2022 CVEs (page 105)
Page 105 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42753 | Medium | 6.1 | 2022-11-03 | SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate… |
CVE-2022-42751 | High | 8.8 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This… |
CVE-2022-42750 | High | 8.8 | 2022-11-03 | CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validat… |
CVE-2022-3852 | High | 8.8 | 2022-11-03 | The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect n… |
CVE-2022-3675 | Low | 2.6 | 2022-11-03 | Fedora CoreOS supports setting a GRUB bootloader password using a Butane config. When this feature is enabled, GRUB requires a password to access the GRUB comm… |
CVE-2022-3776 | High | 8.8 | 2022-11-03 | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and includin… |
CVE-2022-2696 | Medium | 6.3 | 2022-11-03 | The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions… |
CVE-2022-39376 | Low | 2.6 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39375 | Medium | 4.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39373 | Medium | 4.9 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39372 | Low | 3.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39371 | High | 7.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39370 | Medium | 4.3 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39277 | Medium | 4.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39323 | High | 7.4 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-44646 | Low | 2.2 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings |
CVE-2022-44624 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters |
CVE-2022-44623 | Medium | 6.5 | 2022-11-03 | In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings |
CVE-2022-44622 | Low | 2.7 | 2022-11-03 | In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive |
CVE-2022-43109 | Critical | 9.8 | 2022-11-03 | D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers… |
CVE-2022-43108 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function. |
CVE-2022-43107 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function. |
CVE-2022-43106 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the schedStartTime parameter in the setSchedWifi function. |
CVE-2022-43105 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function. |
CVE-2022-43104 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the wpapsk_crypto parameter in the fromSetWirelessRepeat function. |
CVE-2022-43103 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the list parameter in the formSetQosBand function. |
CVE-2022-43102 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function. |
CVE-2022-43101 | Critical | 9.8 | 2022-11-03 | Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function. |
CVE-2022-39382 | Critical | 9.8 | 2022-11-03 | Keystone is a headless CMS for Node.js — built with GraphQL and React.`@keystone-6/core@3.0.0 || 3.0.1` users that use `NODE_ENV` to trigger security-sensitive… |
CVE-2022-39276 | Low | 3.5 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-39262 | Medium | 5.2 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package, GLPI administrator can define rich-text conte… |
CVE-2022-39234 | Medium | 4.7 | 2022-11-03 | GLPI stands for Gestionnaire Libre de Parc Informatique. GLPI is a Free Asset and IT Management Software package that provides ITIL Service Desk features, lice… |
CVE-2022-41435 | Medium | 5.4 | 2022-11-03 | OpenWRT LuCI version git-22.140.66206-02913be was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /system/sshkeys.js… |
CVE-2022-32287 | High | 7.5 | 2022-11-03 | A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the… |
CVE-2022-44638 | High | 8.8 | 2022-11-03 | In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixma… |
CVE-2022-44586 | Medium | 4.8 | 2022-11-02 | Auth. (admin+) Stored Cross-Site Scripting (XSS) in Ayoub Media AM-HiLi plugin <= 1.0 on WordPress. |
CVE-2022-44576 | Medium | 4.8 | 2022-11-02 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in AgentEasy Properties plugin <= 1.0.4 on WordPress. |
CVE-2022-3181 | High | 7.5 | 2022-11-02 | An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request could cause the affecte… |
CVE-2022-43068 | High | 7.2 | 2022-11-02 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reser… |
CVE-2022-43066 | High | 7.2 | 2022-11-02 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Master.php?f=delete… |
CVE-2022-3845 | Low | 2.4 | 2022-11-02 | A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/impor… |
CVE-2022-3844 | Low | 3.5 | 2022-11-02 | A vulnerability, which was classified as problematic, was found in Webmin 2.001. Affected is an unknown function of the file xterm/index.cgi. The manipulation… |
CVE-2022-2904 | High | 7.3 | 2022-11-02 | A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions starting from 15.3 befor… |
CVE-2022-24936 | High | 8.3 | 2022-11-02 | Out-of-Bounds error in GBL parser in Silicon Labs Gecko Bootloader version 4.0.1 and earlier allows attacker to overwrite flash Sign key and OTA decryption key… |
CVE-2022-43227 | High | 7.2 | 2022-11-02 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/admin/?page=appointments/vi… |
CVE-2022-43226 | High | 8.8 | 2022-11-02 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/?page=appointments/view_app… |
CVE-2022-3575 | Critical | 9.8 | 2022-11-02 | Frauscher Sensortechnik GmbH FDS102 for FAdC R2 and FAdCi R2 v2.8.0 to v2.9.1 are vulnerable to malicious code upload without authentication by using the confi… |
CVE-2022-39378 | Medium | 5.3 | 2022-11-02 | Discourse is a platform for community discussion. Under certain conditions, a user badge may have been awarded based on a user's activity in a topic with restr… |
CVE-2022-39356 | High | 8.9 | 2022-11-02 | Discourse is a platform for community discussion. Users who receive an invitation link that is not scoped to a single email address can enter any non-admin use… |
CVE-2022-39353 | Critical | 9.4 | 2022-11-02 | xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. xmldom parses XML that is not well-formed because… |
CVE-2022-39241 | High | 7.6 | 2022-11-02 | Discourse is a platform for community discussion. A malicious admin could use this vulnerability to perform port enumeration on the local host or other hosts o… |
CVE-2022-41716 | High | 7.5 | 2022-11-02 | Due to unsanitized NUL values, attackers may be able to maliciously set environment variables on Windows. In syscall.StartProcess and os/exec.Cmd, invalid envi… |
CVE-2022-41551 | High | 7.2 | 2022-11-02 | Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editorder.php. |
CVE-2022-39381 | High | 7.5 | 2022-11-02 | Muhammara is a node module with c/cpp bindings to modify PDF with js for node or electron (based/replacement on/of galkhana/hummusjs). The package muhammara be… |
CVE-2022-43995 | High | 7.1 | 2022-11-02 | Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result in a heap-base… |
CVE-2022-43255 | Medium | 5.5 | 2022-11-02 | GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf_odf_new_iod at odf/odf_code.c. |
CVE-2022-43254 | Medium | 5.5 | 2022-11-02 | GPAC v2.1-DEV-rev368-gfd054169b-master was discovered to contain a memory leak via the component gf_list_new at utils/list.c. |
CVE-2022-43253 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_unweighted_pred_16_fallback in fallback-motion.cc. This vulnerability al… |
CVE-2022-43252 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_16_fallback in fallback-motion.cc. This vulnerability allows attack… |
CVE-2022-43250 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnerability allows at… |
CVE-2022-43249 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerabili… |
CVE-2022-43248 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_weighted_pred_avg_16_fallback in fallback-motion.cc. This vulnerability… |
CVE-2022-43245 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc. This vulnerability allows attackers to cau… |
CVE-2022-43244 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability… |
CVE-2022-43243 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. This vulnerability all… |
CVE-2022-43242 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char> in motion.cc. This vulnerability allows attackers to… |
CVE-2022-43241 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a… |
CVE-2022-43240 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This vulnerability allow… |
CVE-2022-43239 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.cc. This vulnerability allows attackers… |
CVE-2022-43238 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This vulnerability allows attackers to cause… |
CVE-2022-43237 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulne… |
CVE-2022-43236 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability… |
CVE-2022-43235 | Medium | 6.5 | 2022-11-02 | Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc. This vulnerability allo… |
CVE-2022-43670 | Medium | 5.4 | 2022-11-02 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.0 and prior may all… |
CVE-2022-40840 | Medium | 6.1 | 2022-11-02 | ndk design NdkAdvancedCustomizationFields 3.5.0 is vulnerable to Cross Site Scripting (XSS) via createPdf.php. |
CVE-2022-3827 | Medium | 6.3 | 2022-11-02 | A vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formContactGroup.php of the compon… |
CVE-2022-3826 | Medium | 4.3 | 2022-11-02 | A vulnerability was found in Huaxia ERP. It has been classified as problematic. This affects an unknown part of the file /depotHead/list of the component Retai… |
CVE-2022-3825 | Medium | 6.3 | 2022-11-02 | A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management… |
CVE-2022-3810 | Medium | 4.3 | 2022-11-02 | A vulnerability was found in Axiomatic Bento4. It has been classified as problematic. This affects the function AP4_File::AP4_File of the file Mp42Hevc.cpp of… |
CVE-2022-3809 | Medium | 4.3 | 2022-11-02 | A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag… |
CVE-2022-39379 | Low | 3.1 | 2022-11-02 | Fluentd collects events from various data sources and writes them to files, RDBMS, NoSQL, IaaS, SaaS, Hadoop and so on. A remote code execution (RCE) vulnerabi… |
CVE-2022-43985 | Medium | 6.1 | 2022-11-02 | In Apache Airflow versions prior to 2.4.2, there was an open redirect in the webserver's `/confirm` endpoint. |
CVE-2022-43982 | Medium | 6.1 | 2022-11-02 | In Apache Airflow versions prior to 2.4.2, the "Trigger DAG with config" screen was susceptible to XSS attacks via the `origin` query argument. |
CVE-2022-42473 | Medium | 5.3 | 2022-11-02 | A missing authentication for a critical function vulnerability in Fortinet FortiSOAR 6.4.0 - 6.4.4 and 7.0.0 - 7.0.3 and 7.2.0 allows an attacker to disclose i… |
CVE-2022-39950 | High | 8.0 | 2022-11-02 | An improper neutralization of input during web page generation vulnerability [CWE-79] exists in FortiManager and FortiAnalyzer 6.0.0 all versions, 6.2.0 all ve… |
CVE-2022-39949 | Medium | 4.4 | 2022-11-02 | An improper control of a resource through its lifetime vulnerability [CWE-664] in FortiEDR CollectorWindows 4.0.0 through 4.1, 5.0.0 through 5.0.3.751, 5.1.0 m… |
CVE-2022-39945 | Medium | 5.4 | 2022-11-02 | An improper access control vulnerability [CWE-284] in FortiMail 7.2.0, 7.0.0 through 7.0.3, 6.4 all versions, 6.2 all versions, 6.0 all versions may allow an a… |
CVE-2022-38381 | Medium | 5.3 | 2022-11-02 | An improper handling of malformed request vulnerability [CWE-228] exists in FortiADC 5.0 all versions, 6.0.0 all versions, 6.1.0 all versions, 6.2.0 through 6… |
CVE-2022-38380 | Medium | 4.3 | 2022-11-02 | An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to… |
CVE-2022-38374 | High | 8.8 | 2022-11-02 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker… |
CVE-2022-38373 | High | 8.0 | 2022-11-02 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 m… |
CVE-2022-38372 | Medium | 6.7 | 2022-11-02 | A hidden functionality vulnerability [CWE-1242] in FortiTester CLI 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow a local, privileged… |
CVE-2022-35851 | High | 8.0 | 2022-11-02 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface 7.1.0 may allow a remote and authenticat… |
CVE-2022-35842 | Low | 3.7 | 2022-11-02 | An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versi… |
CVE-2022-33878 | Low | 2.2 | 2022-11-02 | An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiClient for Mac versions 7.0.0 through 7.0.5 may allow a local aut… |
CVE-2022-33870 | High | 7.8 | 2022-11-02 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 3.0.0 through 3.9.1… |
CVE-2022-30307 | Low | 3.9 | 2022-11-02 | A key management error vulnerability [CWE-320] affecting the RSA SSH host key in FortiOS 7.2.0 and below, 7.0.6 and below, 6.4.9 and below may allow an unauthe… |
CVE-2022-26122 | Medium | 4.7 | 2022-11-02 | An insufficient verification of data authenticity vulnerability [CWE-345] in FortiClient, FortiMail and FortiOS AV engines version 6.2.168 and below and versio… |
CVE-2022-26119 | High | 7.8 | 2022-11-02 | A improper authentication vulnerability in Fortinet FortiSIEM before 6.5.0 allows a local attacker with CLI access to perform operations on the Glassfish serve… |
CVE-2022-3723 | High | 8.8 | 2022-11-01 | Type confusion in V8 in Google Chrome prior to 107.0.5304.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |