2022 CVEs (page 102)
Page 102 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29481 | Medium | 6.5 | 2022-11-09 | A leftover debug code vulnerability exists in the console nvram functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network req… |
CVE-2022-28689 | High | 8.8 | 2022-11-09 | A leftover debug code vulnerability exists in the console support functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted network request can… |
CVE-2022-26023 | Medium | 6.5 | 2022-11-09 | A leftover debug code vulnerability exists in the console verify functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network re… |
CVE-2022-25932 | Critical | 9.8 | 2022-11-09 | The firmware of InHand Networks InRouter302 V3.5.45 introduces fixes for TALOS-2022-1472 and TALOS-2022-1474. The fixes are incomplete. An attacker can still p… |
CVE-2022-0031 | Medium | 6.7 | 2022-11-09 | A local privilege escalation (PE) vulnerability in the Palo Alto Networks Cortex XSOAR engine software running on a Linux operating system allows a local attac… |
CVE-2022-43488 | Medium | 5.4 | 2022-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to rule type migration. |
CVE-2022-43278 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the categoriesId parameter at /php_action/fetchSelectedCategories.ph… |
CVE-2022-43277 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via ip/youthappam/php_action/editFile.php. This vulnerability a… |
CVE-2022-43121 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTM… |
CVE-2022-43120 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scrip… |
CVE-2022-43119 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in Clansphere CMS v2011.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected i… |
CVE-2022-43118 | Medium | 6.1 | 2022-11-09 | A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2022-41978 | High | 8.8 | 2022-11-09 | Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress. |
CVE-2022-43292 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editfood.php. |
CVE-2022-43291 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editclient.php. |
CVE-2022-43290 | High | 7.2 | 2022-11-09 | Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /youthappam/editcategory.php. |
CVE-2022-43321 | Medium | 6.1 | 2022-11-09 | Shopwind v3.4.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability in the component /common/library/Page.php. |
CVE-2022-43320 | Medium | 6.1 | 2022-11-09 | FeehiCMS v2.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id parameter at /web/admin/index.php?r=log%2Fview-layer. |
CVE-2022-31253 | High | 7.1 | 2022-11-09 | A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arb… |
CVE-2022-45062 | Critical | 9.8 | 2022-11-09 | In Xfce xfce4-settings before 4.16.4 and 4.17.x before 4.17.1, there is an argument injection vulnerability in xfce4-mime-helper. |
CVE-2022-45061 | High | 7.5 | 2022-11-09 | An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decod… |
CVE-2022-40797 | Critical | 9.8 | 2022-11-09 | Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5… |
CVE-2022-45060 | High | 7.5 | 2022-11-09 | An HTTP Request Forgery issue was discovered in Varnish Cache 5.x and 6.x before 6.0.11, 7.x before 7.1.2, and 7.2.x before 7.2.1. An attacker may introduce ch… |
CVE-2022-45059 | High | 7.5 | 2022-11-09 | An issue was discovered in Varnish Cache 7.x before 7.1.2 and 7.2.x before 7.2.1. A request smuggling attack can be performed on Varnish Cache servers by reque… |
CVE-2022-3890 | Critical | 9.6 | 2022-11-09 | Heap buffer overflow in Crashpad in Google Chrome on Android prior to 107.0.5304.106 allowed a remote attacker who had compromised the renderer process to pote… |
CVE-2022-3889 | High | 8.8 | 2022-11-09 | Type confusion in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2022-3888 | High | 8.8 | 2022-11-09 | Use after free in WebCodecs in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2022-3887 | High | 8.8 | 2022-11-09 | Use after free in Web Workers in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2022-3886 | High | 8.8 | 2022-11-09 | Use after free in Speech Recognition in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2022-3885 | High | 8.8 | 2022-11-09 | Use after free in V8 in Google Chrome prior to 107.0.5304.106 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromi… |
CVE-2022-43144 | Medium | 5.4 | 2022-11-08 | A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. |
CVE-2022-39328 | Critical | 9.8 | 2022-11-08 | Grafana is an open-source platform for monitoring and observability. Versions starting with 9.2.0 and less than 9.2.4 contain a race condition in the authentic… |
CVE-2022-30515 | Medium | 5.3 | 2022-11-08 | ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration. |
CVE-2022-41260 | Medium | 6.1 | 2022-11-08 | SAP Financial Consolidation - version 1010, does not sufficiently encode user-controlled input which may allow an unauthenticated attacker to inject a web scri… |
CVE-2022-41259 | Medium | 6.5 | 2022-11-08 | SAP SQL Anywhere - version 17.0, allows an authenticated attacker to prevent legitimate users from accessing a SQL Anywhere database server by crashing the ser… |
CVE-2022-41258 | Medium | 6.5 | 2022-11-08 | Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker to inject malicious script when running a co… |
CVE-2022-41215 | Medium | 4.7 | 2022-11-08 | SAP NetWeaver ABAP Server and ABAP Platform allows an unauthenticated attacker to redirect users to a malicious site due to insufficient URL validation. This c… |
CVE-2022-41214 | High | 8.7 | 2022-11-08 | Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote ena… |
CVE-2022-41212 | Medium | 4.9 | 2022-11-08 | Due to insufficient input validation, SAP NetWeaver Application Server ABAP and ABAP Platform allows an attacker with high level privileges to use a remote ena… |
CVE-2022-41211 | High | 7.0 | 2022-11-08 | Due to lack of proper memory management, when a victim opens manipulated file received from untrusted sources in SAP 3D Visual Enterprise Author and SAP 3D Vis… |
CVE-2022-41208 | Medium | 5.4 | 2022-11-08 | Due to insufficient input validation, SAP Financial Consolidation - version 1010, allows an authenticated attacker with user privileges to alter current user s… |
CVE-2022-41207 | Medium | 6.1 | 2022-11-08 | SAP Biller Direct allows an unauthenticated attacker to craft a legitimate looking URL. When clicked by an unsuspecting victim, it will use an unsensitized par… |
CVE-2022-41205 | Medium | 5.5 | 2022-11-08 | SAP GUI allows an authenticated attacker to execute scripts in the local network. On successful exploitation, the attacker can gain access to registries which… |
CVE-2022-41203 | High | 8.8 | 2022-11-08 | In some workflow of SAP BusinessObjects BI Platform (Central Management Console and BI LaunchPad), an authenticated attacker with low privileges can intercept… |
CVE-2022-3821 | Medium | 5.5 | 2022-11-08 | An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accurac… |
CVE-2022-39386 | High | 7.5 | 2022-11-08 | @fastify/websocket provides WebSocket support for Fastify. Any application using @fastify/websocket could crash if a specific, malformed packet is sent. All ve… |
CVE-2022-37015 | Critical | 9.8 | 2022-11-08 | Symantec Endpoint Detection and Response (SEDR) Appliance, prior to 4.7.0, may be susceptible to a privilege escalation vulnerability, which is a type of issue… |
CVE-2022-34825 | Critical | 9.8 | 2022-11-08 | Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe f… |
CVE-2022-34824 | Critical | 9.8 | 2022-11-08 | Weak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 Sing… |
CVE-2022-34823 | Critical | 9.8 | 2022-11-08 | Buffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for… |
CVE-2022-34822 | Critical | 9.8 | 2022-11-08 | Path traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for W… |
CVE-2022-27516 | Medium | 5.3 | 2022-11-08 | User login brute force protection functionality bypass |
CVE-2022-27513 | High | 8.3 | 2022-11-08 | Remote desktop takeover via phishing |
CVE-2022-27510 | Critical | 9.8 | 2022-11-08 | Unauthorized access to Gateway user capabilities |
CVE-2022-20465 | Medium | 4.6 | 2022-11-08 | In dismiss and related functions of KeyguardHostViewController.java and related files, there is a possible lockscreen bypass due to a logic error in the code… |
CVE-2022-20462 | High | 7.8 | 2022-11-08 | In phNxpNciHal_write_unlocked of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of… |
CVE-2022-20457 | Medium | 5.5 | 2022-11-08 | In getMountModeInternal of StorageManagerService.java, there is a possible prevention of package installation due to improper input validation. This could lead… |
CVE-2022-20454 | Medium | 6.7 | 2022-11-08 | In fdt_next_tag of fdt.c, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System exec… |
CVE-2022-20453 | Medium | 5.5 | 2022-11-08 | In update of MmsProvider.java, there is a possible constriction of directory permissions due to a path traversal error. This could lead to local denial of serv… |
CVE-2022-20452 | High | 7.8 | 2022-11-08 | In initializeFromParcelLocked of BaseBundle.java, there is a possible method arbitrary code execution due to a confused deputy. This could lead to local escala… |
CVE-2022-20451 | High | 7.8 | 2022-11-08 | In onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalatio… |
CVE-2022-20450 | High | 7.8 | 2022-11-08 | In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission check. This could le… |
CVE-2022-20448 | Medium | 5.5 | 2022-11-08 | In buzzBeepBlinkLocked of NotificationManagerService.java, there is a possible way to share data across users due to a permissions bypass. This could lead to l… |
CVE-2022-20447 | Medium | 6.5 | 2022-11-08 | In PAN_WriteBuf of pan_api.cc, there is a possible out of bounds read due to a use after free. This could lead to remote information disclosure over Bluetooth… |
CVE-2022-20446 | Low | 3.3 | 2022-11-08 | In AlwaysOnHotwordDetector of AlwaysOnHotwordDetector.java, there is a possible way to access the microphone from the background due to a missing permission ch… |
CVE-2022-20445 | High | 7.5 | 2022-11-08 | In process_service_search_rsp of sdp_discovery.cc, there is a possible out of bounds read due to improper input validation. This could lead to remote informati… |
CVE-2022-20441 | High | 7.8 | 2022-11-08 | In navigateUpTo of Task.java, there is a possible way to launch an unexported intent handler due to a logic error in the code. This could lead to local escalat… |
CVE-2022-20426 | Medium | 5.5 | 2022-11-08 | In multiple functions of many files, there is a possible obstruction of the user's ability to select a phone account due to resource exhaustion. This could lea… |
CVE-2022-20414 | Medium | 5.5 | 2022-11-08 | In setImpl of AlarmManagerService.java, there is a possible way to put a device into a boot loop due to an uncaught exception. This could lead to local denial… |
CVE-2022-32618 | Medium | 6.8 | 2022-11-08 | In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an atta… |
CVE-2022-32617 | Medium | 6.8 | 2022-11-08 | In typec, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege, for an atta… |
CVE-2022-32616 | Medium | 6.7 | 2022-11-08 | In isp, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-32615 | Medium | 6.7 | 2022-11-08 | In ccd, there is a possible out of bounds write due to uninitialized data. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-32614 | Medium | 6.7 | 2022-11-08 | In audio, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32613 | Medium | 6.4 | 2022-11-08 | In vcu, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32612 | Medium | 6.4 | 2022-11-08 | In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32611 | Medium | 6.7 | 2022-11-08 | In isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-32610 | Medium | 6.4 | 2022-11-08 | In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32609 | Medium | 6.4 | 2022-11-08 | In vcu, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32608 | Medium | 6.4 | 2022-11-08 | In jpeg, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32607 | Medium | 6.7 | 2022-11-08 | In aee, there is a possible use after free due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2022-32605 | Medium | 6.7 | 2022-11-08 | In isp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2022-32603 | Medium | 6.7 | 2022-11-08 | In gpu drm, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-32602 | Medium | 5.5 | 2022-11-08 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional executi… |
CVE-2022-32601 | High | 7.8 | 2022-11-08 | In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-26446 | High | 7.5 | 2022-11-08 | In Modem 4G RRC, there is a possible system crash due to improper input validation. This could lead to remote denial of service, when concatenating improper SI… |
CVE-2022-21778 | Medium | 6.7 | 2022-11-08 | In vpu, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2022-39377 | High | 7.0 | 2022-11-08 | sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_stru… |
CVE-2022-33322 | Medium | 6.1 | 2022-11-08 | Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote… |
CVE-2022-33321 | Critical | 9.8 | 2022-11-08 | Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer elect… |
CVE-2022-44741 | Medium | 6.1 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress. |
CVE-2022-43491 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import. |
CVE-2022-43481 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal. |
CVE-2022-42494 | Low | 3.0 | 2022-11-08 | Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress. |
CVE-2022-41980 | Medium | 4.8 | 2022-11-08 | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin <= 0.13 on WordPress. |
CVE-2022-41136 | Medium | 6.1 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on Word… |
CVE-2022-40632 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion. |
CVE-2022-40223 | Medium | 5.4 | 2022-11-08 | Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change. |
CVE-2022-40206 | Medium | 6.3 | 2022-11-08 | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles t… |
CVE-2022-40205 | Medium | 5.4 | 2022-11-08 | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles t… |