2022 CVEs (page 99)
Page 99 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2449 | Medium | 6.5 | 2022-11-14 | The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowi… |
CVE-2022-45378 | Critical | 9.8 | 2022-11-14 | In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods… |
CVE-2022-3988 | Low | 3.5 | 2022-11-14 | A vulnerability was found in Frappe. It has been rated as problematic. Affected by this issue is some unknown functionality of the file frappe/templates/includ… |
CVE-2022-40127 | High | 8.8 | 2022-11-14 | A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided r… |
CVE-2022-27949 | High | 7.5 | 2022-11-14 | A vulnerability in UI of Apache Airflow allows an attacker to view unmasked secrets in rendered template values for tasks which were not executed (for example… |
CVE-2022-45184 | High | 7.2 | 2022-11-14 | The Web Server in Ironman Software PowerShell Universal v3.x and v2.x allows for directory traversal outside of the configuration directory, which allows a rem… |
CVE-2022-45183 | High | 8.8 | 2022-11-14 | Escalation of privileges in the Web Server in Ironman Software PowerShell Universal 2.x and 3.x allows an attacker with a valid app token to retrieve other app… |
CVE-2022-37290 | Medium | 5.5 | 2022-11-14 | GNOME Nautilus 42.2 allows a NULL pointer dereference and get_basename application crash via a pasted ZIP archive. |
CVE-2022-45199 | High | 7.5 | 2022-11-14 | Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL. |
CVE-2022-45198 | High | 7.5 | 2022-11-14 | Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification). |
CVE-2022-31630 | Medium | 6.5 | 2022-11-14 | In PHP versions prior to 7.4.33, 8.0.25 and 8.1.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file… |
CVE-2022-3979 | Medium | 5.6 | 2022-11-13 | A vulnerability was found in NagVis up to 1.9.33 and classified as problematic. This issue affects the function checkAuthCookie of the file share/server/core/c… |
CVE-2022-3978 | Medium | 4.3 | 2022-11-13 | A vulnerability, which was classified as problematic, was found in NodeBB up to 2.5.7. This affects an unknown part of the file /register/abort. The manipulati… |
CVE-2022-3976 | Medium | 5.5 | 2022-11-13 | A vulnerability has been found in MZ Automation libiec61850 up to 1.4 and classified as critical. This vulnerability affects unknown code of the file src/mms/i… |
CVE-2022-3975 | Low | 3.5 | 2022-11-13 | A vulnerability, which was classified as problematic, has been found in NukeViet CMS. Affected by this issue is the function filterAttr of the file vendor/vina… |
CVE-2022-3974 | Medium | 6.3 | 2022-11-13 | A vulnerability classified as critical was found in Axiomatic Bento4. Affected by this vulnerability is the function AP4_StdcFileByteStream::ReadPartial of the… |
CVE-2022-3973 | High | 7.3 | 2022-11-13 | A vulnerability classified as critical has been found in Pingkon HMS-PHP. Affected is an unknown function of the file /admin/admin.php of the component Data Pu… |
CVE-2022-3972 | High | 7.3 | 2022-11-13 | A vulnerability was found in Pingkon HMS-PHP. It has been rated as critical. This issue affects some unknown processing of the file admin/adminlogin.php. The m… |
CVE-2022-3971 | Medium | 4.6 | 2022-11-13 | A vulnerability was found in matrix-appservice-irc up to 0.35.1. It has been declared as critical. This vulnerability affects unknown code of the file src/data… |
CVE-2022-3970 | Medium | 6.3 | 2022-11-13 | A vulnerability was found in LibTIFF. It has been classified as critical. This affects the function TIFFReadRGBATileExt of the file libtiff/tif_getimage.c. The… |
CVE-2022-3969 | Low | 2.6 | 2022-11-13 | A vulnerability was found in OpenKM up to 6.3.11 and classified as problematic. Affected by this issue is the function getFileExtension of the file src/main/ja… |
CVE-2022-3968 | Low | 3.5 | 2022-11-13 | A vulnerability has been found in emlog and classified as problematic. Affected by this vulnerability is an unknown functionality of the file admin/article_sav… |
CVE-2022-3967 | Medium | 5.3 | 2022-11-13 | A vulnerability, which was classified as critical, was found in Vesta Control Panel. Affected is an unknown function of the file func/main.sh of the component… |
CVE-2022-3966 | Medium | 4.3 | 2022-11-13 | A vulnerability, which was classified as critical, has been found in Ultimate Member Plugin up to 2.5.0. This issue affects the function load_template of the f… |
CVE-2022-3965 | Medium | 4.3 | 2022-11-13 | A vulnerability classified as problematic was found in ffmpeg. This vulnerability affects the function smc_encode_stream of the file libavcodec/smcenc.c of the… |
CVE-2022-3964 | Medium | 4.3 | 2022-11-13 | A vulnerability classified as problematic has been found in ffmpeg. This affects an unknown part of the file libavcodec/rpzaenc.c of the component QuickTime RP… |
CVE-2022-3963 | Low | 3.5 | 2022-11-12 | A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key… |
CVE-2022-45196 | High | 7.5 | 2022-11-12 | Hyperledger Fabric 2.3 allows attackers to cause a denial of service (orderer crash) by repeatedly sending a crafted channel tx with the same Channel name. NOT… |
CVE-2022-45195 | Medium | 5.3 | 2022-11-12 | SimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere with forward secrecy… |
CVE-2022-45188 | High | 7.8 | 2022-11-12 | Netatalk through 3.1.13 has an afp_getappl heap-based buffer overflow resulting in code execution via a crafted .appl file. This provides remote root access on… |
CVE-2022-38652 | Critical | 9.9 | 2022-11-12 | A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated use… |
CVE-2022-38651 | Critical | 9.8 | 2022-11-12 | A security filter misconfiguration exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to bypass some authentic… |
CVE-2022-38650 | Critical | 10.0 | 2022-11-12 | A remote unauthenticated insecure deserialization vulnerability exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious p… |
CVE-2022-43672 | Critical | 9.8 | 2022-11-12 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software compo… |
CVE-2022-43671 | Critical | 9.8 | 2022-11-12 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection. |
CVE-2022-41339 | High | 7.8 | 2022-11-12 | In Zoho ManageEngine Mobile Device Manager Plus before 10.1.2207.5, the User Administration module allows privilege escalation. |
CVE-2022-40773 | High | 8.8 | 2022-11-12 | Zoho ManageEngine ServiceDesk Plus MSP before 10609 and SupportCenter Plus before 11025 are vulnerable to privilege escalation. This allows users to obtain sen… |
CVE-2022-45194 | Low | 3.8 | 2022-11-12 | CBRN-Analysis before 22 allows XXE attacks via am mws XML document, leading to NTLMv2-SSP hash disclosure. |
CVE-2022-45193 | Medium | 5.9 | 2022-11-12 | CBRN-Analysis before 22 has weak file permissions under Public Profile, leading to disclosure of file contents or privilege escalation. |
CVE-2022-41905 | High | 8.2 | 2022-11-11 | WsgiDAV is a generic and extendable WebDAV server based on WSGI. Implementations using this library with directory browsing enabled may be susceptible to Cross… |
CVE-2022-45182 | Critical | 9.8 | 2022-11-11 | Pi-Star_DV_Dash (for Pi-Star DV) before 5aa194d mishandles the module parameter. |
CVE-2022-41906 | High | 8.7 | 2022-11-11 | OpenSearch Notifications is a notifications plugin for OpenSearch that enables other plugins to send notifications via Email, Slack, Amazon Chime, Custom web-h… |
CVE-2022-41904 | Medium | 6.4 | 2022-11-11 | Element iOS is an iOS Matrix client provided by Element. It is based on MatrixSDK. Prior to version 1.9.7, events encrypted using Megolm for which trust could… |
CVE-2022-41882 | Medium | 6.6 | 2022-11-11 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with your computer. In version 3.6.0, if a user received a malicious file sha… |
CVE-2022-40750 | Medium | 5.4 | 2022-11-11 | IBM WebSphere Application Server 8.5, and 9.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the… |
CVE-2022-38387 | High | 7.1 | 2022-11-11 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.2.0 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending… |
CVE-2022-36776 | Medium | 5.4 | 2022-11-11 | IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript… |
CVE-2022-31772 | Medium | 5.3 | 2022-11-11 | IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels… |
CVE-2022-34331 | Medium | 5.5 | 2022-11-11 | After performing a sequence of Power FW950, FW1010 maintenance operations a SRIOV network adapter can be improperly configured leading to desired VEPA configu… |
CVE-2022-3959 | Low | 3.1 | 2022-11-11 | A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the compone… |
CVE-2022-3957 | Medium | 4.3 | 2022-11-11 | A vulnerability classified as problematic was found in GPAC. Affected by this vulnerability is the function svg_parse_preserveaspectratio of the file scenegrap… |
CVE-2022-3956 | Medium | 6.3 | 2022-11-11 | A vulnerability classified as critical has been found in tsruban HHIMS 2.1. Affected is an unknown function of the component Patient Portrait Handler. The mani… |
CVE-2022-3955 | High | 7.3 | 2022-11-11 | A vulnerability was found in tholum crm42. It has been rated as critical. This issue affects some unknown processing of the file crm42\class\class.user.php of… |
CVE-2022-38099 | High | 7.5 | 2022-11-11 | Improper input validation in BIOS firmware for some Intel(R) NUC 11 Compute Elements before version EBTGL357.0065 may allow a privileged user to potentially en… |
CVE-2022-37345 | High | 7.8 | 2022-11-11 | Improper authentication in BIOS firmware[A1] for some Intel(R) NUC Kits before version RY0386 may allow an authenticated user to potentially enable escalation… |
CVE-2022-37334 | High | 7.8 | 2022-11-11 | Improper initialization in BIOS firmware for some Intel(R) NUC 11 Pro Kits and Intel(R) NUC 11 Pro Boards before version TNTGL357.0064 may allow an authenticat… |
CVE-2022-36789 | High | 7.5 | 2022-11-11 | Improper access control in BIOS firmware for some Intel(R) NUC 10 Performance Kits and Intel(R) NUC 10 Performance Mini PCs before version FNCML357.0053 may al… |
CVE-2022-36400 | Medium | 6.7 | 2022-11-11 | Path traversal in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user… |
CVE-2022-36384 | Medium | 6.7 | 2022-11-11 | Unquoted search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticate… |
CVE-2022-36380 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenti… |
CVE-2022-36377 | Medium | 6.7 | 2022-11-11 | Insecure inherited permissions in some Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs before version 22.190.0.3 for Wi… |
CVE-2022-36370 | High | 7.5 | 2022-11-11 | Improper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow a privileged user to potentially… |
CVE-2022-36367 | Medium | 4.4 | 2022-11-11 | Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable informatio… |
CVE-2022-36349 | Medium | 5.2 | 2022-11-11 | Insecure default variable initialization in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow an authenticated… |
CVE-2022-35276 | High | 7.5 | 2022-11-11 | Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user to potentially enabl… |
CVE-2022-34152 | High | 7.7 | 2022-11-11 | Improper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged user to potentially ena… |
CVE-2022-33973 | Low | 3.3 | 2022-11-11 | Improper access control in the Intel(R) WAPI Security software for Windows 10/11 before version 22.2150.0.1 may allow an authenticated user to potentially enab… |
CVE-2022-33942 | High | 8.8 | 2022-11-11 | Protection mechanism failure in the Intel(R) DCM software before version 5.0 may allow an unauthenticated user to potentially enable escalation of privilege vi… |
CVE-2022-33176 | High | 8.2 | 2022-11-11 | Improper input validation in BIOS firmware for some Intel(R) NUC 11 Performance kits and Intel(R) NUC 11 Performance Mini PCs before version PATGL357.0042 may… |
CVE-2022-32569 | High | 7.5 | 2022-11-11 | Improper buffer restrictions in BIOS firmware for some Intel(R) NUC M15 Laptop Kits before version BCTGL357.0074 may allow a privileged user to potentially ena… |
CVE-2022-30691 | Medium | 5.9 | 2022-11-11 | Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable den… |
CVE-2022-30548 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the Intel(R) Glorp software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2022-30542 | High | 8.2 | 2022-11-11 | Improper input validation in the firmware for some Intel(R) Server Board S2600WF, Intel(R) Server System R1000WF and Intel(R) Server System R2000WF families be… |
CVE-2022-30297 | Low | 3.8 | 2022-11-11 | Cross-site scripting in the Intel(R) EMA software before version 1.8.0 may allow a privileged user to potentially enable escalation of privilege via local acce… |
CVE-2022-29893 | High | 8.1 | 2022-11-11 | Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an authenticated… |
CVE-2022-29515 | Medium | 6.0 | 2022-11-11 | Missing release of memory after effective lifetime in firmware for Intel(R) SPS before versions SPS_E3_06.00.03.035.0 may allow a privileged user to potentiall… |
CVE-2022-29486 | Medium | 4.3 | 2022-11-11 | Improper buffer restrictions in the Hyperscan library maintained by Intel(R) all versions downloaded before 04/29/2022 may allow an unauthenticated user to pot… |
CVE-2022-29466 | High | 7.3 | 2022-11-11 | Improper input validation in firmware for Intel(R) SPS before version SPS_E3_04.01.04.700.0 may allow an authenticated user to potentially enable denial of ser… |
CVE-2022-28667 | Medium | 6.5 | 2022-11-11 | Out-of-bounds write for some Intel(R) PROSet/Wireless WiFi software before version 22.140 may allow an unauthenticated user to potentially enable denial of ser… |
CVE-2022-28611 | Medium | 6.8 | 2022-11-11 | Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable es… |
CVE-2022-28126 | Medium | 6.0 | 2022-11-11 | Improper input validation in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable es… |
CVE-2022-27874 | Medium | 6.8 | 2022-11-11 | Improper authentication in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable esca… |
CVE-2022-27639 | Medium | 5.4 | 2022-11-11 | Incomplete cleanup in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalatio… |
CVE-2022-27638 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the Intel(R) Advanced Link Analyzer Pro before version 22.2 and Standard edition software before version 22.1.1 STD may all… |
CVE-2022-27499 | Low | 2.5 | 2022-11-11 | Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosur… |
CVE-2022-27497 | High | 8.6 | 2022-11-11 | Null pointer dereference in firmware for Intel(R) AMT before version 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticat… |
CVE-2022-27233 | Medium | 6.5 | 2022-11-11 | XML injection in the Quartus(R) Prime Programmer included in the Intel(R) Quartus Prime Pro and Standard edition software may allow an unauthenticated user to… |
CVE-2022-27187 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the Intel(R) Quartus Prime Standard edition software before version 21.1 Patch 0.02std may allow an authenticated user to p… |
CVE-2022-26845 | High | 8.7 | 2022-11-11 | Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticat… |
CVE-2022-26513 | High | 8.0 | 2022-11-11 | Out-of-bounds write in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow an unauthenticated user to potentially enable es… |
CVE-2022-26508 | Medium | 4.3 | 2022-11-11 | Improper authentication in the Intel(R) SDP Tool before version 3.0.0 may allow an unauthenticated user to potentially enable information disclosure via networ… |
CVE-2022-26369 | Medium | 6.2 | 2022-11-11 | Out-of-bounds read in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable escalatio… |
CVE-2022-26367 | Medium | 6.0 | 2022-11-11 | Improper buffer restrictions in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable… |
CVE-2022-26341 | High | 8.2 | 2022-11-11 | Insufficiently protected credentials in software in Intel(R) AMT SDK before version 16.0.4.1, Intel(R) EMA before version 1.7.1 and Intel(R) MC before version… |
CVE-2022-26124 | High | 7.5 | 2022-11-11 | Improper buffer restrictions in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC 8 Boards, Intel(R) NUC 8 Rugged Boards and Intel(R) NUC 8 Rugged Kits… |
CVE-2022-26086 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the PresentMon software maintained by Intel(R) before version 1.7.1 may allow an authenticated user to potentially enable e… |
CVE-2022-26079 | Medium | 6.0 | 2022-11-11 | Improper conditions check in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable es… |
CVE-2022-26047 | Medium | 4.3 | 2022-11-11 | Improper input validation for some Intel(R) PROSet/Wireless WiFi, Intel vPro(R) CSME WiFi and Killer(TM) WiFi products may allow unauthenticated user to potent… |
CVE-2022-26045 | Low | 3.3 | 2022-11-11 | Improper buffer restrictions in some Intel(R) XMM(TM) 7560 Modem software before version M2_7560_R_01.2146.00 may allow a privileged user to potentially enable… |
CVE-2022-26028 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation o… |