2022 CVEs (page 111)
Page 111 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36451 | High | 8.8 | 2022-10-25 | A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Requ… |
CVE-2022-42890 | High | 7.5 | 2022-10-25 | A vulnerability in Batik of Apache XML Graphics allows an attacker to run Java code from untrusted SVG via JavaScript. This issue affects Apache XML Graphics p… |
CVE-2022-41704 | High | 7.5 | 2022-10-25 | A vulnerability in Batik of Apache XML Graphics allows an attacker to run untrusted Java code from an SVG. This issue affects Apache XML Graphics prior to 1.16… |
CVE-2022-3395 | High | 8.8 | 2022-10-25 | The WP All Export Pro WordPress plugin before 1.7.9 uses the contents of the cc_sql POST parameter directly as a database query, allowing users which has been… |
CVE-2022-3394 | High | 7.2 | 2022-10-25 | The WP All Export Pro WordPress plugin before 1.7.9 does not limit some functionality during exports only to users with the Administrator role, allowing any lo… |
CVE-2022-3393 | Critical | 9.8 | 2022-10-25 | The Post to CSV by BestWebSoft WordPress plugin through 1.4.0 does not properly escape fields when exporting data as CSV, leading to a CSV injection |
CVE-2022-3392 | Medium | 4.8 | 2022-10-25 | The WP Humans.txt WordPress plugin through 1.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-3391 | Medium | 4.8 | 2022-10-25 | The Retain Live Chat WordPress plugin through 0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2022-3350 | Medium | 4.8 | 2022-10-25 | The Contact Bank WordPress plugin through 3.0.30 does not sanitise and escape some of its Form settings, which could allow high privilege users such as admin t… |
CVE-2022-3344 | Medium | 5.5 | 2022-10-25 | A flaw was found in the KVM's AMD nested virtualization (SVM). A malicious L1 guest could purposely fail to intercept the shutdown of a cooperative nested gues… |
CVE-2022-3335 | High | 7.2 | 2022-10-25 | The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections is… |
CVE-2022-3302 | High | 7.2 | 2022-10-25 | The Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.185.1 does not validate ids before using them in a SQL statement, which could le… |
CVE-2022-3300 | High | 7.2 | 2022-10-25 | The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL i… |
CVE-2022-3247 | Medium | 6.5 | 2022-10-25 | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the… |
CVE-2022-3246 | High | 8.8 | 2022-10-25 | The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL s… |
CVE-2022-3097 | Medium | 6.5 | 2022-10-25 | The Plugin LBstopattack WordPress plugin before 1.1.3 does not use nonces when saving its settings, making it possible for attackers to conduct CSRF attacks. T… |
CVE-2022-39837 | Medium | 5.5 | 2022-10-25 | An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that cras… |
CVE-2022-39836 | Medium | 5.5 | 2022-10-25 | An issue was discovered in Connected Vehicle Systems Alliance (COVESA) dlt-daemon through 2.18.8. Due to a faulty DLT file parser, a crafted DLT file that cras… |
CVE-2022-39351 | Medium | 4.4 | 2022-10-25 | Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Prior to version 4.6.0, p… |
CVE-2022-39350 | Medium | 5.4 | 2022-10-25 | @dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to… |
CVE-2022-39349 | Medium | 5.5 | 2022-10-25 | The Tasks.org Android app is an open-source app for to-do lists and reminders. The Tasks.org app uses the activity `ShareLinkActivity.kt` to handle "share" int… |
CVE-2022-39345 | Critical | 9.8 | 2022-10-25 | Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. Gin-vue-admin prior to 2.5.4 is vuln… |
CVE-2022-39342 | Medium | 5.9 | 2022-10-25 | OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users whose mod… |
CVE-2022-39341 | Medium | 5.9 | 2022-10-25 | OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have… |
CVE-2022-39340 | Medium | 5.3 | 2022-10-25 | OpenFGA is an authorization/permission engine. Prior to version 0.2.4, the `streamed-list-objects` endpoint was not validating the authorization header, result… |
CVE-2022-39327 | High | 8.1 | 2022-10-25 | Azure CLI is the command-line interface for Microsoft Azure. In versions previous to 2.40.0, Azure CLI contains a vulnerability for potential code injection. C… |
CVE-2022-39326 | High | 8.8 | 2022-10-25 | kartverket/github-workflows are shared reusable workflows for GitHub Actions. Prior to version 2.7.5, all users of the `run-terraform` reusable workflow from t… |
CVE-2022-39322 | Critical | 9.1 | 2022-10-25 | @keystone-6/core is a core package for Keystone 6, a content management system for Node.js. Starting with version 2.2.0 and prior to version 2.3.1, users who e… |
CVE-2022-39321 | High | 8.8 | 2022-10-25 | GitHub Actions Runner is the application that runs a job from a GitHub Actions workflow. The actions runner invokes the docker cli directly in order to run job… |
CVE-2022-39315 | Medium | 6.5 | 2022-10-25 | Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with use… |
CVE-2022-39312 | Critical | 9.8 | 2022-10-25 | Dataease is an open source data visualization analysis tool. Dataease prior to 1.15.2 has a deserialization vulnerability. In Dataease, the Mysql data source i… |
CVE-2022-38870 | High | 7.5 | 2022-10-25 | Free5gc v3.2.1 is vulnerable to Information disclosure. |
CVE-2022-38580 | Critical | 9.8 | 2022-10-25 | Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). |
CVE-2022-38436 | High | 7.8 | 2022-10-25 | Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which c… |
CVE-2022-38435 | High | 7.8 | 2022-10-25 | Adobe Illustrator versions 26.4 (and earlier) and 25.4.7 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrar… |
CVE-2022-38200 | Medium | 6.1 | 2022-10-25 | A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests c… |
CVE-2022-38199 | Medium | 6.1 | 2022-10-25 | A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated atta… |
CVE-2022-38198 | Medium | 6.1 | 2022-10-25 | There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated… |
CVE-2022-38197 | Medium | 6.1 | 2022-10-25 | Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessin… |
CVE-2022-38196 | Medium | 6.5 | 2022-10-25 | Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated att… |
CVE-2022-38195 | Medium | 6.1 | 2022-10-25 | There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convinc… |
CVE-2022-36783 | Medium | 6.5 | 2022-10-25 | AlgoSec – FireFlow Reflected Cross-Site-Scripting (RXSS) A malicious user injects JavaScript code into a parameter called IntersectudRule on the search/result… |
CVE-2022-35887 | High | 8.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security K… |
CVE-2022-35886 | High | 8.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security K… |
CVE-2022-35885 | High | 8.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security K… |
CVE-2022-35884 | High | 8.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security K… |
CVE-2022-35881 | High | 8.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A speci… |
CVE-2022-35880 | High | 8.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A speci… |
CVE-2022-35879 | High | 8.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A speci… |
CVE-2022-35878 | High | 8.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the UPnP logging functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6.9X. A speci… |
CVE-2022-35877 | Critical | 9.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Spec… |
CVE-2022-35876 | Critical | 9.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Spec… |
CVE-2022-35875 | Critical | 9.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Spec… |
CVE-2022-35874 | Critical | 9.8 | 2022-10-25 | Four format string injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. Spec… |
CVE-2022-35739 | Medium | 5.3 | 2022-10-25 | PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s icon, which can be modified to insert arbitrary content into the style t… |
CVE-2022-35271 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35270 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35269 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35268 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35267 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35266 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35265 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35264 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35263 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35262 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35261 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can… |
CVE-2022-35244 | Critical | 9.8 | 2022-10-25 | A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X and 6.9Z. A speciall… |
CVE-2022-35132 | High | 8.8 | 2022-10-25 | Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module. |
CVE-2022-34870 | Medium | 5.4 | 2022-10-25 | Apache Geode versions up to 1.15.0 are vulnerable to a Cross-Site Scripting (XSS) via data injection when using Pulse web application to view Region entries. |
CVE-2022-34850 | High | 7.2 | 2022-10-25 | An OS command injection vulnerability exists in the web_server /action/import_authorized_keys/ functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-cr… |
CVE-2022-34845 | Low | 2.7 | 2022-10-25 | A firmware update vulnerability exists in the sysupgrade functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network packet can lead to arbit… |
CVE-2022-33938 | Critical | 9.8 | 2022-10-25 | A format string injection vulnerability exists in the ghome_process_control_packet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z and 6… |
CVE-2022-33897 | Critical | 9.1 | 2022-10-25 | A directory traversal vulnerability exists in the web_server /ajax/remove/ functionality of Robustel R1510 3.1.16. A specially-crafted network request can lead… |
CVE-2022-33757 | Medium | 6.5 | 2022-10-25 | An authenticated attacker could read Nessus Debug Log file attachments from the web UI without having the correct privileges to do so. This may lead to the dis… |
CVE-2022-33207 | Critical | 9.9 | 2022-10-25 | Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit… |
CVE-2022-33206 | Critical | 9.9 | 2022-10-25 | Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit… |
CVE-2022-33205 | Critical | 9.9 | 2022-10-25 | Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit… |
CVE-2022-33204 | Critical | 9.9 | 2022-10-25 | Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit… |
CVE-2022-33195 | Critical | 10.0 | 2022-10-25 | Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD… |
CVE-2022-33194 | Critical | 10.0 | 2022-10-25 | Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD… |
CVE-2022-33193 | Critical | 10.0 | 2022-10-25 | Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD… |
CVE-2022-33192 | Critical | 10.0 | 2022-10-25 | Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD… |
CVE-2022-33189 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted X… |
CVE-2022-33150 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the js_package install functionality of Robustel R1510 3.1.16. A specially-crafted network request can lead to… |
CVE-2022-32775 | High | 8.8 | 2022-10-25 | An integer overflow vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X an… |
CVE-2022-32773 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-c… |
CVE-2022-32765 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network… |
CVE-2022-32760 | High | 7.5 | 2022-10-25 | A denial of service vulnerability exists in the XCMD doDebug functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-craft… |
CVE-2022-32586 | High | 8.8 | 2022-10-25 | An OS command injection vulnerability exists in the web interface /action/ipcamRecordPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9… |
CVE-2022-32574 | Medium | 6.5 | 2022-10-25 | A double-free vulnerability exists in the web interface /action/ipcamSetParamPost functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6… |
CVE-2022-32454 | Critical | 9.8 | 2022-10-25 | A stack-based buffer overflow vulnerability exists in the XCMD setIPCam functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A spec… |
CVE-2022-30603 | High | 8.8 | 2022-10-25 | An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z… |
CVE-2022-30541 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-c… |
CVE-2022-2762 | Medium | 6.5 | 2022-10-25 | The AdminPad WordPress plugin before 2.2 does not have CSRF check when updating admin's note, allowing attackers to make a logged in admin update their notes v… |
CVE-2022-29889 | Critical | 9.8 | 2022-10-25 | A hard-coded password vulnerability exists in the telnet functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. Use of a hard-coded root passw… |
CVE-2022-29851 | Critical | 9.8 | 2022-10-25 | documentconverter in OX App Suite through 7.10.6, in a non-default configuration with ghostscript, allows OS Command Injection because file conversion may occu… |
CVE-2022-29520 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the console_main_loop :sys functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-… |
CVE-2022-29477 | Critical | 9.8 | 2022-10-25 | An authentication bypass vulnerability exists in the web interface /action/factory* functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and… |
CVE-2022-29475 | High | 8.1 | 2022-10-25 | An information disclosure vulnerability exists in the XFINDER functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-craf… |
CVE-2022-29472 | Critical | 9.8 | 2022-10-25 | An OS command injection vulnerability exists in the web interface util_set_serial_mac functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X an… |