CVE Schwachstellen
CVE-Datenbank angereichert mit CISA KEV und NVD Daten
| CVE ID | CVSS | Schweregrad | KEV | Sichtungen |
|---|---|---|---|---|
| CVE-2022-38709 IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt... | 6.1 | MEDIUM | — | 0 |
| CVE-2022-31252 A Incorrect Authorization vulnerability in chkstat of SUSE Linux Enterprise Server 12-SP5; openSUSE Leap 15.3, openSUSE Leap 15.4, openSUSE Leap Micro 5.2 did not consider group writable path componen... | 4.4 | MEDIUM | — | 0 |
| CVE-2022-32171 In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete user functionality. When an authenticated user deletes a user having a XSS payload in the us... | N/A | NONE | — | 0 |
| CVE-2022-32172 In Zinc, versions v0.1.9 through v0.3.1 are vulnerable to Stored Cross-Site Scripting when using the delete template functionality. When an authenticated user deletes a template with a XSS payload in ... | N/A | NONE | — | 0 |
| CVE-2022-36774 IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxy configuration. IBM X-Force ID: 233575. | 5.3 | MEDIUM | — | 0 |
| CVE-2022-37888 There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Netw... | 9.8 | CRITICAL | — | 0 |
| CVE-2022-39222 Dex is an identity service that uses OpenID Connect to drive authentication for other apps. Dex instances with public clients (and by extension, clients accepting tokens issued by those Dex instances)... | 9.3 | CRITICAL | — | 0 |
| CVE-2022-39237 syslabs/sif is the Singularity Image Format (SIF) reference implementation. In versions prior to 2.8.1the `github.com/sylabs/sif/v2/pkg/integrity` package did not verify that the hash algorithm(s) use... | 6.3 | MEDIUM | — | 0 |
| CVE-2022-39265 MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's opt... | 7.2 | HIGH | — | 0 |
| CVE-2022-39269 PJSIP is a free and open source multimedia communication library written in C. When processing certain packets, PJSIP may incorrectly switch from using SRTP media transport to using basic RTP upon SRT... | 9.1 | CRITICAL | — | 0 |
| CVE-2022-39270 DiscoTOC is a Discourse theme component that generates a table of contents for topics. Users that can create topics in TOC-enabled categories (and have sufficient trust level - configured in component... | 5.4 | MEDIUM | — | 0 |
| CVE-2022-39273 FlyteAdmin is the control plane for the data processing platform Flyte. Users who enable the default Flyte’s authorization server without changing the default clientid hashes will be exposed to the pu... | 4.8 | MEDIUM | — | 0 |
| CVE-2022-39274 LoRaMac-node is a reference implementation and documentation of a LoRa network node. Versions of LoRaMac-node prior to 4.7.0 are vulnerable to a buffer overflow. Improper size validation of the incomi... | 7.5 | HIGH | — | 0 |
| CVE-2022-39275 Saleor is a headless, GraphQL commerce platform. In affected versions some GraphQL mutations were not properly checking the ID type input which allowed to access database objects that the authenticate... | 5.3 | MEDIUM | — | 0 |
| CVE-2022-39280 dparse is a parser for Python dependency files. dparse in versions before 0.5.2 contain a regular expression that is vulnerable to a Regular Expression Denial of Service. All the users parsing index s... | 5.9 | MEDIUM | — | 0 |
| CVE-2022-39988 A cross-site scripting (XSS) vulnerability in Centreon 22.04.0 allows attackers to execute arbitrary web script or HTML via a crafted payload injected into the Service>Templates service_alias paramete... | 5.4 | MEDIUM | — | 0 |
| CVE-2022-3002 Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. | 5.4 | MEDIUM | — | 0 |
| CVE-2022-3273 Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-3376 Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. | 5.3 | MEDIUM | — | 0 |
| CVE-2022-3389 Path Traversal in GitHub repository ikus060/rdiffweb prior to 2.4.10. | 7.5 | HIGH | — | 0 |
| CVE-2022-3396 OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. | 7.8 | HIGH | — | 0 |
| CVE-2022-3397 OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. | 7.8 | HIGH | — | 0 |
| CVE-2022-3398 OMRON CX-Programmer 9.78 and prior is vulnerable to an Out-of-Bounds Write, which may allow an attacker to execute arbitrary code. | 7.8 | HIGH | — | 0 |
| CVE-2022-40160 ** DISPUTED ** This record was originally reported by the oss-fuzz project who failed to consider the security context in which JXPath is intended to be used and failed to contact the JXPath maintaine... | 6.5 | MEDIUM | — | 0 |
| CVE-2022-40895 In certain Nedi products, a vulnerability in the web UI of NeDi login & Community login could allow an unauthenticated, remote attacker to affect the integrity of a device via a User Enumeration vulne... | 9.1 | CRITICAL | — | 0 |
| CVE-2022-41294 IBM Robotic Process Automation 21.0.0, 21.0.1, 21.0.2, 21.0.3, and 21.0.4 is vulnerable to cross origin resource sharing using the bot api. IBM X-Force ID: 236807. | 6.5 | MEDIUM | — | 0 |
| CVE-2022-41517 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a stack overflow in the lang parameter in the setLanguageCfg function | 8.8 | HIGH | — | 0 |
| CVE-2022-41518 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-41520 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the File parameter in the UploadCustomModule function. | 8.8 | HIGH | — | 0 |
| CVE-2022-41521 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the sPort/ePort parameter in the setIpPortFilterRules function. | 8.8 | HIGH | — | 0 |
| CVE-2022-41556 A resource leak in gw_backend.c in lighttpd 1.4.56 through 1.4.66 could lead to a denial of service (connection-slot exhaustion) after a large amount of anomalous TCP behavior by clients. It is relate... | 7.5 | HIGH | — | 0 |
| CVE-2022-41853 Those using java.sql.Statement or java.sql.PreparedStatement in hsqldb (HyperSQL DataBase) to process untrusted input may be vulnerable to a remote code execution attack. By default it is allowed to c... | 8.0 | HIGH | — | 0 |
| CVE-2022-42241 Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_message. | 7.2 | HIGH | — | 0 |
| CVE-2022-42242 Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/classes/Master.php?f=delete_booking. | 7.2 | HIGH | — | 0 |
| CVE-2022-42243 Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/manage_storage.php?id=. | 7.2 | HIGH | — | 0 |
| CVE-2022-39878 Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadcast. | 4.0 | MEDIUM | — | 0 |
| CVE-2022-42249 Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/storages/view_storage.php?id=. | 7.2 | HIGH | — | 0 |
| CVE-2022-42250 Simple Cold Storage Management System v1.0 is vulnerable to SQL injection via /csms/admin/inquiries/view_details.php?id=. | 7.2 | HIGH | — | 0 |
| CVE-2022-42457 Generex CS141 through 2.10 allows remote command execution by administrators via a web interface that reaches run_update in /usr/bin/gxserve-update.sh (e.g., command execution can occur via a reverse ... | 9.1 | CRITICAL | — | 0 |
| CVE-2022-41522 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an unauthenticated stack overflow via the "main" function. | 9.8 | CRITICAL | — | 0 |
| CVE-2022-41523 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the command parameter in the setTracerouteCfg function. | 8.8 | HIGH | — | 0 |
| CVE-2022-41524 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the week, sTime, and eTime parameters in the setParentalRules function. | 8.8 | HIGH | — | 0 |
| CVE-2022-41525 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the OpModeCfg function at /cgi-bin/cstecgi.cgi. | 9.8 | CRITICAL | — | 0 |
| CVE-2023-21787 3D Builder Remote Code Execution Vulnerability | 7.8 | HIGH | — | 0 |
| CVE-2022-41526 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the ip parameter in the setDiagnosisCfg function. | 8.8 | HIGH | — | 0 |
| CVE-2022-41527 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the pppoeUser parameter in the setOpModeCfg function. | 8.8 | HIGH | — | 0 |
| CVE-2022-41528 TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain an authenticated stack overflow via the text parameter in the setSmsCfg function. | 8.8 | HIGH | — | 0 |
| CVE-2022-27810 It was possible to trigger an infinite recursion condition in the error handler when Hermes executed specific maliciously formed JavaScript. This condition was only possible to trigger in dev-mode (wh... | 7.5 | HIGH | — | 0 |
| CVE-2022-39279 discourse-chat is a plugin for the Discourse message board which adds chat functionality. In versions prior to 0.9 some places render a chat channel's name and description in an unsafe way, allowing s... | 4.3 | MEDIUM | — | 0 |
| CVE-2022-39284 CodeIgniter is a PHP full-stack web framework. In versions prior to 4.2.7 setting `$secure` or `$httponly` value to `true` in `Config\Cookie` is not reflected in `set_cookie()` or `Response::setCookie... | 2.6 | LOW | — | 0 |
This product uses data from the NVD API but is not endorsed or certified by the NVD.