CVE-2022-36312

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Aug 16, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-363135.5An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the fileCVE-2022-363145.5When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requCVE-2022-363154.3When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entrieCVE-2022-363166.1When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the targCVE-2022-363176.5When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this could lead to a permanCVE-2022-363185.3When visiting directory listings for `chrome://` URLs as source text, some parameters were reflected. This vulnerability affects Firefox ESRCVE-2022-363197.5When combining CSS properties for overflow and transform, the mouse cursor could interact with different coordinates than displayed. This vuCVE-2022-36326.5The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not have CSRF checks in some places, which could allow attackers to mCVE-2022-363209.8Mozilla developers and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 102. Some of these bugs showed evidence of meCVE-2022-363216.5In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some casesCVE-2022-363228.8In JetBrains TeamCity before 2022.04.2 build parameter injection was possibleCVE-2022-363239.1Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges
CVE-2022-36312: High severity, CVSS 8.8 | Vulnix