2022 CVEs (page 105)
Page 105 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40747 | Critical | 9.1 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploi… |
CVE-2022-40276 | Medium | 5.5 | 2022-11-03 | Zettlr version 2.3.0 allows an external attacker to remotely obtain arbitrary local files on any client that attempts to view a malicious markdown file through… |
CVE-2022-40235 | Medium | 6.5 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 could allow a user to cause a denial of service by removing the ability to run jobs due to improper input validation. I… |
CVE-2022-40230 | Medium | 6.5 | 2022-11-03 | "IBM MQ Appliance 9.2 CD, 9.2 LTS, 9.3 CD, and LTS 9.3 does not invalidate session after logout which could allow an authenticated user to impersonate another… |
CVE-2022-40131 | Medium | 5.4 | 2022-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Page View Count plugin <= 2.5.5 on WordPress allows an attacker to reset the plugin settings. |
CVE-2022-38712 | Medium | 5.9 | 2022-11-03 | "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwant… |
CVE-2022-38710 | Medium | 5.3 | 2022-11-03 | IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version to an unauthorized control sphere information that could aid in further attac… |
CVE-2022-36428 | Medium | 4.8 | 2022-11-03 | Auth. (admin+) Cross-Site Scripting (XSS) vulnerability in Stage Rock Convert plugin <= 2.11.0 on WordPress. |
CVE-2022-36404 | Medium | 5.4 | 2022-11-03 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO (WordPress plugin) plugin <= 1.8.12 versions. |
CVE-2022-35717 | High | 7.8 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted… |
CVE-2022-35642 | Medium | 5.4 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-35279 | Medium | 4.3 | 2022-11-03 | "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sen… |
CVE-2022-34339 | Medium | 6.5 | 2022-11-03 | "IBM Cognos Analytics 11.2.1, 11.2.0, 11.1.7 stores user credentials in plain clear text which can be read by an authenticated user. IBM X-Force ID: 229963." |
CVE-2022-30615 | Medium | 5.4 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-30608 | High | 8.8 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions… |
CVE-2022-25952 | Medium | 4.3 | 2022-11-03 | Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress. |
CVE-2022-22442 | Medium | 6.5 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 could allow an authenticated user to access information restricted to users with elevated privileges due to improper ac… |
CVE-2022-22425 | Critical | 9.8 | 2022-11-03 | "IBM InfoSphere Information Server 11.7 is potentially vulnerable to CSV Injection. A remote attacker could execute arbitrary commands on the system, caused by… |
CVE-2022-3258 | Low | 3.7 | 2022-11-03 | Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse. |
CVE-2022-43372 | Medium | 4.8 | 2022-11-03 | Emlog Pro v1.7.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability at /admin/store.php. |
CVE-2022-42753 | Medium | 6.1 | 2022-11-03 | SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate… |
CVE-2022-42751 | High | 8.8 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This… |
CVE-2022-42750 | High | 8.8 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validat… |
CVE-2022-3852 | High | 8.8 | 2022-11-03 | The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect n… |
CVE-2022-3675 | Low | 2.6 | 2022-11-03 | Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB comm… |
CVE-2022-3776 | High | 8.8 | 2022-11-03 | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin… |
CVE-2022-2696 | Medium | 6.3 | 2022-11-03 | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions… |
CVE-2022-39376 | Low | 2.6 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39375 | Medium | 4.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39373 | Medium | 4.9 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39372 | Low | 3.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39371 | High | 7.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39370 | Medium | 4.3 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39277 | Medium | 4.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39323 | High | 7.4 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-44646 | Low | 2.2 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings |
CVE-2022-44624 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters |
CVE-2022-44623 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings |
CVE-2022-44622 | Low | 2.7 | 2022-11-03 | In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive |
CVE-2022-43109 | Critical | 9.8 | 2022-11-03 | D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers… |
CVE-2022-43108 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function. |
CVE-2022-43107 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function. |
CVE-2022-43106 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the schedStartTime parameter in the setSchedWifi function. |
CVE-2022-43105 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. |
CVE-2022-43104 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the wpapsk_crypto parameter in the fromSetWirelessRepeat function. |
CVE-2022-43103 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the list parameter in the formSetQosBand function. |
CVE-2022-43102 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function. |
CVE-2022-43101 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function. |
CVE-2022-39382 | Critical | 9.8 | 2022-11-03 | Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive… |
CVE-2022-39276 | Low | 3.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39262 | Medium | 5.2 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text conte… |
CVE-2022-39234 | Medium | 4.7 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-41435 | Medium | 5.4 | 2022-11-03 | OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js… |
CVE-2022-32287 | High | 7.5 | 2022-11-03 | A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the… |
CVE-2022-44638 | High | 8.8 | 2022-11-03 | In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixma… |
CVE-2022-44586 | Medium | 4.8 | 2022-11-02 | Auth. (admin+) Stored Cross-Site Scripting (XSS) in Ayoub Media AM-HiLi plugin <= 1.0 on WordPress. |
CVE-2022-44576 | Medium | 4.8 | 2022-11-02 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in AgentEasy Properties plugin <= 1.0.4 on WordPress. |
CVE-2022-3181 | High | 7.5 | 2022-11-02 | An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request could cause the affecte… |
CVE-2022-43068 | High | 7.2 | 2022-11-02 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reser… |
CVE-2022-43066 | High | 7.2 | 2022-11-02 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Master.php?f=delete… |
CVE-2022-3845 | Low | 2.4 | 2022-11-02 | A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/impor… |
CVE-2022-3844 | Low | 3.5 | 2022-11-02 | A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation… |
CVE-2022-2904 | High | 7.3 | 2022-11-02 | A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions starting from 15.3 befor… |
CVE-2022-24936 | High | 8.3 | 2022-11-02 | Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key… |
CVE-2022-43227 | High | 7.2 | 2022-11-02 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/admin/?page=appointments/vi… |
CVE-2022-43226 | High | 8.8 | 2022-11-02 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/?page=appointments/view_app… |
CVE-2022-3575 | Critical | 9.8 | 2022-11-02 | Frauscher Sensortechnik GmbH FDS102 for FAdC R2 and FAdCi R2 v2.8.0 to v2.9.1 are vulnerable to malicious code upload without authentication by using the confi… |
CVE-2022-39378 | Medium | 5.3 | 2022-11-02 | Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restr… |
CVE-2022-39356 | High | 8.9 | 2022-11-02 | Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can enter any non-admin use… |
CVE-2022-39353 | Critical | 9.4 | 2022-11-02 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because… |
CVE-2022-39241 | High | 7.6 | 2022-11-02 | Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local host or other hosts o… |
CVE-2022-41716 | High | 7.5 | 2022-11-02 | Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid envi… |
CVE-2022-41551 | High | 7.2 | 2022-11-02 | Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editorder.php. |
CVE-2022-39381 | High | 7.5 | 2022-11-02 | Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara be… |
CVE-2022-43995 | High | 7.1 | 2022-11-02 | Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-base… |
CVE-2022-43255 | Medium | 5.5 | 2022-11-02 | GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf_odf_new_iod at odf/odf_code.c. |
CVE-2022-43254 | Medium | 5.5 | 2022-11-02 | GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf_list_new at utils/list.c. |
CVE-2022-43253 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in fallback-motion.cc. This vulnerability al… |
CVE-2022-43252 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-motion.cc. This vulnerability allows attack… |
CVE-2022-43250 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnerability allows at… |
CVE-2022-43249 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerabili… |
CVE-2022-43248 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_weighted_pred_avg_16_fallback in fallback-motion.cc. This vulnerability… |
CVE-2022-43245 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc. This vulnerability allows attackers to cau… |
CVE-2022-43244 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability… |
CVE-2022-43243 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. This vulnerability all… |
CVE-2022-43242 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char> in motion.cc. This vulnerability allows attackers to… |
CVE-2022-43241 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a… |
CVE-2022-43240 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This vulnerability allow… |
CVE-2022-43239 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.cc. This vulnerability allows attackers… |
CVE-2022-43238 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This vulnerability allows attackers to cause… |
CVE-2022-43237 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulne… |
CVE-2022-43236 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability… |
CVE-2022-43235 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc. This vulnerability allo… |
CVE-2022-43670 | Medium | 5.4 | 2022-11-02 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may all… |
CVE-2022-40840 | Medium | 6.1 | 2022-11-02 | ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php. |
CVE-2022-3827 | Medium | 6.3 | 2022-11-02 | A vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formContactGroup.php of the compon… |
CVE-2022-3826 | Medium | 4.3 | 2022-11-02 | A vulnerability was found in Huaxia ERP. It has been classified as problematic. This affects an unknown part of the file /depotHead/list of the component Retai… |
CVE-2022-3825 | Medium | 6.3 | 2022-11-02 | A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management… |
CVE-2022-3810 | Medium | 4.3 | 2022-11-02 | A vulnerability was found in Axiomatic Bento4. It has been classified as problematic. This affects the function AP4_File::AP4_File of the file Mp42Hevc.cpp of… |
CVE-2022-3809 | Medium | 4.3 | 2022-11-02 | A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag… |