Uncategorized CVEs — 2022 (Page 4/27)

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0

2022-11-01

Medium

CVE-2022-3443

Insufficient data validation in File System API in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass File System restrictions via a crafted HTML page. (Chromium security severi…

CVSS: 4.3CWE: N/A

Medium

CVE-2022-3317

Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 106.0.5249.62 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium…

CVSS: 4.3CWE: N/A

Medium

CVE-2022-3316

Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass security feature via a crafted HTML page. (Chromium security se…

CVSS: 4.3CWE: N/A

High

CVE-2022-32899

The issue was addressed with improved memory handling. This issue is fixed in iOS 15.7 and iPadOS 15.7, iOS 16, macOS Ventura 13, watchOS 9. An app may be able to execute arbitrary code with kernel p…

CVSS: 7.8CWE: N/A

High

CVE-2022-32898

CVSS: 7.8CWE: N/A

High

CVE-2022-32892

An access issue was addressed with improvements to the sandbox. This issue is fixed in Safari 16, iOS 15.7 and iPadOS 15.7, iOS 16, macOS Ventura 13. A sandboxed process may be able to circumvent san…

CVSS: 8.6CWE: N/A

High

CVE-2022-32890

A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. A sandboxed process may be able to circumvent sandbox restrictions.

CVSS: 8.6CWE: N/A

High

CVE-2022-32889

The issue was addressed with improved memory handling. This issue is fixed in iOS 16, watchOS 9. An app may be able to execute arbitrary code with kernel privileges.

CVSS: 7.8CWE: N/A

High

CVE-2022-32887

The issue was addressed with improved memory handling. This issue is fixed in iOS 16. An app may be able to execute arbitrary code with kernel privileges.

CVSS: 7.8CWE: N/A

Medium

CVE-2022-32881

A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.7, macOS Ventura 13, iOS 16, watchOS 9, macOS Monterey 12.6, tvOS 16. An app may be able to modify prot…

CVSS: 5.5CWE: N/A

Low

CVE-2022-32879

A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, iOS 16, iOS 15.7 and iPadOS 15.7, watchOS 9, tvOS 16. A user with physical access to a device may…

CVSS: 2.4CWE: N/A

Medium

CVE-2022-22677

A logic issue in the handling of concurrent media was addressed with improved state handling. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. Video self-preview in a webRTC call…

CVSS: 4.3CWE: N/A

High

CVE-2022-25892

The package muhammara before 2.6.1, from 3.0.0 and before 3.1.1; all versions of package hummus are vulnerable to Denial of Service (DoS) when supplied with a maliciously crafted PDF file to be parse…

CVSS: 7.5CWE: N/A

2022-10-31

High

CVE-2022-31690

Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attac…

CVSS: 8.1CWE: N/A

2022-10-28

High

CVE-2022-43284

Nginx NJS v0.7.2 to v0.7.4 was discovered to contain a segmentation violation via njs_scope_valid_value at njs_scope.h. NOTE: the vendor disputes the significance of this report because NJS does not…

CVSS: 7.5CWE: N/A

Medium

CVE-2022-3402

The Log HTTP Requests plugin for WordPress is vulnerable to Stored Cross-Site Scripting via logged HTTP requests in versions up to, and including, 1.3.1 due to insufficient input sanitization and out…

CVSS: 6.1CWE: N/A

High

CVE-2022-3401

The Bricks theme for WordPress is vulnerable to remote code execution due to the theme allowing site editors to include executable code blocks in website content in versions 1.2 to 1.5.3. This, combi…

CVSS: 8.8CWE: N/A

High

CVE-2022-2864

The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the ~/includes/settings.p…

CVSS: 8.8CWE: N/A

2022-10-27

High

CVE-2022-43366

IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to access sensitive information via the checkLoginUser, ate, telnet, version, setDebugCfg, and boot interfaces.

CVSS: 7.5CWE: N/A

High

CVE-2022-43364

An access control issue in the password reset page of IP-COM EW9 V15.11.0.14(9732) allows unauthenticated attackers to arbitrarily change the admin password.

CVSS: 7.5CWE: N/A

2022-10-26

Critical

CVE-2022-3363

Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7.

CVSS: 9.8CWE: CWE-840

High

CVE-2022-43747

baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution. This is fixed in security update S-2022-01, which contains fixed bMA setu…

CVSS: 7.5CWE: N/A

2022-10-25

Medium

CVE-2022-33180

A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out sensitive files with “seccryptocfg”, “conf…

CVSS: 5.5CWE: N/A

High

CVE-2022-33179

A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user to break out of restricted shells with “set context” and es…

CVSS: 8.8CWE: N/A

Medium

CVE-2022-3097

The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. This could allow attackers to disable the…

CVSS: 6.5CWE: N/A

2022-10-24

Medium

CVE-2022-43677

In free5GC 3.2.1, a malformed NGAP message can crash the AMF and NGAP decoders via an index-out-of-range panic in aper.GetBitString.

CVSS: 5.5CWE: N/A

High

CVE-2022-41986

Information disclosure vulnerability in Android App 'IIJ SmartKey' versions prior to 2.1.4 allows an attacker to obtain a one-time password issued by the product under certain conditions.

CVSS: 7.5CWE: N/A

Medium

CVE-2022-41799

Improper access control vulnerability in GROWI prior to v5.1.4 (v5 series) and versions prior to v4.5.25 (v4 series) allows a remote authenticated attacker to bypass access restriction and download t…

CVSS: 6.5CWE: N/A

2022-10-21

High

CVE-2022-38104

Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions – Multiple Accordions or FAQs Builder plugin…

CVSS: 7.2CWE: CWE-264

2022-10-19

Critical

CVE-2022-43406

A sandbox bypass vulnerability in Jenkins Pipeline: Deprecated Groovy Libraries Plugin 583.vf3b_454e43966 and earlier allows attackers with permission to define untrusted Pipeline libraries and to de…

CVSS: 9.9CWE: N/A

Critical

CVE-2022-43405

A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Libraries Plugin 612.v84da_9c54906d and earlier allows attackers with permission to define untrusted Pipeline libraries and to define and ru…

CVSS: 9.9CWE: N/A

Critical

CVE-2022-43404

A sandbox bypass vulnerability involving crafted constructor bodies and calls to sandbox-generated synthetic constructors in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows a…

CVSS: 9.9CWE: N/A

Critical

CVE-2022-43403

A sandbox bypass vulnerability involving casting an array-like value to an array type in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with permission to define a…

CVSS: 9.9CWE: N/A

Critical

CVE-2022-43402

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Pipeline: Groovy Plugin 2802.v5ea_628154b_c2 and earlier allows attackers with pe…

CVSS: 9.9CWE: N/A

Critical

CVE-2022-43401

A sandbox bypass vulnerability involving various casts performed implicitly by the Groovy language runtime in Jenkins Script Security Plugin 1183.v774b_0b_0a_a_451 and earlier allows attackers with p…

CVSS: 9.9CWE: N/A

2022-10-18

Critical

CVE-2022-39428

Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). Supported versions that are affected are 12.2.3-12.2.11. Easily exploitable vul…

CVSS: 9.8CWE: N/A

High

CVE-2022-39427

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Easily exploitable vulnerability allows low pri…

CVSS: 8.8CWE: N/A

Medium

CVE-2022-39423

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.38. Easily exploitable vulnerability allows high pr…

CVSS: 6.0CWE: N/A

Medium

CVE-2022-39420

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Data, Functional Security). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitab…

CVSS: 5.4CWE: N/A

Medium

CVE-2022-39419

Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows low privileged attacker having Create P…

CVSS: 4.3CWE: N/A

Medium

CVE-2022-39417

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker wi…

CVSS: 5.5CWE: N/A

Medium

CVE-2022-39411

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: Business Process Automation). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploit…

CVSS: 4.9CWE: N/A

Medium

CVE-2022-39410

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privil…

CVSS: 6.5CWE: N/A

Low

CVE-2022-39409

CVSS: 2.7CWE: N/A

Medium

CVE-2022-39408

CVSS: 6.5CWE: N/A

Medium

CVE-2022-39407

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security). Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerabili…

CVSS: 5.5CWE: N/A

Medium

CVE-2022-39404

Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General). Supported versions that are affected are 1.6.3 and prior. Difficult to exploit vulnerability allows low p…

CVSS: 4.2CWE: N/A

Low

CVE-2022-39403

Vulnerability in the MySQL Shell product of Oracle MySQL (component: Shell: Core Client). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows low privil…

CVSS: 3.9CWE: N/A

Medium

CVE-2022-39402

CVSS: 4.3CWE: N/A

Medium

CVE-2022-39401

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). The supported version that is affected is 11. Easily exploitable vulnerability allows low privileged attacker with l…

CVSS: 5.5CWE: N/A

Medium

CVE-2022-39400

CVSS: 4.9CWE: N/A

Low

CVE-2022-39399

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). Supported versions that are affected are Oracle Java SE: 11.0.16.1, 17.0.4.1,…

CVSS: 3.7CWE: N/A

Medium

CVE-2022-21641

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privi…

CVSS: 4.9CWE: N/A

Medium

CVE-2022-21640

CVSS: 4.9CWE: N/A

Medium

CVE-2022-21638

CVSS: 4.9CWE: N/A

Medium

CVE-2022-21637

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high privileged attac…

CVSS: 4.9CWE: N/A

Medium

CVE-2022-21636

Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Session Management). Supported versions that are affected are 12.2.6-12.2.11. Easily exploitable vuln…

CVSS: 6.5CWE: N/A

Medium

CVE-2022-21635

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.29 and prior. Easily exploitable vulnerability allows high privileged attac…

CVSS: 6.5CWE: N/A

High

CVE-2022-21634

Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: LLVM Interpreter). Supported versions that are affected are Oracle GraalVM Enterprise Edition: 20.3.7, 21.…

CVSS: 7.5CWE: N/A

Medium

CVE-2022-21633

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows high pri…

CVSS: 4.9CWE: N/A

Medium

CVE-2022-21632

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows…

CVSS: 4.9CWE: N/A

Medium

CVE-2022-21630

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are 9.2.6.4 and prior. Easily exploitable vulnerabi…

CVSS: 6.1CWE: N/A

Medium

CVE-2022-21629

CVSS: 5.4CWE: N/A

Medium

CVE-2022-21628

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Lightweight HTTP Server). Supported versions that are affected are Oracle Java SE: 8u341,…

CVSS: 5.3CWE: N/A

Medium

CVE-2022-21627

CVSS: 4.4CWE: N/A

Medium

CVE-2022-21626

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.…

CVSS: 5.3CWE: N/A

Medium

CVE-2022-21625

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.30 and prior. Difficult to exploit vulnerability allows high pri…

CVSS: 4.4CWE: N/A

Low

CVE-2022-21624

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JNDI). Supported versions that are affected are Oracle Java SE: 8u341, 8u345-perf, 11.0.16…

CVSS: 3.7CWE: N/A

High

CVE-2022-21623

Vulnerability in the Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Config Console). Supported versions that are affected are 13.4.0.0 and 13.5.0.0. Eas…

CVSS: 7.5CWE: N/A

High

CVE-2022-21622

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: Adapters). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability a…

CVSS: 7.5CWE: N/A

Medium

CVE-2022-21621

CVSS: 6.0CWE: N/A

High

CVE-2022-21620

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are Prior to 6.1.40. Difficult to exploit vulnerability allows high…

CVSS: 7.5CWE: N/A

Low

CVE-2022-21619

CVSS: 3.7CWE: N/A

Medium

CVE-2022-21618

Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JGSS). Supported versions that are affected are Oracle Java SE: 17.0.4.1, 19; Oracle Graal…

CVSS: 5.3CWE: N/A

Medium

CVE-2022-21617

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). Supported versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable…

CVSS: 4.9CWE: N/A

Medium

CVE-2022-21616

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0. Difficult t…

CVSS: 5.2CWE: N/A

High

CVE-2022-21615

Vulnerability in the Oracle Enterprise Data Quality product of Oracle Fusion Middleware (component: Dashboard). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable…

CVSS: 7.4CWE: N/A

High

CVE-2022-21614

CVSS: 7.5CWE: N/A

High

CVE-2022-21613

CVSS: 8.8CWE: N/A

High

CVE-2022-21612

CVSS: 8.1CWE: N/A

Medium

CVE-2022-21611

Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.30 and prior. Difficult to exploit vulnerability allows high privileged att…

CVSS: 4.1CWE: N/A

Low

CVE-2022-21610

Vulnerability in the Oracle Solaris product of Oracle Systems (component: LDoms). The supported version that is affected is 11. Difficult to exploit vulnerability allows low privileged attacker with…

CVSS: 3.3CWE: N/A

Medium

CVE-2022-21609

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Server). The supported version that is affected is 5.9.0.0. Easily explo…

CVSS: 5.7CWE: N/A

Medium

CVE-2022-21608

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 5.7.39 and prior and 8.0.30 and prior. Easily exploitable vulnerabil…

CVSS: 4.9CWE: N/A

Medium

CVE-2022-21607

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high privi…

CVSS: 4.9CWE: N/A

Medium

CVE-2022-21605

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Data Dictionary). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vulnerability allows high…

CVSS: 4.9CWE: N/A

Medium

CVE-2022-21604

CVSS: 4.9CWE: N/A

High

CVE-2022-21603

Vulnerability in the Oracle Database - Sharding component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allows high privileged atta…

CVSS: 7.2CWE: N/A

Medium

CVE-2022-21602

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal). Supported versions that are affected are 8.58, 8.59 and 8.60. Easily exploitable vulnerability…

CVSS: 5.3CWE: N/A

Medium

CVE-2022-21601

Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Supported versions that are affected are 12.0.…

CVSS: 6.5CWE: N/A

High

CVE-2022-21600

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.27 and prior. Easily exploitable vulnerability allows high privi…

CVSS: 7.2CWE: N/A

Medium

CVE-2022-21599

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure). Supported versions that are affected are 8.0.30 and prior. Easily exploitable vulnerability allows hig…

CVSS: 4.9CWE: N/A

High

CVE-2022-21598

Vulnerability in the Siebel Core - DB Deployment and Configuration product of Oracle Siebel CRM (component: Repository Utilities). Supported versions that are affected are 22.8 and prior. Easily expl…

CVSS: 7.5CWE: N/A

Medium

CVE-2022-21597

Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaScript). Supported versions that are affected are Oracle GraalVM Enterprise Edition: 20.3.7, 21.3.3 an…

CVSS: 5.3CWE: N/A

High

CVE-2022-21596

Vulnerability in the Oracle Database - Advanced Queuing component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows high privileged att…

CVSS: 7.2CWE: N/A

Medium

CVE-2022-21595

Vulnerability in the MySQL Server product of Oracle MySQL (component: C API). Supported versions that are affected are 5.7.36 and prior and 8.0.27 and prior. Difficult to exploit vulnerability allows…

CVSS: 4.4CWE: N/A

Medium

CVE-2022-21594

CVSS: 4.9CWE: N/A

High

CVE-2022-21593

Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: OHS Config MBeans). Supported versions that are affected are 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vuln…

CVSS: 7.1CWE: N/A

Medium

CVE-2022-21592

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). Supported versions that are affected are 5.7.39 and prior and 8.0.29 and prior. Easily exploitable…

CVSS: 4.3CWE: N/A

Medium

CVE-2022-21591

Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure). Supported versions that are affected are 6.4.3 and 6.5.1. Easily exploitable vulne…

CVSS: 5.4CWE: N/A

High

CVE-2022-21590

Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Core Formatting API). Supported versions that are affected are 5.9.0.0, 6.4.0.0.0, 12.2.1.3.0 and 12.2.1.4.0.…

CVSS: 7.6CWE: N/A

Medium

CVE-2022-21589

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected are 5.7.39 and prior and 8.0.16 and prior. Easily exploitable…

CVSS: 4.3CWE: N/A

2022-10-17

High

CVE-2022-42142

Online Tours & Travels Management System v1.0 is vulnerable to Arbitrary code execution via ip/tour/admin/operations/update_settings.php.

CVSS: 7.2CWE: N/A

Medium

CVE-2022-3421

An attacker can pre-create the `/Applications/Google\ Drive.app/Contents/MacOS` directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is…

CVSS: 5.6CWE: CWE-264

High

CVE-2022-42221

Netgear R6220 v1.1.0.114_1.0.1 suffers from Incorrect Access Control, resulting in a command injection vulnerability.

CVSS: 8.8CWE: N/A

Medium

CVE-2022-3351

An issue has been discovered in GitLab EE affecting all versions starting from 13.7 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A user…

CVSS: 4.3CWE: N/A

Medium

CVE-2022-3330

It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions from 15.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1.

CVSS: 4.3CWE: N/A

Medium

CVE-2022-41471

74cmsSE v3.12.0 allows authenticated attackers with low-level privileges to arbitrarily change the rights and credentials of the Super Administrator account.

CVSS: 6.5CWE: N/A

High

CVE-2022-3150

The WP Custom Cursors WordPress plugin before 3.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privileged users…

CVSS: 7.2CWE: N/A

2022-10-14

High

CVE-2022-3479

A vulnerability found in nss. By this security vulnerability, nss client auth crash without a user certificate in the database and this can lead us to a segmentation fault or crash.

CVSS: 7.5CWE: N/A

High

CVE-2022-41715

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but…

CVSS: 7.5CWE: N/A

High

CVE-2022-28762

Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with 5.10.6 and prior to 5.12.0 contains a debugging port misconfiguration. When camera mode rendering context is enabled as pa…

CVSS: 7.3CWE: CWE-16

2022-10-11

Critical

CVE-2022-42042

The d8s-networking package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hashes package. The affected vers…

CVSS: 9.8CWE: N/A

Critical

CVE-2022-42041

The d8s-file-system package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hashes package. The affected ver…

CVSS: 9.8CWE: N/A

Medium

CVE-2022-31682

VMware Aria Operations contains an arbitrary file read vulnerability. A malicious actor with administrative privileges may be able to read arbitrary files containing sensitive data.

CVSS: 4.9CWE: N/A

Medium

CVE-2022-20440

In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242259918

CVSS: 5.5CWE: N/A

Medium

CVE-2022-20439

In Messaging, There has unauthorized provider, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242266172

CVSS: 5.5CWE: N/A

Medium

CVE-2022-20438

In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242259920

CVSS: 5.5CWE: N/A

Medium

CVE-2022-20437

In Messaging, There has unauthorized broadcast, this could cause Local Deny of Service.Product: AndroidVersions: Android SoCAndroid ID: A-242258929

CVSS: 5.5CWE: N/A

High

CVE-2022-20429

In CarSettings of app packages, there is a possible permission bypass due to a confused deputy. This could lead to local escalation of privilege in Bluetooth settings with no additional execution pri…

CVSS: 8.8CWE: N/A