CVE-2022-36553

Hytec Inter HWL-2511-SS (v1.05 and earlier) is affected by an unauthenticated remote command-injection vulnerability in /www/cgi-bin/popen.cgi. Exploitation could allow arbitrary command execution with high impact on confidentiality, integrity, and availability. Public references (NVD/NIST) docum...

CVE-2022-22897

CVE-2022-22897 describes a SQL injection in the ApolloTheme AP PageBuilder for PrestaShop up to version 2.4.4, affecting the parameters product_all_one_img and image_product . Unauthenticated attackers could exfiltrate database data by exploiting this vulnerability. The NVD/Nuclei entries confirm...

CVE-2022-37055

CVE-2022-37055 affects D-Link Go-RT-AC750 devices (GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02). Root cause: buffer overflow via cgibin and hnap_main, due to insufficient stack/size checks. Impact reported as high confidentiality, integrity, and availability losses. Public sources descr...

CVE-2022-37056

The CVE-2022-37056 issue affects D-Link GO-RT-AC750 family (GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02). The vulnerability is a command injection in the HNAP/cgi-bin main function, arising from insufficient input handling, allowing remote execution of arbitrary commands via the HNAP in...

CVE-2022-2915

CVE-2022-2915 is a heap-based buffer overflow in SonicWall SMA100 firmware that affects 10.2.1.5-34sv and earlier. An authenticated remote attacker can cause DoS and potentially code execution. Remediation: upgrade to SMA100 10.2.1.6-37sv or later as noted by SonicWall advisories; exploitation st...

CVE-2022-36537

CVE-2022-36537 – ZK Framework Information Disclosure . Affected versions of ZK Framework: 9.6.1, 9.6.0.1, 9.5.1.3, 9.0.1.2, 8.6.4.1. An unauthenticated attacker can obtain sensitive data via a crafted POST to the AuUploader component, potentially exposing web-context files and configuration data....

CVE-2022-36509

CVE-2022-36509 affects H3C GR3200 MiniGR1B0V100R014. The vulnerability is a command injection in the DelL2tpLNSList endpoint triggered via the param parameter. NVD CVSSv3.1 base score 7.8 (HIGH) with LOCAL attack vector, LOW authentication/privilege requirements, and C/I/A HIGH. Connected sources...

CVE-2022-36804

CVE-2022-36804 affects Atlassian Bitbucket Server and Data Center. Multiple API endpoints in Bitbucket Server/Data Center allow remote attackers with read permissions on a public or private repository to execute arbitrary code via a crafted HTTP request. Affected versions span Bitbucket Server/Da...

CVE-2022-37153

Artica Proxy 4.30.000000 is affected by CVE-2022-37153, a Cross-Site Scripting (XSS) vulnerability exploitable via the password parameter in /fw.login.php. The issue is described across multiple sources as a reflected XSS that can inject JavaScript and potentially capture credentials or session d...

CVE-2022-32894

CVE-2022-32894 is an out-of-bounds write in Apple’s kernel code that could allow arbitrary code execution with kernel privileges. Affected products include iOS/iPadOS/macOS kernel components (macOS Big Sur and newer). The issue was fixed in iOS 15.6.1, iPadOS 15.6.1, and macOS Monterey 12.5.1, wi...

CVE-2022-32893

CVE-2022-32893 is an out-of-bounds write vulnerability in WebKit/WebKitGTK that could allow arbitrary code execution when processing malicious web content. The CVE is fixed in Apple products by updates: iOS 15.6.1 / iPadOS 15.6.1, macOS Monterey 12.5.1, and Safari 15.6.1. Connected advisories not...

CVE-2022-38171

CVE-2022-38171 describes an integer overflow in the JBIG2 decoder of Xpdf (JBIG2Stream::readTextRegionSeg in JBIG2Stream.cc) that can crash or allow arbitrary code execution when processing a crafted PDF or JBIG2 image. Publicly documented impact aligns with prior CVEs (e.g., CVE-2021-30860) and ...

CVE-2022-35583

The CVE-2022-35583 entry pertains to wkhtmltopdf 0.12.6, which is vulnerable to Server-Side Request Forgery (SSRF) via crafted iframe injection. The connected exploit document provides a Pandoc-based SSRF PoC claiming it can compromise the infrastructure by injecting an iframe, indicating practic...

CVE-2022-37063

The connected sources confirm CVE-2022-37063 affects Teledyne FLIR AX8 thermal sensor cameras up to version 1.46.16, due to improper input sanitization that enables authenticated remote XSS in the web management interface. Successful exploits can execute arbitrary JavaScript in the victim’s brows...

CVE-2022-37062

The CVE-2022-37062 issue affects Teledyne FLIR AX8 thermal sensor cameras version up to and including 1.46.16, due to an insecure design from improper directory access restriction that allows an unauthenticated remote attacker to request a URI containing the path to the SQLite users database and ...

CVE-2022-37061

CVE-2022-37061 – FLIR AX8 RCE vulnerability (up to firmware 1.46.16) : The issue is an unauthenticated remote command injection via the POST parameter id to res.php, allowing an attacker to execute arbitrary shell commands as root. Public reports indicate exploitation in the wild (e.g., Metasploi...

CVE-2022-37060

The CVE-2022-37060 entry relates to Teledyne FLIR AX8 thermal sensor cameras affected up to firmware version 1.46.16. A directory traversal flaw arises from improper access restrictions, allowing an unauthenticated, remote attacker to disclose files outside the restricted server path by sending c...

CVE-2022-37393

CVE-2022-37393: Zimbra’s sudo configuration allows the zimbra user to run the zmslapd binary as root with arbitrary parameters. zmslapd can load a user-defined configuration file that may include plugins (.so) executed as root, enabling local privilege escalation. The available connected document...

CVE-2022-2314

The CVE-2022-2314 case concerns the WordPress VR Calendar plugin (versions up to and including 2.3.2). Affected component: VR Calendar WordPress plugin; root cause: unauthenticated arbitrary PHP function calls, enabling remote code execution. Impact stated across sources: attacker can execute arb...

CVE-2022-37042

CVE-2022-37042 affects Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The vulnerability arises in the mboximport endpoint that accepts a ZIP archive; when an attacker bypasses authentication (no authtoken), they can upload arbitrary files, causing directory traversal and remote code execution. ...