2022 CVEs (page 99)
Page 99 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24937 | Medium | 6.5 | 2022-11-14 | Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in Silicon Labs Ember ZNet allows Overflow Buffers. |
CVE-2022-0137 | High | 7.5 | 2022-11-14 | A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries. |
CVE-2022-43693 | High | 8.8 | 2022-11-14 | Concrete CMS is vulnerable to CSRF due to the lack of "State" parameter for external Concrete authentication service for users of Concrete who use the "out of… |
CVE-2022-3992 | Low | 2.4 | 2022-11-14 | A vulnerability classified as problematic was found in SourceCodester Sanitization Management System. Affected by this vulnerability is an unknown functionalit… |
CVE-2022-35719 | Medium | 5.1 | 2022-11-14 | IBM MQ Internet Pass-Thru 2.1, 9.2 LTS and 9.2 CD stores potentially sensitive information in trace files that could be read by a local user. |
CVE-2022-0324 | High | 8.1 | 2022-11-14 | There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that could cause buffer overflow in a memcpy… |
CVE-2022-45136 | Critical | 9.8 | 2022-11-14 | Apache Jena SDB 3.17.0 and earlier is vulnerable to a JDBC Deserialisation attack if the attacker is able to control the JDBC URL used or cause the underlying… |
CVE-2022-43342 | Medium | 5.4 | 2022-11-14 | A stored cross-site scripting (XSS) vulnerability in the Add function of Eramba GRC Software c2.8.1 allows attackers to execute arbitrary web scripts or HTML v… |
CVE-2022-43288 | High | 8.8 | 2022-11-14 | Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the order_by parameter at /rukovoditel/index.php?module=logs/view&type=php. |
CVE-2022-3632 | Medium | 6.5 | 2022-11-14 | The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to make logged-in users… |
CVE-2022-3631 | Medium | 4.8 | 2022-11-14 | The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users su… |
CVE-2022-3578 | Medium | 6.1 | 2022-11-14 | The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2022-3574 | Critical | 9.8 | 2022-11-14 | The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection. |
CVE-2022-3539 | Medium | 4.8 | 2022-11-14 | The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privil… |
CVE-2022-3538 | Medium | 6.5 | 2022-11-14 | The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated user… |
CVE-2022-3484 | Medium | 6.1 | 2022-11-14 | The WPB Show Core WordPress plugin does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. |
CVE-2022-3477 | Critical | 9.8 | 2022-11-14 | The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not prope… |
CVE-2022-3469 | Medium | 4.8 | 2022-11-14 | The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to pe… |
CVE-2022-3415 | Medium | 6.1 | 2022-11-14 | The Chat Bubble WordPress plugin before 2.3 does not sanitise and escape some contact parameters, which could allow unauthenticated attackers to set Stored Cro… |
CVE-2022-2450 | Medium | 4.3 | 2022-11-14 | The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged… |
CVE-2022-2449 | Medium | 6.5 | 2022-11-14 | The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowi… |
CVE-2022-45378 | Critical | 9.8 | 2022-11-14 | In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods… |
CVE-2022-3988 | Low | 3.5 | 2022-11-14 | A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includ… |
CVE-2022-40127 | High | 8.8 | 2022-11-14 | A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided r… |
CVE-2022-27949 | High | 7.5 | 2022-11-14 | A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example… |
CVE-2022-45184 | High | 7.2 | 2022-11-14 | The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the configuration directory, which allows a rem… |
CVE-2022-45183 | High | 8.8 | 2022-11-14 | Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app… |
CVE-2022-37290 | Medium | 5.5 | 2022-11-14 | GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive. |
CVE-2022-45199 | High | 7.5 | 2022-11-14 | Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. |
CVE-2022-45198 | High | 7.5 | 2022-11-14 | Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). |
CVE-2022-31630 | Medium | 6.5 | 2022-11-14 | In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file… |
CVE-2022-3979 | Medium | 5.6 | 2022-11-13 | A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/c… |
CVE-2022-3978 | Medium | 4.3 | 2022-11-13 | A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulati… |
CVE-2022-3976 | Medium | 5.5 | 2022-11-13 | A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/i… |
CVE-2022-3975 | Low | 3.5 | 2022-11-13 | A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vina… |
CVE-2022-3974 | Medium | 6.3 | 2022-11-13 | A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is the function AP4_StdcFileByteStream::ReadPartial of the… |
CVE-2022-3973 | High | 7.3 | 2022-11-13 | A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pu… |
CVE-2022-3972 | High | 7.3 | 2022-11-13 | A vulnerability was found in Pingkon HMS-PHP. It has been rated as critical. This issue affects some unknown processing of the file admin/adminlogin.php. The m… |
CVE-2022-3971 | Medium | 4.6 | 2022-11-13 | A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/data… |
CVE-2022-3970 | Medium | 6.3 | 2022-11-13 | A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The… |
CVE-2022-3969 | Low | 2.6 | 2022-11-13 | A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/ja… |
CVE-2022-3968 | Low | 3.5 | 2022-11-13 | A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_sav… |
CVE-2022-3967 | Medium | 5.3 | 2022-11-13 | A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component… |
CVE-2022-3966 | Medium | 4.3 | 2022-11-13 | A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the f… |
CVE-2022-3965 | Medium | 4.3 | 2022-11-13 | A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the… |
CVE-2022-3964 | Medium | 4.3 | 2022-11-13 | A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RP… |
CVE-2022-3963 | Low | 3.5 | 2022-11-12 | A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key… |
CVE-2022-45196 | High | 7.5 | 2022-11-12 | Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name. NOT… |
CVE-2022-45195 | Medium | 5.3 | 2022-11-12 | SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy… |
CVE-2022-45188 | High | 7.8 | 2022-11-12 | Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl file. This provides remote root access on… |
CVE-2022-38652 | Critical | 9.9 | 2022-11-12 | A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated use… |
CVE-2022-38651 | Critical | 9.8 | 2022-11-12 | A security filter misconfiguration exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to bypass some authentic… |
CVE-2022-38650 | Critical | 10.0 | 2022-11-12 | A remote unauthenticated insecure deserialization vulnerability exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious p… |
CVE-2022-43672 | Critical | 9.8 | 2022-11-12 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software compo… |
CVE-2022-43671 | Critical | 9.8 | 2022-11-12 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection. |
CVE-2022-41339 | High | 7.8 | 2022-11-12 | In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation. |
CVE-2022-40773 | High | 8.8 | 2022-11-12 | Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sen… |
CVE-2022-45194 | Low | 3.8 | 2022-11-12 | CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure. |
CVE-2022-45193 | Medium | 5.9 | 2022-11-12 | CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation. |
CVE-2022-41905 | High | 8.2 | 2022-11-11 | WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross… |
CVE-2022-45182 | Critical | 9.8 | 2022-11-11 | Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter. |
CVE-2022-41906 | High | 8.7 | 2022-11-11 | OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-h… |
CVE-2022-41904 | Medium | 6.4 | 2022-11-11 | Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could… |
CVE-2022-41882 | Medium | 6.6 | 2022-11-11 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0, if a user received a malicious file sha… |
CVE-2022-40750 | Medium | 5.4 | 2022-11-11 | IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2022-38387 | High | 7.1 | 2022-11-11 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending… |
CVE-2022-36776 | Medium | 5.4 | 2022-11-11 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2022-31772 | Medium | 5.3 | 2022-11-11 | IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels… |
CVE-2022-34331 | Medium | 5.5 | 2022-11-11 | After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly configured leading to desired VEPA configu… |
CVE-2022-3959 | Low | 3.1 | 2022-11-11 | A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the compone… |
CVE-2022-3957 | Medium | 4.3 | 2022-11-11 | A vulnerability classified as problematic was found in GPAC. Affected by this vulnerability is the function svg_parse_preserveaspectratio of the file scenegrap… |
CVE-2022-3956 | Medium | 6.3 | 2022-11-11 | A vulnerability classified as critical has been found in tsruban HHIMS 2.1. Affected is an unknown function of the component Patient Portrait Handler. The mani… |
CVE-2022-3955 | High | 7.3 | 2022-11-11 | A vulnerability was found in tholum crm42. It has been rated as critical. This issue affects some unknown processing of the file crm42\class\class.user.php of… |
CVE-2022-38099 | High | 7.5 | 2022-11-11 | Improper input validation in BIOS firmware for some Intel(R) NUC 11 Compute Elements before version EBTGL357.0065 may allow a privileged user to potentially en… |
CVE-2022-37345 | High | 7.8 | 2022-11-11 | Improper authentication in BIOS firmware[A1] for some Intel(R) NUC Kits before version RY0386 may allow an authenticated user to potentially enable escalation… |
CVE-2022-37334 | High | 7.8 | 2022-11-11 | Improper initialization in BIOS firmware for some Intel(R) NUC 11 Pro Kits and Intel(R) NUC 11 Pro Boards before version TNTGL357.0064 may allow an authenticat… |
CVE-2022-36789 | High | 7.5 | 2022-11-11 | Improper access control in BIOS firmware for some Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Performance Mini PCs before version FNCML357.0053 may al… |
CVE-2022-36400 | Medium | 6.7 | 2022-11-11 | Path traversal in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user… |
CVE-2022-36384 | Medium | 6.7 | 2022-11-11 | Unquoted search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticate… |
CVE-2022-36380 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenti… |
CVE-2022-36377 | Medium | 6.7 | 2022-11-11 | Insecure inherited permissions in some Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs before version 22.190.0.3 for Wi… |
CVE-2022-36370 | High | 7.5 | 2022-11-11 | Improper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow a privileged user to potentially… |
CVE-2022-36367 | Medium | 4.4 | 2022-11-11 | Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable informatio… |
CVE-2022-36349 | Medium | 5.2 | 2022-11-11 | Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow an authenticated… |
CVE-2022-35276 | High | 7.5 | 2022-11-11 | Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user to potentially enabl… |
CVE-2022-34152 | High | 7.7 | 2022-11-11 | Improper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged user to potentially ena… |
CVE-2022-33973 | Low | 3.3 | 2022-11-11 | Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user to potentially enab… |
CVE-2022-33942 | High | 8.8 | 2022-11-11 | Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege vi… |
CVE-2022-33176 | High | 8.2 | 2022-11-11 | Improper input validation in BIOS firmware for some Intel(R) NUC 11 Performance kits and Intel(R) NUC 11 Performance Mini PCs before version PATGL357.0042 may… |
CVE-2022-32569 | High | 7.5 | 2022-11-11 | Improper buffer restrictions in BIOS firmware for some Intel(R) NUC M15 Laptop Kits before version BCTGL357.0074 may allow a privileged user to potentially ena… |
CVE-2022-30691 | Medium | 5.9 | 2022-11-11 | Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable den… |
CVE-2022-30548 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the Intel(R) Glorp software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2022-30542 | High | 8.2 | 2022-11-11 | Improper input validation in the firmware for some Intel(R) Server Board S2600WF, Intel(R) Server System R1000WF and Intel(R) Server System R2000WF families be… |
CVE-2022-30297 | Low | 3.8 | 2022-11-11 | Cross-site scripting in the Intel(R) EMA software before version 1.8.0 may allow a privileged user to potentially enable escalation of privilege via local acce… |
CVE-2022-29893 | High | 8.1 | 2022-11-11 | Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an authenticated… |
CVE-2022-29515 | Medium | 6.0 | 2022-11-11 | Missing release of memory after effective lifetime in firmware for Intel(R) SPS before versions SPS_E3_06.00.03.035.0 may allow a privileged user to potentiall… |
CVE-2022-29486 | Medium | 4.3 | 2022-11-11 | Improper buffer restrictions in the Hyperscan library maintained by Intel(R) all versions downloaded before 04/29/2022 may allow an unauthenticated user to pot… |
CVE-2022-29466 | High | 7.3 | 2022-11-11 | Improper input validation in firmware for Intel(R) SPS before version SPS_E3_04.01.04.700.0 may allow an authenticated user to potentially enable denial of ser… |
CVE-2022-28667 | Medium | 6.5 | 2022-11-11 | Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi software before version 22.140 may allow an unauthenticated user to potentially enable denial of ser… |
CVE-2022-28611 | Medium | 6.8 | 2022-11-11 | Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable es… |