CVE-2022-32964

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

OMICARD EDM’s API function has insufficient validation for user input. An unauthenticated remote attacker can inject arbitrary SQL commands to access, modify, delete database or disrupt service.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Vendor	Product	Versions
ITPison	OMICARD EDM	>= 5.8, <= 6.0

References

https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988fThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-6372-f61bc-1.htmlThird Party Advisory
https://www.chtsecurity.com/news/48032532-b2de-401c-97a8-a2be5691988fThird Party Advisory
https://www.twcert.org.tw/tw/cp-132-6372-f61bc-1.htmlThird Party Advisory

Timeline

Published: Aug 4, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-329659.8OMICARD EDM has a hard-coded machine key. An unauthenticated remote attacker can use the machine key to send serialized payload to the serve CVE-2022-329666.5RTL8168FP-CG Dash remote management function has missing authorization. An unauthenticated attacker within the adjacent network can connect CVE-2022-329672.1RTL8111EP-CG/RTL8111FP-CG DASH function has hard-coded password. An unauthenticated physical attacker can use the hard-coded default passwor CVE-2022-329695.9MetaMask before 10.11.3 might allow an attacker to access a user's secret recovery phrase because an input field is used for a BIP39 mnemoni CVE-2022-32977.8Use After Free in GitHub repository vim/vim prior to 9.0.0579.CVE-2022-329705.4Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in Themify Themify Portfolio Post plugin <= 1.2.4 versions.CVE-2022-329717.2Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow a privileged user to potentially enable escalation of CVE-2022-329727.8Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation.CVE-2022-329738.8An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privile CVE-2022-329746.5An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance a CVE-2022-329786.5There is an assertion failure in SingleComponentLSScan::ParseMCU in singlecomponentlsscan.cpp in libjpeg before 1.64 via an empty JPEG-LS sc CVE-2022-32987.5Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8.