2022 CVEs (page 103)
Page 103 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40128 | Medium | 4.3 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Order Export For WooCommerce plugin <= 3.3.2 on WordPress leading to export file download. |
CVE-2022-38137 | Medium | 4.3 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress. |
CVE-2022-32776 | Medium | 4.8 | 2022-11-08 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin <= 1.31.1 on WordPress. |
CVE-2022-32587 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in CodeAndMore WP Page Widget plugin <= 3.9 on WordPress leading to plugin settings change. |
CVE-2022-30545 | Medium | 4.8 | 2022-11-08 | Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress. |
CVE-2022-27914 | Medium | 6.1 | 2022-11-08 | An issue was discovered in Joomla! 4.0.0 through 4.2.4. Inadequate filtering of potentially malicious user input leads to reflected XSS vulnerabilities in com_… |
CVE-2022-27858 | High | 7.4 | 2022-11-08 | CSV Injection vulnerability in Activity Log Team Activity Log <= 2.8.3 on WordPress. |
CVE-2022-27855 | Medium | 5.4 | 2022-11-08 | Cross-Site Request Forgery (CSRF) vulnerability in Fatcat Apps Analytics Cat plugin <= 1.0.9 on WordPress allows Plugin Settings Change. |
CVE-2022-44556 | High | 7.5 | 2022-11-08 | Missing parameter type validation in the DRM module. Successful exploitation of this vulnerability may affect availability. |
CVE-2022-39069 | Medium | 5.3 | 2022-11-08 | There is a SQL injection vulnerability in ZTE ZAIP-AIE. Due to lack of input verification by the server, an attacker could trigger an attack by building malici… |
CVE-2022-44321 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexSkipComment function in lex.c when called from LexScanGetToken. |
CVE-2022-44320 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from ExpressionParseFunctio… |
CVE-2022-44319 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from ExpressionParseFuncti… |
CVE-2022-44318 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionC… |
CVE-2022-44317 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioOutPutc function in cstdlib/stdio.c when called from ExpressionParseFunctionCa… |
CVE-2022-44316 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanGetToken. |
CVE-2022-44315 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionC… |
CVE-2022-44314 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunction… |
CVE-2022-44313 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when called from Expressio… |
CVE-2022-44312 | Medium | 5.5 | 2022-11-08 | PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in expression.c when called from ExpressionInfixOp… |
CVE-2022-44311 | High | 8.1 | 2022-11-08 | html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elm_close(tree_node_t *nodo) at procesador.c. This vulnerability al… |
CVE-2022-43343 | High | 7.5 | 2022-11-08 | N-Prolog v1.91 was discovered to contain a global buffer overflow vulnerability in the function gettoken() at Main.c. |
CVE-2022-41757 | High | 8.8 | 2022-11-08 | An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing operations to obtain write access to read-onl… |
CVE-2022-44457 | Critical | 9.8 | 2022-11-08 | A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 <… |
CVE-2022-43958 | High | 7.6 | 2022-11-08 | A vulnerability has been identified in QMS Automotive (All versions < V12.39), QMS Automotive (All versions < V12.39). User credentials are stored in plaintext… |
CVE-2022-43546 | Critical | 9.9 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al… |
CVE-2022-43545 | Critical | 9.9 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al… |
CVE-2022-43439 | Critical | 9.9 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (7KG9501-0AA01-0AA1) (All versions < V2.50), POWER METER SICAM Q100 (7KG9501-0AA01-2AA1) (All ver… |
CVE-2022-43398 | High | 7.5 | 2022-11-08 | A vulnerability has been identified in POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (All versions < V2.50), POWER METER SICAM Q100 (Al… |
CVE-2022-43397 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions <… |
CVE-2022-41664 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-41663 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-41662 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-41661 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-41660 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-39157 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.0 (All versions >= V34.0.252 < V34.0.254), Parasolid V34.1 (Al… |
CVE-2022-39136 | High | 7.8 | 2022-11-08 | A vulnerability has been identified in JT2Go (All versions < V14.1.0.4), Teamcenter Visualization V13.2 (All versions < V13.2.0.12), Teamcenter Visualization… |
CVE-2022-30694 | Medium | 6.5 | 2022-11-08 | The login endpoint /FormLogin in affected web services does not apply proper origin checking. This could allow authenticated remote attackers to track the a… |
CVE-2022-39352 | Medium | 4.8 | 2022-11-08 | OpenFGA is a high-performance authorization/permission engine inspired by Google Zanzibar. Versions prior to 0.2.5 are vulnerable to authorization bypass under… |
CVE-2022-39343 | Medium | 5.6 | 2022-11-08 | Azure RTOS FileX is a FAT-compatible file system that’s fully integrated with Azure RTOS ThreadX. In versions before 6.2.0, the Fault Tolerant feature of Azure… |
CVE-2022-36077 | High | 7.2 | 2022-11-08 | The Electron framework enables writing cross-platform desktop applications using JavaScript, HTML and CSS. In versions prior to 21.0.0-beta.1, 20.0.1, 19.0.11… |
CVE-2022-41434 | Medium | 6.1 | 2022-11-08 | EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /lilac/main.php. |
CVE-2022-41433 | Medium | 4.8 | 2022-11-08 | EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/admin_bp/add_applicat… |
CVE-2022-41432 | Medium | 4.8 | 2022-11-08 | EyesOfNetwork Web Interface v5.3 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /module/report_event/index.ph… |
CVE-2022-31199 | Critical | 9.8 | 2022-11-08 | Remote code execution vulnerabilities exist in the Netwrix Auditor User Activity Video Recording component affecting both the Netwrix Auditor server and agents… |
CVE-2022-43359 | High | 7.8 | 2022-11-07 | Gifdec commit 1dcbae19363597314f6623010cc80abad4e47f7c was discovered to contain an out-of-bounds read in the function read_image_data. This vulnerability is t… |
CVE-2022-43049 | High | 7.2 | 2022-11-07 | Canteen Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the component /youthappam/add-food.php. |
CVE-2022-43046 | Medium | 4.8 | 2022-11-07 | Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order.php. |
CVE-2022-3872 | High | 8.6 | 2022-11-07 | An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and s… |
CVE-2022-44747 | High | 7.8 | 2022-11-07 | Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40… |
CVE-2022-44746 | Medium | 5.5 | 2022-11-07 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before bu… |
CVE-2022-44745 | Medium | 5.5 | 2022-11-07 | Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107. |
CVE-2022-44744 | High | 7.3 | 2022-11-07 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40… |
CVE-2022-43052 | High | 7.2 | 2022-11-07 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete. |
CVE-2022-43051 | High | 7.2 | 2022-11-07 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete_… |
CVE-2022-43050 | High | 7.2 | 2022-11-07 | Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component update_profile.php. This vulner… |
CVE-2022-44733 | High | 7.8 | 2022-11-07 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2022-44732 | High | 7.8 | 2022-11-07 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2022-38164 | Medium | 6.5 | 2022-11-07 | A vulnerability affecting F-Secure SAFE browser for Android and iOS was discovered. A maliciously crafted website could make a phishing attack with URL spoofin… |
CVE-2022-42990 | High | 7.2 | 2022-11-07 | Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Cus… |
CVE-2022-3878 | High | 7.3 | 2022-11-07 | A vulnerability classified as critical has been found in Maxon ERP. This affects an unknown part of the file /index.php/purchase_order/browse_data. The manipul… |
CVE-2022-44054 | Critical | 9.8 | 2022-11-07 | The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor ins… |
CVE-2022-44053 | Critical | 9.8 | 2022-11-07 | The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backd… |
CVE-2022-44052 | Critical | 9.8 | 2022-11-07 | The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-44051 | Critical | 9.8 | 2022-11-07 | The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-44050 | Critical | 9.8 | 2022-11-07 | The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backd… |
CVE-2022-44049 | Critical | 9.8 | 2022-11-07 | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor… |
CVE-2022-44048 | Critical | 9.8 | 2022-11-07 | The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor in… |
CVE-2022-43352 | High | 7.2 | 2022-11-07 | Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_quote. |
CVE-2022-43351 | Medium | 6.5 | 2022-11-07 | Sanitization Management System v1.0 was discovered to contain an arbitrary file deletion vulnerability via the component /classes/Master.php?f=delete_img. |
CVE-2022-43350 | High | 7.2 | 2022-11-07 | Sanitization Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /php-sms/classes/Master.php?f=delete_inquir… |
CVE-2022-43319 | High | 7.5 | 2022-11-07 | An information disclosure vulnerability in the component vcs/downloadFiles.php?download=./search.php of Simple E-Learning System v1.0 allows attackers to read… |
CVE-2022-43318 | High | 8.8 | 2022-11-07 | Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the stateedit parameter at /hrm/state.php. |
CVE-2022-43317 | Medium | 6.1 | 2022-11-07 | A cross-site scripting (XSS) vulnerability in /hrm/index.php?msg of Human Resource Management System v1.0 allows attackers to execute arbitrary web scripts or… |
CVE-2022-43306 | High | 8.8 | 2022-11-07 | The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-43305 | Critical | 9.8 | 2022-11-07 | The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor… |
CVE-2022-43304 | Critical | 9.8 | 2022-11-07 | The d8s-timer for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor i… |
CVE-2022-43303 | Critical | 9.8 | 2022-11-07 | The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor… |
CVE-2022-38163 | Low | 3.5 | 2022-11-07 | A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on addr… |
CVE-2022-37866 | High | 7.5 | 2022-11-07 | When Apache Ivy downloads artifacts from a repository it stores them in the local file system based on a user-supplied "pattern" that may include placeholders… |
CVE-2022-42956 | High | 7.5 | 2022-11-07 | The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain the cleartext master password. |
CVE-2022-42955 | High | 7.5 | 2022-11-07 | The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain cleartext cached credentials. |
CVE-2022-42920 | Critical | 9.8 | 2022-11-07 | Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue… |
CVE-2022-2188 | Medium | 6.5 | 2022-11-07 | Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory con… |
CVE-2022-3873 | Medium | 6.1 | 2022-11-07 | Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2. |
CVE-2022-37865 | Critical | 9.1 | 2022-11-07 | With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging… |
CVE-2022-3558 | High | 8.0 | 2022-11-07 | The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. |
CVE-2022-3537 | High | 8.8 | 2022-11-07 | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uplo… |
CVE-2022-3536 | High | 8.8 | 2022-11-07 | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path give… |
CVE-2022-3494 | High | 8.8 | 2022-11-07 | The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanit… |
CVE-2022-3489 | Medium | 5.3 | 2022-11-07 | The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauth… |
CVE-2022-3481 | Critical | 9.8 | 2022-11-07 | The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoi… |
CVE-2022-3463 | Critical | 9.8 | 2022-11-07 | The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection |
CVE-2022-3462 | Medium | 4.8 | 2022-11-07 | The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-3451 | Medium | 4.3 | 2022-11-07 | The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role… |
CVE-2022-3418 | High | 7.2 | 2022-11-07 | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which… |
CVE-2022-2711 | High | 7.2 | 2022-11-07 | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privil… |
CVE-2022-2387 | Medium | 4.3 | 2022-11-07 | The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be… |
CVE-2022-44797 | Critical | 9.8 | 2022-11-07 | btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking. |
CVE-2022-44796 | Critical | 9.8 | 2022-11-07 | An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowi… |