CVE-2022-47xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
514 records · Page 4 of 6
- CVE-2022-47399: Not used Rejected
Not used
Updated · Rejected record - CVE-2022-47398: Not used Rejected
Not used
Updated · Rejected record - CVE-2022-47397: Not used Rejected
Not used
Updated · Rejected record - CVE-2022-47396: Not used Rejected
Not used
Updated · Rejected record - CVE-2022-47395: CVE-2022-47395 8.1 High
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operations and cause a denial-of-service condition.
Updated - CVE-2022-47393: CODESYS: Multiple products prone to improperly restricted memory operations 6.5 Medium
An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.
Updated An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition.
UpdatedIn multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.
UpdatedAn authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedAn authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
UpdatedMultiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.
UpdatedPassword recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system.
UpdatedThe Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data.
UpdatedA vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SI
UpdatedA vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SI
UpdatedReflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.
UpdatedStored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the stored XSS payload.
UpdatedIn bt driver, there is a thread competition leads to early release of resources to be accessed. This could lead to local denial of service in kernel.
UpdatedIn wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
UpdatedIn wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
UpdatedIn wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
UpdatedIn bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
UpdatedIn wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
UpdatedIn wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
UpdatedIn wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
UpdatedIn wlan driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service in wlan services.
UpdatedIn telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
UpdatedIn firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
UpdatedIn log service, there is a missing permission check. This could lead to local denial of service in log service.
UpdatedIn log service, there is a missing permission check. This could lead to local denial of service in log service.
UpdatedIn log service, there is a missing permission check. This could lead to local denial of service in log service.
UpdatedIn log service, there is a missing permission check. This could lead to local denial of service in log service.
UpdatedIn log service, there is a missing permission check. This could lead to local denial of service in log service.
UpdatedIn log service, there is a missing permission check. This could lead to local denial of service in log service.
UpdatedIn log service, there is a missing permission check. This could lead to local denial of service in log service.
UpdatedIn vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of service with System execution privileges needed
UpdatedIn camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
UpdatedIn camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
UpdatedIn camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
UpdatedIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
UpdatedIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
UpdatedIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
UpdatedIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
UpdatedIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
UpdatedIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
UpdatedIn engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
UpdatedIn engineermode services, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
UpdatedIn h265 codec firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges.
UpdatedIn cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
UpdatedIn telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
UpdatedIn media service, there is a missing permission check. This could lead to local denial of service in media service.
UpdatedIn telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
UpdatedIn telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
UpdatedIn phasecheck server, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
UpdatedIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
UpdatedIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
UpdatedIn wlan driver, there is a race condition. This could lead to local denial of service in wlan services.
UpdatedIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
UpdatedIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
UpdatedIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
UpdatedIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
UpdatedIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
UpdatedIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
UpdatedIn wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
UpdatedIn wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
UpdatedIn wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Updated- CVE-2022-47320: CVE-2022-47320 8.1 High
The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.
Updated ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.
UpdatedOut-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.
Updated- CVE-2022-47311: CVE-2022-47311 8.5 High
A proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the username and password; it also contains the configuration data for the user specified. If the user does not exist, then it sends a value for username and password, which allows successful authentication for a connection.
Updated Microsoft Office Graphics Remote Code Execution Vulnerability
UpdatedMicrosoft Office Graphics Remote Code Execution Vulnerability
UpdatedMicrosoft Office Graphics Remote Code Execution Vulnerability
UpdatedThe default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device.
UpdatedA support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for this account is “support” and cannot be changed by a user via any normally accessible means.
UpdatedThe “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication.
UpdatedAn insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into
UpdatedAn insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into
UpdatedAn insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into
UpdatedAn insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into
UpdatedGenerex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password.
UpdatedGenerex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges.
UpdatedGenerex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root.
UpdatedGenerex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device.
UpdatedThere is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path.
UpdatedThere is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file.
UpdatedThere is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory.
UpdatedImproper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
Updated- CVE-2022-47184: Apache Traffic Server: The TRACE method can be use to disclose network information 7.5 High
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.
Updated Cross-Site Request Forgery (CSRF) vulnerability in StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin <= 0.2.6 versions.
Updated