2022 CVEs¶
82 entries from 2022. 3 ship detection & prevention rules.
| CVE | Severity | Detection / prevention | PoC |
|---|---|---|---|
| CVE-2022-0543 — It was discovered, that redis, a persistent key-value database, due to a packaging issue,… | Critical (10.0) | — | ✅ |
| CVE-2022-20708 — Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series… | Critical (10.0) | — | ✅ |
| CVE-2022-22947 — In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable… | Critical (10.0) | — | ✅ |
| CVE-2022-1040 — An authentication bypass vulnerability in the User Portal and Webadmin allows a remote… | Critical (9.8) | — | ✅ |
| CVE-2022-1388 — On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x… | Critical (9.8) | — | ✅ |
| CVE-2022-21445 — Vulnerability in the Oracle Application Development Framework (ADF) product of Oracle… | Critical (9.8) | — | ✅ |
| CVE-2022-21587 — Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle… | Critical (9.8) | — | ✅ |
| CVE-2022-22954 — VMware Workspace ONE Access and Identity Manager contain a remote code execution… | Critical (9.8) | — | ✅ |
| CVE-2022-22963 — Spring Cloud Function SpEL Injection | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2022-22965 — Spring4Shell RCE | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2022-23227 — NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR… | Critical (9.8) | — | ✅ |
| CVE-2022-24086 — Adobe Commerce versions 2.4.3-p1 (and earlier) and 2.3.7-p2 (and earlier) are affected by… | Critical (9.8) | — | ✅ |
| CVE-2022-24112 — An attacker can abuse the batch-requests plugin to send requests to bypass the IP… | Critical (9.8) | — | ✅ |
| CVE-2022-24706 — In Apache CouchDB prior to 3.2.2, an attacker can access an improperly secured default… | Critical (9.8) | — | ✅ |
| CVE-2022-26134 — In affected versions of Confluence Server and Data Center, an OGNL injection… | Critical (9.8) | — | ✅ |
| CVE-2022-26138 — The Atlassian Questions For Confluence app for Confluence Server and Data Center creates… | Critical (9.8) | — | ✅ |
| CVE-2022-26143 — The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice… | Critical (9.8) | — | ✅ |
| CVE-2022-26318 — On WatchGuard Firebox and XTM appliances, an unauthenticated user can execute arbitrary… | Critical (9.8) | — | ✅ |
| CVE-2022-26352 — An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. | Critical (9.8) | — | ✅ |
| CVE-2022-26501 — Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). | Critical (9.8) | — | ✅ |
| CVE-2022-26871 — An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an… | Critical (9.8) | — | ✅ |
| CVE-2022-27518 — CVE ID: CVE-2022-27518, CWE: CWE-664, Attack Vector: NETWORK, CVSS: 9.8 | Critical (9.8) | — | ✅ |
| CVE-2022-29303 — SolarView Compact ver.6.00 was discovered to contain a command injection vulnerability… | Critical (9.8) | — | ✅ |
| CVE-2022-29464 — Certain WSO2 products allow unrestricted file upload with resultant remote code execution. | Critical (9.8) | — | ✅ |
| CVE-2022-29499 — The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote… | Critical (9.8) | — | ✅ |
| CVE-2022-30525 — A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware… | Critical (9.8) | — | ✅ |
| CVE-2022-31199 — Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video… | Critical (9.8) | — | ✅ |
| CVE-2022-3236 — A code injection vulnerability in the User Portal and Webadmin allows a remote attacker… | Critical (9.8) | — | ✅ |
| CVE-2022-35405 — Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable… | Critical (9.8) | — | ✅ |
| CVE-2022-35914 — /vendor/htmlawed/htmlawed/htmLawedTest.php in the htmlawed module for GLPI through 10.0.2… | Critical (9.8) | — | ✅ |
| CVE-2022-37042 — Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that… | Critical (9.8) | — | ✅ |
| CVE-2022-37055 — D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable… | Critical (9.8) | — | ✅ |
| CVE-2022-40684 — An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS… | Critical (9.8) | — | ✅ |
| CVE-2022-41352 — An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. | Critical (9.8) | — | ✅ |
| CVE-2022-42475 — A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through… | Critical (9.8) | — | ✅ |
| CVE-2022-42948 — Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing… | Critical (9.8) | — | ✅ |
| CVE-2022-44877 — login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147… | Critical (9.8) | — | ✅ |
| CVE-2022-46169 — Cacti is an open source platform which provides a robust and extensible operational… | Critical (9.8) | — | ✅ |
| CVE-2022-47966 — Zoho ManageEngine RCE | Critical (9.8) | Snort, YARA, Nginx, Apache | ✅ |
| CVE-2022-26486 — An unexpected message in the WebGPU IPC framework could lead to a use-after-free and… | Critical (9.6) | — | ✅ |
| CVE-2022-3075 — Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a… | Critical (9.6) | — | ✅ |
| CVE-2022-4135 — Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote… | Critical (9.6) | — | ✅ |
| CVE-2022-23131 — In the case of instances where the SAML SSO authentication is enabled (non-default),… | Critical (9.1) | — | ✅ |
| CVE-2022-0609 — Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote… | High (8.8) | — | ✅ |
| CVE-2022-1096 — Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2022-1364 — Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote… | High (8.8) | — | ✅ |
| CVE-2022-22620 — A use after free issue was addressed with improved memory management. | High (8.8) | — | ✅ |
| CVE-2022-2294 — Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote… | High (8.8) | — | ✅ |
| CVE-2022-23176 — WatchGuard Firebox and XTM appliances allow a remote attacker with unprivileged… | High (8.8) | — | ✅ |
| CVE-2022-26485 — Removing an XSLT parameter during processing could have lead to an exploitable… | High (8.8) | — | ✅ |
| CVE-2022-26500 — Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and… | High (8.8) | — | ✅ |
| CVE-2022-26923 — CVE ID: CVE-2022-26923, CWE: CWE-295, Attack Vector: NETWORK, CVSS: 8.8 | High (8.8) | — | ✅ |
| CVE-2022-3038 — Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a… | High (8.8) | — | ✅ |
| CVE-2022-32893 — An out-of-bounds write issue was addressed with improved bounds checking. | High (8.8) | — | ✅ |
| CVE-2022-33891 — The Apache Spark UI offers the possibility to enable ACLs via the configuration option… | High (8.8) | — | ✅ |
| CVE-2022-36804 — Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version… | High (8.8) | — | ✅ |
| CVE-2022-3723 — Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2022-38181 — The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because… | High (8.8) | — | ✅ |
| CVE-2022-41040 — CVE ID: CVE-2022-41040, CWE: CWE-918, Type: SSRF, Attack Vector: NETWORK, CVSS: 8.8 | High (8.8) | — | ✅ |
| CVE-2022-41080 — Microsoft Exchange Server Elevation of Privilege Vulnerability | High (8.8) | — | ✅ |
| CVE-2022-41128 — CVE ID: CVE-2022-41128, CWE: CWE-787, Type: RCE, Attack Vector: NETWORK, CVSS: 8.8 | High (8.8) | — | ✅ |
| CVE-2022-4262 — Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to… | High (8.8) | — | ✅ |
| CVE-2022-42856 — A type confusion issue was addressed with improved state handling. | High (8.8) | — | ✅ |
| CVE-2022-43769 — Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2,… | High (8.8) | — | ✅ |
| CVE-2022-48503 — The issue was addressed with improved bounds checks. | High (8.8) | — | ✅ |
| CVE-2022-0028 — A PAN-OS URL filtering policy misconfiguration could allow a network-based attacker to… | High (8.6) | — | ✅ |
| CVE-2022-43939 — Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2,… | High (8.6) | — | ✅ |
| CVE-2022-0185 — A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in… | High (8.4) | — | ✅ |
| CVE-2022-22071 — Possible use after free when process shell memory is freed using IOCTL munmap call and… | High (8.4) | — | ✅ |
| CVE-2022-26925 — CVE ID: CVE-2022-26925, CWE: CWE-306, Attack Vector: NETWORK, CVSS: 8.1 | High (8.1) | — | ✅ |
| CVE-2022-41082 — CVE ID: CVE-2022-41082, CWE: CWE-502, Type: RCE, Attack Vector: ADJACENT_NETWORK, CVSS:… | High (8.0) | — | ✅ |
| CVE-2022-20699 — CVE ID: CVE-2022-20699, CWE: CWE-121, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2022-20700 — CVE ID: CVE-2022-20700, CWE: CWE-121, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2022-20701 — CVE ID: CVE-2022-20701, CWE: CWE-121, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2022-20703 — CVE ID: CVE-2022-20703, CWE: CWE-121, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2022-22536 — CVE ID: CVE-2022-22536, CWE: CWE-444, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2022-22587 — CVE ID: CVE-2022-22587, CWE: CWE-787, Attack Vector: NETWORK, CVSS: 9.8 | Unrated | — | ✅ |
| CVE-2022-24816 — CVE ID: CVE-2022-24816, CWE: CWE-94, Type: RCE, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2022-26258 — CVE ID: CVE-2022-26258, CWE: CWE-78, Type: RCE, Attack Vector: NETWORK, CVSS: 9.8 | Unrated | — | ✅ |
| CVE-2022-27593 — CVE ID: CVE-2022-27593, CWE: CWE-610, Type: RCE, Attack Vector: NETWORK, CVSS: 10.0 | Unrated | — | ✅ |
| CVE-2022-40799 — CVE ID: CVE-2022-40799, CWE: CWE-494, Attack Vector: NETWORK, CVSS: 8.8 | Unrated | — | ✅ |
| CVE-2022-47986 — CVE ID: CVE-2022-47986, CWE: CWE-502, Type: RCE, Attack Vector: NETWORK, CVSS: 9.8 | Unrated | — | ✅ |