CVE-2022-43xxx records

Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.

729 records · Page 2 of 8

• CVE-2022-43851: IBM Aspera Console information disclosure 5.9 Medium

  IBM Aspera Console 3.4.0 through 3.4.4 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

  Updated 2025-08-15
• CVE-2022-43850: IBM Aspera Console cross-site scripting 5.4 Medium

  IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

  Updated 2025-08-15
• CVE-2022-43849: IBM AIX denial of service 6.2 Medium

  IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1could allow a non-privileged local user to exploit a vulnerability in the AIX pfcdd kernel extension to cause a denial of service. IBM X-Force ID: 239170.

  Updated 2025-04-15
• CVE-2022-43848: IBM AIX denial of service 6.2 Medium

  IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the AIX perfstat kernel extension to cause a denial of service. IBM X-Force ID: 239169.

  Updated 2025-04-15
• CVE-2022-43847: IBM Aspera Console HTTP header injection 5.4 Medium

  IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning or session hijacking.

  Updated 2025-08-15
• CVE-2022-43845: IBM Aspera Console information disclosure 3.7 Low

  IBM Aspera Console 3.4.0 through 3.4.4 could allow a remote attacker to obtain sensitive information, caused by the failure to set the HTTPOnly flag. A remote attacker could exploit this vulnerability to obtain sensitive information from the cookie.

  Updated 2024-09-24
• CVE-2022-43844: IBM Robotic Process Automation for Cloud Pak session fixation 8.8 High

  IBM Robotic Process Automation for Cloud Pak 20.12 through 21.0.3 is vulnerable to broken access control. A user is not correctly redirected to the platform log out screen when logging out of IBM RPA for Cloud Pak. IBM X-Force ID: 239081.

  Updated 2025-04-10
• CVE-2022-43843: IBM Spectrum Scale information disclosure 5.9 Medium

  IBM Spectrum Scale 5.1.5.0 through 5.1.5.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 239080.

  Updated 2024-08-03
• CVE-2022-43842: IBM Aspera Console SQL injection 8.6 High

  IBM Aspera Console 3.4.0 through 3.4.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 239079.

  Updated 2024-08-03
• CVE-2022-43841: IBM Aspera Console information disclosure 4.0 Medium

  IBM Aspera Console 3.4.0 through 3.4.2 PL9 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 239078.

  Updated 2024-08-03
• CVE-2022-43840: IBM Aspera Console XPath injection 4.3 Medium

  IBM Aspera Console 3.4.0 through 3.4.4 is vulnerable to an XPath injection vulnerability, which could allow an authenticated attacker to exfiltrate sensitive application data and/or determine the structure of the XML document.

  Updated 2025-08-15
• CVE-2022-43831: IBM Spectrum Scale privilege escalation 7.4 High

  IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.6.1 could allow a local user to obtain escalated privileges on a host without proper security context settings configured. IBM X-Force ID: 238941.

  Updated 2024-10-18
• CVE-2022-43830: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43829: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43828: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43827: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43826: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43825: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43824: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43823: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43822: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43821: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43820: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43819: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43818: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43817: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43816: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43815: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43814: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43813: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43812: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43811: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43810: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43809: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43808: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43807: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43806: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43805: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43804: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43803: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43802: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43801: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43800: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43799: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43798: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43797: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43796: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43795: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43794: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43793: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43792: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43791: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43790: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43789: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43788: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43787: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43786: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43785: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43784: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43783: To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used. Rejected

  To maintain compliance with CNA rules, we have rejected this CVE record because it has not been used.

  Updated 2023-11-15 · Rejected record
• CVE-2022-43782: Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in 9.8 Critical

  Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call privileged endpoints in Crowd's REST API under the {{usermanagement}} path. This vulnerability can only be exploited by IPs specified under the crowd application allowlist in the Remote Addresses configuration, which is {{none}} by default.

  Updated 2024-10-02
• CVE-2022-43781: There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this i 9.8 Critical

  There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerability can be unauthenticated if the Bitbucket Server and Data Center instance has enabled “Allow public signup”.

  Updated 2024-10-02
• CVE-2022-43780: Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack. 7.5 High

  Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack.

  Updated 2025-04-30
• CVE-2022-43779: A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary code 7.0 High

  A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in certain HP PC products using AMI UEFI Firmware (system BIOS) which might allow arbitrary code execution, denial of service, and information disclosure. AMI has released updates to mitigate the potential vulnerability.

  Updated 2025-03-25
• CVE-2022-43778: Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of s 7.8 High

  Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.

  Updated 2025-01-06
• CVE-2022-43777: Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of s 7.8 High

  Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.

  Updated 2025-01-06
• CVE-2022-43776: The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be cir 6.5 Medium

  The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks. Previously implemented blacklists could be circumvented by leveraging 301 and 302 redirects.

  Updated 2025-05-07
• CVE-2022-43775: The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. 9.8 Critical

  The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system.

  Updated 2025-05-07
• CVE-2022-43774: The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. 9.8 Critical

  The HandlerPageP_KID class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system.

  Updated 2025-05-07
• CVE-2022-43773: Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource 8.8 High

  Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is installed with a sample HSQLDB data source configured with stored procedures enabled. 

  Updated 2025-02-11
• CVE-2022-43772: Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File 3.8 Low

  Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x with the Big Data Plugin expose the username and password of clusters in clear text into system logs. 

  Updated 2025-02-11
• CVE-2022-43771: Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 6.5 Medium

  Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.0 and 9.3.0.1, including 8.3.x, using the Pentaho Data Access plugin exposes a service endpoint for CSV import which allows a user supplied path to access resources that are out of bounds.  

  Updated 2025-02-11
• CVE-2022-43770: Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization 5.4 Medium

  Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashboard editor plugin API.   

  Updated 2025-02-07
• CVE-2022-43769: Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) 8.8 High

  Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.

  Updated 2025-10-21
• CVE-2022-43768: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions < V3.4.29), SIMATIC 7.5 High

  A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) (All versions < V3.4.29), SIMATIC CP

  Updated 2025-02-07
• CVE-2022-43767: A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions < V3.4.29), SIMATIC 7.5 High

  A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 DNP3 (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-1 IEC (incl. SIPLUS variants) (All versions < V3.4.29), SIMATIC CP 1243-7 LTE EU (6GK7243-7KX30-0XE0) (All versions < V3.4.29), SIMATIC CP

  Updated 2024-09-10
• CVE-2022-43766: Apache IoTDB prior to 0.13.3 allows DoS 7.5 High

  Apache IoTDB version 0.12.2 to 0.12.6, 0.13.0 to 0.13.2 are vulnerable to a Denial of Service attack when accepting untrusted patterns for REGEXP queries with Java 8. Users should upgrade to 0.13.3 which addresses this issue or use a later version of Java to avoid it.

  Updated 2025-05-07
• CVE-2022-43765: DoS in APROLs Tbase server 7.5 High

  B&R APROL versions < R 4.2-07 doesn’t process correctly specially formatted data packages sent to port 55502/tcp, which may allow a network based attacker to cause an application Denial-of-Service.

  Updated 2025-03-25
• CVE-2022-43764: Buffer overflow when changing configuration on Tbase Server 9.8 Critical

  Insufficient validation of input parameters when changing configuration on Tbase server in B&R APROL versions < R 4.2-07 could result in buffer overflow. This may lead to Denial-of-Service conditions or execution of arbitrary code.

  Updated 2025-03-25
• CVE-2022-43763: Lack of checking preconditions in APROL 7.5 High

  Insufficient check of preconditions could lead to Denial of Service conditions when calling commands on the Tbase server of B&R APROL versions < R 4.2-07.

  Updated 2025-03-25
• CVE-2022-43762: Memory leak when receiving messages in APROL Tbase server 7.5 High

   Lack of verification in B&R APROL Tbase server versions < R 4.2-07 may lead to memory leaks when receiving messages

  Updated 2025-03-25
• CVE-2022-43761: Lack of authentication when managing APROL database 9.4 Critical

  Missing authentication when creating and managing the B&R APROL database in versions < R 4.2-07 allows reading and changing the system configuration. 

  Updated 2025-03-25
• CVE-2022-43760: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject cod 8.4 High

  An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SUSE Rancher allows users in some higher-privileged groups to to inject code that is executed within another user's browser, allowing the attacker to steal sensitive information, manipulate web content, or perform other malicious activities on behalf of the victims. This could result in a u

  Updated 2025-01-09
• CVE-2022-43759: Rancher: Privilege escalation via promoted roles 7.2 High

  A Improper Privilege Management vulnerability in SUSE Rancher, allows users with access to the escalate verb on PRTBs to escalate permissions for any -promoted resource in any cluster. This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10.

  Updated 2025-03-25
• CVE-2022-43758: Rancher: Command injection in Git package 7.6 High

  A Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SUSE Rancher allows code execution for user with the ability to add an untrusted Helm catalog or modifying the URL configuration used to download KDM (only admin users by default) This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher v

  Updated 2025-03-25
• CVE-2022-43757: Rancher: Exposure of sensitive fields 9.9 Critical

  A Cleartext Storage of Sensitive Information vulnerability in SUSE Rancher allows users on managed clusters to gain access to credentials. The impact depends on the credentials exposed This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

  Updated 2025-03-25
• CVE-2022-43756: Rancher/Wrangler: Denial of service when processing Git credentials 5.9 Medium

  A Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in SUSE Rancher allows remote attackers to cause denial of service by supplying specially crafted git credentials. This issue affects: SUSE Rancher wrangler version 0.7.3 and prior versions; wrangler version 0.8.4 and prior versions; wrangler version 1.0.0 and prior versions.

  Updated 2025-03-25
• CVE-2022-43755: Rancher: Non-random authentication token 7.1 High

  A Insufficient Entropy vulnerability in SUSE Rancher allows attackers that gained knowledge of the cattle-token to continue abusing this even after the token was renewed. This issue affects: SUSE Rancher Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.

  Updated 2025-03-25
• CVE-2022-43754: SUMA/UYUNI reflected cross site scripting in /rhn/audit/scap/Search.do 2.6 Low

  An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to embed Javascript code via /rhn/audit/scap/Search.do This issue affects: SUSE Linux Enterprise Module for SUSE

  Updated 2025-04-30
• CVE-2022-43753: SUMA/UYUNI arbitrary file disclosure vulnerability in ScapResultDownload 4.3 Medium

  A Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in spacewalk/Uyuni of SUSE Linux Enterprise Module for SUSE Manager Server 4.2, SUSE Linux Enterprise Module for SUSE Manager Server 4.3, SUSE Manager Server 4.2 allows remote attackers to read files available to the user running the process, typically tomcat. This issue affects: SUSE Linux Enterprise Mo

  Updated 2025-04-30
• CVE-2022-43752: Oracle Solaris version 10 1/13, when using the Common Desktop Environment (CDE), is vulnerable to a privilege escalation vulnerability. A low privileged user can escalate to root b 7.8 High

  Oracle Solaris version 10 1/13, when using the Common Desktop Environment (CDE), is vulnerable to a privilege escalation vulnerability. A low privileged user can escalate to root by crafting a malicious printer and double clicking on the the crafted printer's icon.

  Updated 2025-05-06
• CVE-2022-43751: McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectory that may be cont 7.8 High

  McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectory that may be controllable by an unprivileged user. This may have allowed the unprivileged user to execute arbitrary code with system privileges.

  Updated 2025-04-29
• CVE-2022-43750: drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory. 6.7 Medium

  drivers/usb/mon/mon_bin.c in usbmon in the Linux kernel before 5.19.15 and 6.x before 6.0.1 allows a user-space client to corrupt the monitor's internal memory.

  Updated 2026-10-14
• CVE-2022-43749: Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security const 4.3 Medium

  Improper privilege management vulnerability in summary report management in Synology Presto File Server before 2.1.2-1601 allows remote authenticated users to bypass security constraint via unspecified vectors.

  Updated 2025-05-09
• CVE-2022-43748: Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows re 5.8 Medium

  Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in file operation management in Synology Presto File Server before 2.1.2-1601 allows remote attackers to write arbitrary files via unspecified vectors.

  Updated 2025-04-25
• CVE-2022-43747: baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution. This is fixed in security update S-2022-01, which cont 7.5 High

  baramundi Management Agent (bMA) in baramundi Management Suite (bMS) 2021 R1 and R2 and 2022 R1 allows remote code execution. This is fixed in security update S-2022-01, which contains fixed bMA setup files for these versions. This also is fixed in baramundi Management Suite 2022 R2.

  Updated 2024-08-22
• CVE-2022-43740: IBM Security Verify Access denial of service 7.5 High

  IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238921.

  Updated 2024-09-16
• CVE-2022-43724: A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inbuilt SQL server in cleartext. In combina 9.8 Critical

  A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software transmits the database credentials for the inbuilt SQL server in cleartext. In combination with the by default enabled xp_cmdshell feature unauthenticated remote attackers could execute custom OS commands. At the time of assigning the CVE, the affected firmware version of the component has already been su

  Updated 2025-04-22
• CVE-2022-43723: A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software does not properly validate the input for 7.5 High

  A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0), SICAM PAS/PQS (All versions >= 7.0 < V8.06). Affected software does not properly validate the input for a certain parameter in the s7ontcp.dll. This could allow an unauthenticated remote attacker to send messages and create a denial of service condition as the application crashes. At the time of assigning the CVE, the affe

  Updated 2025-04-22
• CVE-2022-43722: A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing library files. This could allow an attack 7.8 High

  A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing library files. This could allow an attacker to place a custom malicious DLL in this folder which is then run with SYSTEM rights when a service is started that requires this DLL. At the time of assigning the CVE, the affected firmware version of the component ha

  Updated 2025-04-22

Search a CVE ID or check dependency files →