.3 through 7.4.3.4, and Liferay DXP 7.1 before fix pack 27, 7.2 before fix pack 17, 7.3… |
CVE-2022-42120 | Critical | 9.8 | 2022-11-15 | A SQL injection vulnerability in the Fragment module in Liferay Portal 7.3.3 through 7.4.3.16, and Liferay DXP 7.3 before update 4, and 7.4 before update 17 al… |
CVE-2022-42119 | Medium | 5.4 | 2022-11-15 | Certain Liferay products are vulnerable to Cross Site Scripting (XSS) via the Commerce module. This affects Liferay Portal 7.3.5 through 7.4.2 and Liferay DXP… |
CVE-2022-42118 | Medium | 6.1 | 2022-11-15 | A Cross-site scripting (XSS) vulnerability in the Portal Search module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 befor… |
CVE-2022-42111 | Medium | 5.4 | 2022-11-15 | A Cross-site scripting (XSS) vulnerability in the Sharing module's user notification in Liferay Portal 7.2.1 through 7.4.2, and Liferay DXP 7.2 before fix pack… |
CVE-2022-42984 | Critical | 9.8 | 2022-11-15 | WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients. |
CVE-2022-42110 | Medium | 6.1 | 2022-11-15 | A Cross-site scripting (XSS) vulnerability in the Announcements module in Liferay Portal 7.1.0 through 7.4.2, and Liferay DXP 7.1 before fix pack 27, 7.2 befor… |
CVE-2022-40405 | High | 7.5 | 2022-11-15 | WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs. |
CVE-2022-35613 | High | 8.8 | 2022-11-15 | Konker v2.3.9 was to discovered to contain a Cross-Site Request Forgery (CSRF). |
CVE-2022-33986 | Medium | 6.4 | 2022-11-15 | DMA attacks on the parameter buffer used by the VariableRuntimeDxe software SMI handler could lead to a TOCTOU attack. DMA attacks on the parameter buffer used… |
CVE-2022-33985 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the NvmExpressDxe software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA… |
CVE-2022-33984 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the SdMmcDevice software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA tr… |
CVE-2022-33983 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the NvmExpressLegacy software SMI handler could cause SMRAM corruption through a TOCTOU attack. D… |
CVE-2022-33909 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the HddPassword software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA tr… |
CVE-2022-33908 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the SdHostDriver software SMI handler could cause SMRAM corruption through a TOCTOU attack. DMA t… |
CVE-2022-33906 | Medium | 6.4 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the FwBlockServiceSmm software SMI handler could cause SMRAM corruption through a TOCTOU attack… |
CVE-2022-33905 | High | 7.0 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the AhciBusDxe software SMI handler could cause SMRAM corruption (a TOCTOU attack). DMA transacti… |
CVE-2022-32267 | Medium | 6.4 | 2022-11-15 | DMA transactions which are targeted at input buffers used for the SmmResourceCheckDxe software SMI handler cause SMRAM corruption (a TOCTOU attack) DMA transac… |
CVE-2022-31243 | Medium | 6.4 | 2022-11-15 | Update description and links DMA transactions which are targeted at input buffers used for the software SMI handler used by the FvbServicesRuntimeDxe driver co… |
CVE-2022-30774 | Medium | 6.4 | 2022-11-15 | DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before they are used (a TO… |
CVE-2022-43695 | Medium | 4.8 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in dashboard/system/express/entit… |
CVE-2022-43691 | Medium | 5.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 inadvertently disclose server-side sensitive information (secrets in environment var… |
CVE-2022-43690 | Medium | 6.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 did not use strict comparison for the legacy_salt so that limited authentication byp… |
CVE-2022-43689 | Medium | 5.3 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to XXE based DNS requests leading to IP disclosure. |
CVE-2022-43688 | Medium | 4.8 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Stored Cross-Site Scripting (XSS) in icons since the Microsoft appl… |
CVE-2022-43687 | Medium | 5.4 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 does not issue a new session ID upon successful OAuth authentication. Remediate by u… |
CVE-2022-43030 | High | 7.2 | 2022-11-14 | Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management system based on ThinkPa… |
CVE-2022-40903 | Medium | 6.5 | 2022-11-14 | Aiphone GT-DMB-N 3-in-1 Video Entrance Station with NFC Reader 1.0.3 does not mitigate against repeated failed access attempts, which allows an attacker to gai… |
CVE-2022-40735 | High | 7.5 | 2022-11-14 | The Diffie-Hellman Key Agreement Protocol allows use of long exponents that arguably make certain calculations unnecessarily expensive, because the 1996 van Oo… |
CVE-2022-34325 | High | 7.8 | 2022-11-14 | DMA transactions which are targeted at input buffers used for the StorageSecurityCommandDxe software SMI handler could cause SMRAM corruption through a TOCTOU… |
CVE-2022-33982 | Medium | 6.4 | 2022-11-14 | DMA attacks on the parameter buffer used by the Int15ServiceSmm software SMI handler could lead to a TOCTOU attack on the SMI handler and lead to corruption of… |
CVE-2022-33907 | Medium | 6.4 | 2022-11-14 | DMA transactions which are targeted at input buffers used for the software SMI handler used by the IdeBusDxe driver could cause SMRAM corruption through a TOCT… |
CVE-2022-43968 | Medium | 6.1 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output. Re… |
CVE-2022-43967 | Medium | 6.1 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the multilingual report due to un-sanitized output… |
CVE-2022-43686 | Medium | 6.5 | 2022-11-14 | In Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2, the authTypeConcreteCookieMap table can be filled up causing a denial of service… |
CVE-2022-43294 | Critical | 9.8 | 2022-11-14 | Tasmota before commit 066878da4d4762a9b6cb169fdf353e804d735cfd was discovered to contain a stack overflow via the ClientPortPtr parameter at lib/libesp32/rtsp/… |
CVE-2022-32266 | Medium | 6.4 | 2022-11-14 | DMA attacks on the parameter buffer used by a software SMI handler used by the driver PcdSmmDxe could lead to a TOCTOU attack on the SMI handler and lead to co… |
CVE-2022-30773 | Medium | 6.4 | 2022-11-14 | DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a… |
CVE-2022-43295 | Medium | 5.5 | 2022-11-14 | XPDF v4.04 was discovered to contain a stack overflow via the function FileStream::copy() at xpdf/Stream.cc:795. |
CVE-2022-43146 | High | 7.2 | 2022-11-14 | An arbitrary file upload vulnerability in the image upload function of Canteen Management System v1.0 allows attackers to execute arbitrary code via a crafted… |
CVE-2022-41913 | Medium | 4.3 | 2022-11-14 | Discourse-calendar is a plugin for the Discourse messaging platform which adds the ability to create a dynamic calendar in the first post of a topic. Members o… |
CVE-2022-3903 | Medium | 4.6 | 2022-11-14 | An incorrect read request flaw was found in the Infrared Transceiver USB driver in the Linux kernel. This issue occurs when a user attaches a malicious USB dev… |
CVE-2022-3362 | Critical | 9.8 | 2022-11-14 | Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0. |
CVE-2022-3238 | High | 7.8 | 2022-11-14 | A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allows a local user to c… |
CVE-2022-39385 | Medium | 6.5 | 2022-11-14 | Discourse is the an open source discussion platform. In some rare cases users redeeming an invitation can be added as a participant to several private message… |
CVE-2022-38167 | Medium | 6.1 | 2022-11-14 | The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS. |
CVE-2022-37109 | Critical | 9.8 | 2022-11-14 | patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. Access to the password.txt fi… |
CVE-2022-28764 | Low | 3.3 | 2022-11-14 | The Zoom Client for Meetings (for Android, iOS, Linux, macOS, and Windows) before version 5.12.6 is susceptible to a local information exposure vulnerability… |
CVE-2022-27896 | Medium | 4.2 | 2022-11-14 | Information Exposure Through Log Files vulnerability discovered in Foundry Code-Workbooks where the endpoint backing that console was generating service log re… |
CVE-2022-44390 | Medium | 5.4 | 2022-11-14 | A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2022-44389 | Medium | 6.5 | 2022-11-14 | EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module. This vulnerability allows attackers to… |
CVE-2022-44387 | High | 8.8 | 2022-11-14 | EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module. |
CVE-2022-43323 | High | 8.8 | 2022-11-14 | EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Top Up Balance component under the Edit Member module. |
CVE-2022-34320 | Medium | 5.9 | 2022-11-14 | IBM CICS TX 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 2294… |
CVE-2022-34317 | Medium | 5.4 | 2022-11-14 | IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int… |
CVE-2022-43694 | Medium | 6.1 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the image manipulation library due to un-sanitized… |
CVE-2022-43692 | Medium | 6.1 | 2022-11-14 | Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS - user can cause an administrator to trigger reflecte… |
CVE-2022-34316 | Low | 3.7 | 2022-11-14 | IBM CICS TX 11.1 does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can proce… |
CVE-2022-34315 | Medium | 5.4 | 2022-11-14 | IBM CICS TX 11.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the int… |
CVE-2022-34314 | Medium | 4.0 | 2022-11-14 | IBM CICS TX 11.1 could disclose sensitive information to a local user due to insecure permission settings. IBM X-Force ID: 229450. |
CVE-2022-3993 | Critical | 9.4 | 2022-11-14 | Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3. |
CVE-2022-38705 | Medium | 5.3 | 2022-11-14 | IBM CICS TX 11.1 Standard and Advanced could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could e… |
CVE-2022-34329 | Medium | 5.3 | 2022-11-14 | IBM CICS TX 11.7 could allow an attacker to obtain sensitive information from HTTP response headers. IBM X-Force ID: 229467. |
CVE-2022-34319 | Medium | 5.9 | 2022-11-14 | IBM CICS TX 11.7 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 229… |
CVE-2022-34313 | Medium | 4.3 | 2022-11-14 | IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a htt… |
CVE-2022-34312 | Medium | 4.0 | 2022-11-14 | IBM CICS TX 11.1 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 229447. |
CVE-2022-24938 | Medium | 6.5 | 2022-11-14 | A malformed packet causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset, immediately clearing the error. |