2022 CVEs (page 104)
Page 104 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42956 | High | 7.5 | 2022-11-07 | The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain the cleartext master password. |
CVE-2022-42955 | High | 7.5 | 2022-11-07 | The PassWork extension 5.0.9 for Chrome and other browsers allows an attacker to obtain cleartext cached credentials. |
CVE-2022-42920 | Critical | 9.8 | 2022-11-07 | Apache Commons BCEL has a number of APIs that would normally only allow changing specific class characteristics. However, due to an out-of-bounds writing issue… |
CVE-2022-2188 | Medium | 6.5 | 2022-11-07 | Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory con… |
CVE-2022-3873 | Medium | 6.1 | 2022-11-07 | Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2. |
CVE-2022-37865 | Critical | 9.1 | 2022-11-07 | With Apache Ivy 2.4.0 an optional packaging attribute has been introduced that allows artifacts to be unpacked on the fly if they used pack200 or zip packaging… |
CVE-2022-3558 | High | 8.0 | 2022-11-07 | The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. |
CVE-2022-3537 | High | 8.8 | 2022-11-07 | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uplo… |
CVE-2022-3536 | High | 8.8 | 2022-11-07 | The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path give… |
CVE-2022-3494 | High | 8.8 | 2022-11-07 | The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanit… |
CVE-2022-3489 | Medium | 5.3 | 2022-11-07 | The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauth… |
CVE-2022-3481 | Critical | 9.8 | 2022-11-07 | The WooCommerce Dropshipping WordPress plugin before 4.4 does not properly sanitise and escape a parameter before using it in a SQL statement via a REST endpoi… |
CVE-2022-3463 | Critical | 9.8 | 2022-11-07 | The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection |
CVE-2022-3462 | Medium | 4.8 | 2022-11-07 | The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-3451 | Medium | 4.3 | 2022-11-07 | The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role… |
CVE-2022-3418 | High | 7.2 | 2022-11-07 | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not properly filtering which file extensions are allowed to be imported on the server, which… |
CVE-2022-2711 | High | 7.2 | 2022-11-07 | The Import any XML or CSV File to WordPress plugin before 3.6.9 is not validating the paths of files contained in uploaded zip archives, allowing highly privil… |
CVE-2022-2387 | Medium | 4.3 | 2022-11-07 | The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be… |
CVE-2022-44797 | Critical | 9.8 | 2022-11-07 | btcd before 0.23.2, as used in Lightning Labs lnd before 0.15.2-beta and other Bitcoin-related products, mishandles witness size checking. |
CVE-2022-44796 | Critical | 9.8 | 2022-11-07 | An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowi… |
CVE-2022-44795 | Medium | 6.5 | 2022-11-07 | An issue was discovered in Object First Ootbi BETA build 1.0.7.712. A flaw was found in the Web Service, which could lead to local information disclosure. The… |
CVE-2022-44794 | High | 8.8 | 2022-11-07 | An issue was discovered in Object First Ootbi BETA build 1.0.7.712. Management protocol has a flow which allows a remote attacker to execute arbitrary Bash cod… |
CVE-2022-44793 | Medium | 6.5 | 2022-11-07 | handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote att… |
CVE-2022-44792 | Medium | 6.5 | 2022-11-07 | handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker… |
CVE-2022-42919 | High | 7.8 | 2022-11-07 | Python 3.9.x before 3.9.16 and 3.10.x before 3.10.9 on Linux allows local privilege escalation in a non-default configuration. The Python multiprocessing libra… |
CVE-2022-42905 | Critical | 9.1 | 2022-11-07 | In wolfSSL before 5.5.2, if callback functions are enabled (via the WOLFSSL_CALLBACKS flag), then a malicious TLS 1.3 client or network attacker can trigger a… |
CVE-2022-37710 | High | 7.8 | 2022-11-07 | Patterson Dental Eaglesoft 21 has AES-256 encryption but there are two ways to obtain a keyfile: (1) keybackup.data > License > Encryption Key or (2) Eaglesoft… |
CVE-2022-40284 | High | 7.8 | 2022-11-06 | A buffer overflow was discovered in NTFS-3G before 2022.10.3. Crafted metadata in an NTFS image can cause code execution. A local attacker can exploit this if… |
CVE-2022-44544 | Critical | 9.8 | 2022-11-06 | Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0 potentially allow a PDF export to trigger a remote shell if t… |
CVE-2022-42707 | High | 7.5 | 2022-11-06 | In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permi… |
CVE-2022-3869 | Medium | 6.1 | 2022-11-05 | Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. |
CVE-2022-3868 | Medium | 4.7 | 2022-11-05 | A vulnerability classified as critical has been found in SourceCodester Sanitization Management System. Affected is an unknown function of the file /php-sms/cl… |
CVE-2022-43572 | High | 7.5 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, sending a malformed file through the Splunk-to-Splunk (S2S) or HTTP Event Collector (HEC) protoco… |
CVE-2022-43570 | High | 8.8 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can perform an extensible markup language (XML) external entity (XXE) injec… |
CVE-2022-43569 | High | 8.0 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, an authenticated user can inject and store arbitrary scripts that can lead to persistent cross-si… |
CVE-2022-43568 | High | 8.8 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a que… |
CVE-2022-43567 | High | 8.8 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run arbitrary operating system commands remotely through the use of spe… |
CVE-2022-43566 | High | 7.3 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can run risky commands using a more privileged user’s permissions to bypass… |
CVE-2022-43565 | High | 8.1 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the ‘tstats command handles Javascript Object Notation (JSON) lets an attacker bypass SPL s… |
CVE-2022-43564 | Medium | 4.9 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user who can create search macros and schedule search reports can cause a denial of serv… |
CVE-2022-43563 | High | 8.1 | 2022-11-04 | In Splunk Enterprise versions below 8.2.9 and 8.1.12, the way that the rex search command handles field names lets an attacker bypass SPL safeguards for risky… |
CVE-2022-43562 | Low | 3.0 | 2022-11-04 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, Splunk Enterprise fails to properly validate and escape the Host header, which could let a remote… |
CVE-2022-39384 | Medium | 5.6 | 2022-11-04 | OpenZeppelin Contracts is a library for secure smart contract development. Before version 4.4.1 but after 3.2.0, initializer functions that are invoked separat… |
CVE-2022-38654 | Medium | 5.5 | 2022-11-04 | HCL Domino is susceptible to an information disclosure vulnerability. In some scenarios, local calls made on the server to search the Domino directory will ig… |
CVE-2022-39344 | Critical | 9.8 | 2022-11-04 | Azure RTOS USBX is a USB host, device, and on-the-go (OTG) embedded stack, that is fully integrated with Azure RTOS ThreadX. Prior to version 6.1.12, the USB D… |
CVE-2022-38660 | High | 8.3 | 2022-11-04 | HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker could exploit this vulnerability to… |
CVE-2022-43945 | High | 7.5 | 2022-11-04 | The Linux kernel NFSD implementation prior to versions 5.19.17 and 6.0.2 are vulnerable to buffer overflow. NFSD tracks the number of pages held by each NFSD t… |
CVE-2022-40263 | Medium | 6.6 | 2022-11-04 | BD Totalys MultiProcessor, versions 1.70 and earlier, contain hardcoded credentials. If exploited, threat actors may be able to access, modify or delete sensit… |
CVE-2022-39387 | Critical | 9.1 | 2022-11-04 | XWiki OIDC has various tools to manipulate OpenID Connect protocol in XWiki. Prior to version 1.29.1, even if a wiki has an OpenID provider configured through… |
CVE-2022-31691 | Critical | 9.8 | 2022-11-04 | Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloud… |
CVE-2022-27894 | Medium | 4.8 | 2022-11-04 | The Foundry Blobster service was found to have a cross-site scripting (XSS) vulnerability that could have allowed an attacker with access to Foundry to launch… |
CVE-2022-20969 | Medium | 4.8 | 2022-11-04 | A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS)… |
CVE-2022-20963 | Medium | 5.4 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-… |
CVE-2022-20962 | Low | 3.8 | 2022-11-04 | A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unauthorized… |
CVE-2022-20961 | High | 8.8 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cros… |
CVE-2022-20960 | High | 7.5 | 2022-11-04 | A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a denial of service… |
CVE-2022-20958 | High | 8.3 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a se… |
CVE-2022-20956 | High | 7.1 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authoriza… |
CVE-2022-20951 | High | 7.7 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a serv… |
CVE-2022-20942 | Medium | 6.5 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and Web Manager, and Cisco Secure Web Applian… |
CVE-2022-20937 | Medium | 5.3 | 2022-11-04 | A vulnerability in a feature that monitors RADIUS requests on Cisco Identity Services Engine (ISE) Software could allow an unauthenticated, remote attacker to… |
CVE-2022-20868 | Medium | 4.7 | 2022-11-04 | A vulnerability in the web-based management interface of Cisco Email Security Appliance, Cisco Secure Email and Web Manager and Cisco Secure Web Appliance coul… |
CVE-2022-20867 | Medium | 5.4 | 2022-11-04 | A vulnerability in web-based management interface of the of Cisco Email Security Appliance and Cisco Secure Email and Web Manager could allow an authenticated… |
CVE-2022-20772 | Medium | 4.7 | 2022-11-04 | A vulnerability in Cisco Email Security Appliance (ESA) and Cisco Secure Email and Web Manager could allow an unauthenticated, remote attacker to conduct an HT… |
CVE-2022-27893 | Medium | 4.2 | 2022-11-04 | The Foundry Magritte plugin osisoft-pi-web-connector versions 0.15.0 - 0.43.0 was found to be logging in a manner that captured authentication requests. This v… |
CVE-2022-41671 | High | 7.0 | 2022-11-04 | A CWE-89: Improper Neutralization of Special Elements used in SQL Command (‘SQL Injection’) vulnerability exists that allows adversaries with local user privil… |
CVE-2022-41670 | High | 7.0 | 2022-11-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in the SGIUtility component that allows adversari… |
CVE-2022-41669 | High | 7.0 | 2022-11-04 | A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists in the SGIUtility component that allows adversaries with local user privileges… |
CVE-2022-3721 | Medium | 4.6 | 2022-11-04 | Code Injection in GitHub repository froxlor/froxlor prior to 0.10.39. |
CVE-2022-41668 | High | 7.0 | 2022-11-04 | A CWE-704: Incorrect Project Conversion vulnerability exists that allows adversaries with local user privileges to load a project file from an adversary-contro… |
CVE-2022-41667 | High | 7.0 | 2022-11-04 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that allows adversaries with local user privilege… |
CVE-2022-3340 | Medium | 5.9 | 2022-11-04 | XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the admini… |
CVE-2022-3023 | Critical | 9.8 | 2022-11-04 | Use of Externally-Controlled Format String in GitHub repository pingcap/tidb prior to 6.4.0, 6.1.3. |
CVE-2022-38582 | Medium | 6.5 | 2022-11-04 | Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files. |
CVE-2022-33684 | High | 8.1 | 2022-11-04 | The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureC… |
CVE-2022-44724 | High | 8.9 | 2022-11-04 | The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary HTML or JavaScript… |
CVE-2022-41666 | High | 7.0 | 2022-11-04 | A CWE-347: Improper Verification of Cryptographic Signature vulnerability exists that allows adversaries with local user privileges to load a malicious DLL whi… |
CVE-2022-43571 | High | 8.8 | 2022-11-03 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component. |
CVE-2022-43561 | Medium | 6.4 | 2022-11-03 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a remote user that holds the “power” Splunk role can store arbitrary scripts that can lead to per… |
CVE-2022-38168 | Critical | 9.1 | 2022-11-03 | Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the l… |
CVE-2022-44628 | Medium | 5.9 | 2022-11-03 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress. |
CVE-2022-44627 | Medium | 5.4 | 2022-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps. |
CVE-2022-43574 | High | 7.5 | 2022-11-03 | "IBM Robotic Process Automation 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to incorrect permission assignment which could allow access to applica… |
CVE-2022-43495 | Medium | 6.5 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had a DOS vulnerability in distributedhardware_device_manager when joining a network. Network attakcers can send an abono… |
CVE-2022-43451 | High | 8.4 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Multiple path traversal vulnerability in appspawn and nwebspawn services. Local attackers can create arbitrary dir… |
CVE-2022-43449 | Medium | 6.2 | 2022-11-03 | OpenHarmony-v3.1.2 and prior versions had an Arbitrary file read vulnerability via download_server. Local attackers can install an malicious application on the… |
CVE-2022-43063 | High | 7.2 | 2022-11-03 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Users.php?f=delete_client. |
CVE-2022-43062 | High | 7.2 | 2022-11-03 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_appoi… |
CVE-2022-43061 | High | 7.2 | 2022-11-03 | Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/travellers.php. Thi… |
CVE-2022-42749 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the… |
CVE-2022-42748 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible bec… |
CVE-2022-42747 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because th… |
CVE-2022-42746 | Medium | 6.1 | 2022-11-03 | CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because… |
CVE-2022-42745 | High | 7.5 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE. |
CVE-2022-42744 | Critical | 9.8 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not… |
CVE-2022-42743 | Medium | 5.3 | 2022-11-03 | deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correct… |
CVE-2022-42442 | Low | 3.3 | 2022-11-03 | IBM Robotic Process Automation for Cloud Pak 21.0.1, 21.0.2, 21.0.3, 21.0.4, and 21.0.5 is vulnerable to exposure of the first tenant owner e-mail address to… |
CVE-2022-41714 | Medium | 5.3 | 2022-11-03 | fastest-json-copy version 1.0.1 allows an external attacker to edit or add new properties to an object. This is possible because the application does not corre… |
CVE-2022-41713 | Medium | 5.3 | 2022-11-03 | deep-object-diff version 1.1.0 allows an external attacker to edit or add new properties to an object. This is possible because the application does not proper… |
CVE-2022-41710 | Medium | 5.5 | 2022-11-03 | Markdownify version 1.4.1 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file th… |