CVE-2022-48xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
756 records · Page 5 of 8
A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
UpdatedA SQL injection vulnerability exists in the “reporting job editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
UpdatedA SQL injection vulnerability exists in the “schedule editor decoupled” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
UpdatedA SQL injection vulnerability exists in the “schedule editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
UpdatedA SQL injection vulnerability exists in the “json walker” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
UpdatedA SQL injection vulnerability exists in the “admin brand portal” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
UpdatedA command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
UpdatedA command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
UpdatedA command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
UpdatedA command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
UpdatedA command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
UpdatedUnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.
UpdatedAn out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5. Processing an AppleScript may result in unexpected termination or disclosure of process memory.
UpdatedAn access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.
UpdatedA person with access to a Mac may be able to bypass Login Window. A consistency issue was addressed with improved state handling. This issue is fixed in macOS Monterey 12.4.
Updated- CVE-2022-48571: memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP. Unscored
memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.
Updated Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was not 16-byte aligned. NOTE: this issue exists because the CVE-2019-14318 fix was intentionally removed for functionality reasons.
UpdatedAn issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
UpdatedAn XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
Updatedread_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
UpdatedA use-after-free exists in Python through 3.9 via heappushpop in heapq.
UpdatedFile before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.
UpdatedA reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php.
UpdatedAn infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.
UpdatedA memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command.
UpdatedIn Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password.
UpdatedIn Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
UpdatedAn issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when i
UpdatedUnauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.
UpdatedUnauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.
UpdatedVulnerability of signature verification in the iaware system being initialized later than the time when the system broadcasts are sent. Successful exploitation of this vulnerability may cause malicious apps to start upon power-on by spoofing the package names of apps in the startup trustlist, which affects system performance.
UpdatedUnauthorized service access vulnerability in the DSoftBus module. Successful exploitation of this vulnerability will affect availability.
UpdatedVulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerability will affect confidentiality.
UpdatedVulnerability of inappropriate permission control in Nearby. Successful exploitation of this vulnerability may affect service confidentiality.
UpdatedThe Sepolicy module has inappropriate permission control on the use of Netlink.Successful exploitation of this vulnerability may affect confidentiality.
UpdatedVulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-bounds access.
UpdatedUse After Free (UAF) vulnerability in the Vdecoderservice service. Successful exploitation of this vulnerability may cause the image decoding feature to perform abnormally.
UpdatedUse After Free (UAF) vulnerability in the audio PCM driver module under special conditions. Successful exploitation of this vulnerability may cause audio features to perform abnormally.
UpdatedInput verification vulnerability in the AMS module. Successful exploitation of this vulnerability will cause unauthorized operations.
UpdatedRace condition vulnerability due to multi-thread access to mutually exclusive resources in Huawei Share. Successful exploitation of this vulnerability may cause the program to exit abnormally.
UpdatedInappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity.
UpdatedVulnerability of identity verification being bypassed in the storage module. Successful exploitation of this vulnerability may affect service confidentiality.
UpdatedA flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios. This issue was observed for use of the following versions of Democracy Suite: 5.2, 5.4-NM, 5
UpdatedThis issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system
UpdatedThe issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.
UpdatedThe issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.
UpdatedAn issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
UpdatedVulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.
UpdatedVulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cause foreground app information to be obtained.
UpdatedVulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
UpdatedVulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead to ads and other windows to display at any time.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
UpdatedVulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause unauthorized modifications to the desktop.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
UpdatedConfiguration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
Updated3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory traversal in conjunction with a path component that has a drive letter and uses backslash characters. NOTE: this issue exists because of an incomplete fix for CVE-2022-28005.
Updated3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal. Files may have credentials, full backups, call recordings, and chat logs.
Updated- CVE-2022-48481: In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible 5.2 Medium
In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible
Updated Integer overflow vulnerability in some phones. Successful exploitation of this vulnerability may affect service confidentiality.
UpdatedThe facial recognition TA of some products has the out-of-bounds memory read vulnerability. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.
UpdatedThe facial recognition TA of some products lacks memory length verification. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.
UpdatedIn JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing
UpdatedIn JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible
UpdatedBuffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function. Sending a modified request by the attacker could cause a Buffer Overflow when the adminitrator tries to accept or delete the print query created by the request.
UpdatedControl de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Sending a malicious request could cause the server to check if an unrecognized component is up to date, causing a memory failure error that shuts down the process.
UpdatedThere is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
UpdatedA Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution. Affected product versions include:BiSheng-WNM versions OTA-BiSheng-FW-2.0.0.211-beta,BiSheng-WNM FW 3.0.0.325,BiSheng-WNM FW 2.0.0.211.
UpdatedThere is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
UpdatedHuawei HiLink AI Life product has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions.(Vulnerability ID:HWPSIRT-2022-42291) This vulnerability has been assigned a (CVE)ID:CVE-2022-48470
UpdatedThere is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers.
Updated- CVE-2022-48468: protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member. 5.5 Medium
protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
Updated In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
UpdatedIn wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
UpdatedIn wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
UpdatedIn sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
UpdatedIn setting service, there is a possible undefined behavior due to incorrect error handling. This could lead to local denial of service with no additional execution privileges needed
UpdatedIn TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
UpdatedIn TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
UpdatedIn TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
UpdatedIn camera driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution privileges needed
UpdatedIn wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
UpdatedIn wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
UpdatedIn camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
UpdatedIn Ifaa service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
UpdatedIn bluetooth service, there is a possible out of bounds write due to race condition. This could lead to local denial of service with System execution privileges needed.
UpdatedIn bluetooth service, there is a possible missing params check. This could lead to local denial of service with System execution privileges needed.
UpdatedIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
UpdatedIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
UpdatedIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
UpdatedIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
UpdatedIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
UpdatedIn telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Updated