2022 CVEs (page 103)
Page 103 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-32607 | Medium | 6.7 | 2022-11-08 | In aee, there is a possible use after free due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges nee… |
CVE-2022-32605 | Medium | 6.7 | 2022-11-08 | In isp, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2022-32603 | Medium | 6.7 | 2022-11-08 | In gpu drm, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-32602 | Medium | 5.5 | 2022-11-08 | In keyinstall, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with no additional executi… |
CVE-2022-32601 | High | 7.8 | 2022-11-08 | In telephony, there is a possible permission bypass due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-26446 | High | 7.5 | 2022-11-08 | In Modem 4G RRC, there is a possible system crash due to improper input validation. This could lead to remote denial of service, when concatenating improper SI… |
CVE-2022-21778 | Medium | 6.7 | 2022-11-08 | In vpu, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2022-39377 | High | 7.0 | 2022-11-08 | sysstat is a set of system performance tools for the Linux operating system. On 32 bit systems, in versions 9.1.16 and newer but prior to 12.7.1, allocate_stru… |
CVE-2022-33322 | Medium | 6.1 | 2022-11-08 | Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote… |
CVE-2022-33321 | Critical | 9.8 | 2022-11-08 | Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer elect… |
CVE-2022-44741 | Medium | 6.1 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress. |
CVE-2022-43491 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.5 on WordPress leading to plugin settings import. |
CVE-2022-43481 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Coupons for WooCommerce Coupons plugin <= 4.5 on WordPress leading to notice dismissal. |
CVE-2022-42494 | Low | 3.0 | 2022-11-08 | Server Side Request Forgery (SSRF) vulnerability in All in One SEO Pro plugin <= 4.2.5.1 on WordPress. |
CVE-2022-41980 | Medium | 4.8 | 2022-11-08 | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Mantenimiento web plugin <= 0.13 on WordPress. |
CVE-2022-41136 | Medium | 6.1 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Vladimir Anokhin's Shortcodes Ultimate plugin <= 5.12.0 on Word… |
CVE-2022-40632 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 on WordPress leading to topic deletion. |
CVE-2022-40223 | Medium | 5.4 | 2022-11-08 | Nonce token leakage and missing authorization in SearchWP premium plugin <= 4.2.5 on WordPress leading to plugin settings change. |
CVE-2022-40206 | Medium | 6.3 | 2022-11-08 | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles t… |
CVE-2022-40205 | Medium | 5.4 | 2022-11-08 | Insecure direct object references (IDOR) vulnerability in the wpForo Forum plugin <= 2.0.5 on WordPress allows attackers with subscriber or higher user roles t… |
CVE-2022-40128 | Medium | 4.3 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download. |
CVE-2022-38137 | Medium | 4.3 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress. |
CVE-2022-32776 | Medium | 4.8 | 2022-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 on WordPress. |
CVE-2022-32587 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change. |
CVE-2022-30545 | Medium | 4.8 | 2022-11-08 | Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress. |
CVE-2022-27914 | Medium | 6.1 | 2022-11-08 | An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_… |
CVE-2022-27858 | High | 7.4 | 2022-11-08 | CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress. |
CVE-2022-27855 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change. |
CVE-2022-44556 | High | 7.5 | 2022-11-08 | Missing parameter type validation in the DRM module. Successful exploitation of this vulnerability may affect availability. |
CVE-2022-39069 | Medium | 5.3 | 2022-11-08 | There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attack by building malici… |
CVE-2022-44321 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexSkipComment function in lex.c when called from LexScanGetToken. |
CVE-2022-44320 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from ExpressionParseFunctio… |
CVE-2022-44319 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from ExpressionParseFuncti… |
CVE-2022-44318 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionC… |
CVE-2022-44317 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioOutPutc function in cstdlib/stdio.c when called from ExpressionParseFunctionCa… |
CVE-2022-44316 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanGetToken. |
CVE-2022-44315 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionC… |
CVE-2022-44314 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunction… |
CVE-2022-44313 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when called from Expressio… |
CVE-2022-44312 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in expression.c when called from ExpressionInfixOp… |
CVE-2022-44311 | High | 8.1 | 2022-11-08 | html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elm_close(tree_node_t *nodo) at procesador.c. This vulnerability al… |
CVE-2022-43343 | High | 7.5 | 2022-11-08 | N-Prolog v1.91 was discovered to contain a global buffer overflow vulnerability in the function gettoken() at Main.c. |
CVE-2022-41757 | High | 8.8 | 2022-11-08 | An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to obtain write access to read-onl… |
CVE-2022-44457 | Critical | 9.8 | 2022-11-08 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 <… |
CVE-2022-43958 | High | 7.6 | 2022-11-08 | A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext… |
CVE-2022-43546 | Critical | 9.9 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al… |
CVE-2022-43545 | Critical | 9.9 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al… |
CVE-2022-43439 | Critical | 9.9 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All ver… |
CVE-2022-43398 | High | 7.5 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al… |
CVE-2022-43397 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <… |
CVE-2022-41664 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-41663 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-41662 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-41661 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-41660 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-39157 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.0 (All versions >= V34.0.252 < V34.0.254), Parasolid V34.1 (Al… |
CVE-2022-39136 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-30694 | Medium | 6.5 | 2022-11-08 | The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenticated remote attackers to track the a… |
CVE-2022-39352 | Medium | 4.8 | 2022-11-08 | OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under… |
CVE-2022-39343 | Medium | 5.6 | 2022-11-08 | Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure… |
CVE-2022-36077 | High | 7.2 | 2022-11-08 | The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11… |
CVE-2022-41434 | Medium | 6.1 | 2022-11-08 | EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/main.php. |
CVE-2022-41433 | Medium | 4.8 | 2022-11-08 | EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/admin_bp/add_applicat… |
CVE-2022-41432 | Medium | 4.8 | 2022-11-08 | EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/report_event/index.ph… |
CVE-2022-31199 | Critical | 9.8 | 2022-11-08 | Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents… |
CVE-2022-43359 | High | 7.8 | 2022-11-07 | Gifdec commit 1dcbae19363597314f6623010cc80abad4e47f7c was discovered to contain an out-of-bounds read in the function read_image_data. This vulnerability is t… |
CVE-2022-43049 | High | 7.2 | 2022-11-07 | Canteen Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the component /youthappam/add-food.php. |
CVE-2022-43046 | Medium | 4.8 | 2022-11-07 | Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order.php. |
CVE-2022-3872 | High | 8.6 | 2022-11-07 | An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and s… |
CVE-2022-44747 | High | 7.8 | 2022-11-07 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40… |
CVE-2022-44746 | Medium | 5.5 | 2022-11-07 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before bu… |
CVE-2022-44745 | Medium | 5.5 | 2022-11-07 | Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107. |
CVE-2022-44744 | High | 7.3 | 2022-11-07 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40… |
CVE-2022-43052 | High | 7.2 | 2022-11-07 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete. |
CVE-2022-43051 | High | 7.2 | 2022-11-07 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete_… |
CVE-2022-43050 | High | 7.2 | 2022-11-07 | Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component update_profile.php. This vulner… |
CVE-2022-44733 | High | 7.8 | 2022-11-07 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2022-44732 | High | 7.8 | 2022-11-07 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2022-38164 | Medium | 6.5 | 2022-11-07 | A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing attack with URL spoofin… |
CVE-2022-42990 | High | 7.2 | 2022-11-07 | Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Cus… |
CVE-2022-3878 | High | 7.3 | 2022-11-07 | A vulnerability classified as critical has been found in Maxon ERP. This affects an unknown part of the file /index.php/purchase_order/browse_data. The manipul… |
CVE-2022-44054 | Critical | 9.8 | 2022-11-07 | The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor ins… |
CVE-2022-44053 | Critical | 9.8 | 2022-11-07 | The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backd… |
CVE-2022-44052 | Critical | 9.8 | 2022-11-07 | The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-44051 | Critical | 9.8 | 2022-11-07 | The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-44050 | Critical | 9.8 | 2022-11-07 | The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backd… |
CVE-2022-44049 | Critical | 9.8 | 2022-11-07 | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor… |
CVE-2022-44048 | Critical | 9.8 | 2022-11-07 | The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor in… |
CVE-2022-43352 | High | 7.2 | 2022-11-07 | Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_quote. |
CVE-2022-43351 | Medium | 6.5 | 2022-11-07 | Sanitization Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php?f=delete_img. |
CVE-2022-43350 | High | 7.2 | 2022-11-07 | Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_inquir… |
CVE-2022-43319 | High | 7.5 | 2022-11-07 | An information disclosure vulnerability in the component vcs/downloadFiles.php?download=./search.php of Simple E-Learning System v1.0 allows attackers to read… |
CVE-2022-43318 | High | 8.8 | 2022-11-07 | Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the stateedit parameter at /hrm/state.php. |
CVE-2022-43317 | Medium | 6.1 | 2022-11-07 | A cross-site scripting (XSS) vulnerability in /hrm/index.php?msg of Human Resource Management System v1.0 allows attackers to execute arbitrary web scripts or… |
CVE-2022-43306 | High | 8.8 | 2022-11-07 | The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-43305 | Critical | 9.8 | 2022-11-07 | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor… |
CVE-2022-43304 | Critical | 9.8 | 2022-11-07 | The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-43303 | Critical | 9.8 | 2022-11-07 | The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor… |
CVE-2022-38163 | Low | 3.5 | 2022-11-07 | A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on addr… |
CVE-2022-37866 | High | 7.5 | 2022-11-07 | When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders… |