2022 CVEs (page 123)
Page 123 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3137 | Medium | 5.4 | 2022-10-10 | The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber)… |
CVE-2022-3136 | Medium | 4.8 | 2022-10-10 | The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2022-39288 | High | 7.5 | 2022-10-10 | fastify is a fast and low overhead web framework, for Node.js. Affected versions of fastify are subject to a denial of service via malicious use of the Content… |
CVE-2022-36063 | High | 7.6 | 2022-10-10 | Azure RTOS USBx is a USB host, device, and on-the-go (OTG) embedded stack, fully integrated with Azure RTOS ThreadX and available for all Azure RTOS ThreadX–su… |
CVE-2022-34425 | High | 7.5 | 2022-10-10 | Dell Enterprise SONiC OS, 4.0.0, 4.0.1, contain a cryptographic key vulnerability in SSH. An unauthenticated remote attacker could potentially exploit this vul… |
CVE-2022-34402 | Medium | 6.8 | 2022-10-10 | Dell Wyse ThinOS 2205 contains a Regular Expression Denial of Service Vulnerability in UI. An admin privilege attacker could potentially exploit this vulnerabi… |
CVE-2022-34334 | Medium | 6.5 | 2022-10-10 | IBM Sterling Partner Engagement Manager 2.0 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the… |
CVE-2022-2981 | Medium | 4.9 | 2022-10-10 | The Download Monitor WordPress plugin before 4.5.98 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high p… |
CVE-2022-2891 | Medium | 5.9 | 2022-10-10 | The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the… |
CVE-2022-2823 | Medium | 4.8 | 2022-10-10 | The Slider, Gallery, and Carousel by MetaSlider WordPress plugin before 3.27.9 does not sanitise and escape some of its Gallery Image parameters, which could a… |
CVE-2022-2629 | Medium | 4.8 | 2022-10-10 | The Top Bar WordPress plugin before 3.0.4 does not sanitise and escape some of its settings before outputting them in frontend pages, which could allow high pr… |
CVE-2022-2554 | Medium | 4.9 | 2022-10-10 | The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege user… |
CVE-2022-2448 | Medium | 4.8 | 2022-10-10 | The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform… |
CVE-2022-2350 | Medium | 5.3 | 2022-10-10 | The Disable User Login WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating its settings, allowing unauthenticated attacker… |
CVE-2022-20944 | Medium | 6.1 | 2022-10-10 | A vulnerability in the software image verification functionality of Cisco IOS XE Software for Cisco Catalyst 9200 Series Switches could allow an unauthenticate… |
CVE-2022-20920 | High | 7.7 | 2022-10-10 | A vulnerability in the SSH implementation of Cisco IOS Software and Cisco IOS XE Software could allow an authenticated, remote attacker to cause an affected de… |
CVE-2022-20915 | High | 7.4 | 2022-10-10 | A vulnerability in the implementation of IPv6 VPN over MPLS (6VPE) with Zone-Based Firewall (ZBFW) of Cisco IOS XE Software could allow an unauthenticated, adj… |
CVE-2022-20870 | High | 8.6 | 2022-10-10 | A vulnerability in the egress MPLS packet processing function of Cisco IOS XE Software for Cisco Catalyst 3650, Catalyst 3850, and Catalyst 9000 Family Switche… |
CVE-2022-20864 | Medium | 4.6 | 2022-10-10 | A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor (ROMMON) Software for Cisco Catalyst Switches could allow an unauthenticat… |
CVE-2022-20837 | High | 8.6 | 2022-10-10 | A vulnerability in the DNS application layer gateway (ALG) functionality that is used by Network Address Translation (NAT) in Cisco IOS XE Software could allow… |
CVE-2022-20830 | Medium | 5.3 | 2022-10-10 | A vulnerability in authentication mechanism of Cisco Software-Defined Application Visibility and Control (SD-AVC) on Cisco vManage could allow an unauthenticat… |
CVE-2022-40257 | Medium | 5.4 | 2022-10-10 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via a crafted email with… |
CVE-2022-40248 | Medium | 5.4 | 2022-10-10 | An HTML injection vulnerability exists in CERT/CC VINCE software prior to 1.50.4. An authenticated attacker can inject arbitrary HTML via form using the "Produ… |
CVE-2022-39292 | High | 7.5 | 2022-10-10 | Slack Morphism is a modern client library for Slack Web/Events API/Socket Mode and Block Kit. Debug logs expose sensitive URLs for Slack webhooks that contain… |
CVE-2022-3442 | Low | 3.5 | 2022-10-10 | A vulnerability was found in Crealogix EBICS 7.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /ebics-ser… |
CVE-2022-26121 | Low | 3.7 | 2022-10-10 | An exposure of resource to wrong sphere vulnerability [CWE-668] in FortiAnalyzer and FortiManager GUI 7.0.0 through 7.0.3, 6.4.0 through 6.4.8, 6.2.0 through 6… |
CVE-2022-3438 | Medium | 6.1 | 2022-10-10 | Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. |
CVE-2022-42725 | High | 7.5 | 2022-10-10 | Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links. |
CVE-2022-42724 | Medium | 4.3 | 2022-10-10 | app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have). |
CVE-2022-42012 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-42011 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-42010 | Medium | 6.5 | 2022-10-10 | An issue was discovered in D-Bus before 1.12.24, 1.13.x and 1.14.x before 1.14.4, and 1.15.x before 1.15.2. An authenticated attacker can cause dbus-daemon and… |
CVE-2022-42703 | Medium | 5.5 | 2022-10-09 | mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse. |
CVE-2022-3436 | Medium | 6.3 | 2022-10-09 | A vulnerability classified as critical was found in SourceCodester Web-Based Student Clearance System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2022-3435 | Medium | 4.3 | 2022-10-08 | A vulnerability classified as problematic has been found in Linux Kernel. This affects the function fib_nh_match of the file net/ipv4/fib_semantics.c of the co… |
CVE-2022-3434 | Low | 3.5 | 2022-10-08 | A vulnerability was found in SourceCodester Web-Based Student Clearance System. It has been rated as problematic. Affected by this issue is the function prepar… |
CVE-2022-39281 | Medium | 6.5 | 2022-10-08 | fat_free_crm is a an open source, Ruby on Rails customer relationship management platform (CRM). In versions prior to 0.20.1 an authenticated user can perform… |
CVE-2022-36635 | High | 8.8 | 2022-10-07 | ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do. |
CVE-2022-41442 | Medium | 6.1 | 2022-10-07 | PicUploader v2.6.3 was discovered to contain cross-site scripting (XSS) vulnerability via the setStorageParams function in SettingController.php. |
CVE-2022-39959 | High | 7.8 | 2022-10-07 | Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder. This leads to privilege escalation… |
CVE-2022-41574 | High | 7.5 | 2022-10-07 | An access-control vulnerability in Gradle Enterprise 2022.4 through 2022.3.1 allows remote attackers to prevent backups from occurring, and send emails with ar… |
CVE-2022-3276 | High | 8.4 | 2022-10-07 | Command injection is possible in the puppetlabs-mysql module prior to version 13.0.0. A malicious actor is able to exploit this vulnerability only if they are… |
CVE-2022-3275 | High | 8.4 | 2022-10-07 | Command injection is possible in the puppetlabs-apt module prior to version 9.0.0. A malicious actor is able to exploit this vulnerability only if they are abl… |
CVE-2022-39291 | Medium | 5.4 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. Affected versions of zoneminder are subject to a vulnerability which allows u… |
CVE-2022-39290 | High | 8.0 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions authenticated users can bypass CSRF keys by modifying th… |
CVE-2022-39289 | Critical | 9.1 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user… |
CVE-2022-39285 | High | 7.6 | 2022-10-07 | ZoneMinder is a free, open source Closed-circuit television software application The file parameter is vulnerable to a cross site scripting vulnerability (XSS)… |
CVE-2022-31681 | Medium | 6.5 | 2022-10-07 | VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service cond… |
CVE-2022-31680 | Critical | 9.1 | 2022-10-07 | The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter s… |
CVE-2022-39287 | High | 8.1 | 2022-10-07 | tiny-csrf is a Node.js cross site request forgery (CSRF) protection middleware. In versions prior to 1.1.0 cookies were not encrypted and thus CSRF tokens were… |
CVE-2022-36634 | High | 8.8 | 2022-10-07 | An access control issue in ZKTeco ZKBioSecurity V5000 3.0.5_r allows attackers to arbitrarily create admin users via a crafted HTTP request. |
CVE-2022-32593 | Medium | 6.7 | 2022-10-07 | In vowe, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-32592 | Medium | 6.7 | 2022-10-07 | In cpu dvfs, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution priv… |
CVE-2022-32591 | High | 7.5 | 2022-10-07 | In ril, there is a possible system crash due to an incorrect bounds check. This could lead to remote denial of service with no additional execution privileges… |
CVE-2022-32590 | Medium | 6.7 | 2022-10-07 | In wlan, there is a possible use after free due to an incorrect status check. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-32589 | High | 7.5 | 2022-10-07 | In Wi-Fi driver, there is a possible way to disconnect Wi-Fi due to an improper resource release. This could lead to remote denial of service with no additiona… |
CVE-2022-26475 | Medium | 6.7 | 2022-10-07 | In wlan, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-26474 | Medium | 6.7 | 2022-10-07 | In sensorhub, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with Sys… |
CVE-2022-26473 | Medium | 6.7 | 2022-10-07 | In vdec fmt, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges need… |
CVE-2022-26472 | High | 7.8 | 2022-10-07 | In ims, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional execut… |
CVE-2022-26471 | High | 7.8 | 2022-10-07 | In telephony, there is a possible escalation of privilege due to a parcel format mismatch. This could lead to local escalation of privilege with no additional… |
CVE-2022-26452 | Medium | 6.7 | 2022-10-07 | In isp, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-42075 | Critical | 9.8 | 2022-10-07 | Wedding Planner v1.0 is vulnerable to arbitrary code execution. |
CVE-2022-42074 | High | 7.2 | 2022-10-07 | Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editcategory.php?id=. |
CVE-2022-42073 | High | 7.2 | 2022-10-07 | Online Diagnostic Lab Management System v1.0 is vulnerable to SQL Injection via /diagnostic/editclient.php?id=. |
CVE-2022-41392 | Medium | 5.4 | 2022-10-07 | A cross-site scripting (XSS) vulnerability in TotalJS commit 8c2c8909 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected… |
CVE-2022-41379 | High | 7.2 | 2022-10-07 | An arbitrary file upload vulnerability in the component /leave_system/classes/Users.php?f=save of Online Leave Management System v1.0 allows attackers to execu… |
CVE-2022-41378 | High | 7.2 | 2022-10-07 | Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=inventory/manage_inventory. |
CVE-2022-41377 | High | 7.2 | 2022-10-07 | Online Pet Shop We App v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /pet_shop/admin/?page=maintenance/manage_category. |
CVE-2022-37896 | Medium | 6.1 | 2022-10-07 | A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow a remote attacker to conduct a reflected cross-site scripting (XSS)… |
CVE-2022-37895 | Medium | 4.9 | 2022-10-07 | An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitat… |
CVE-2022-37894 | Medium | 6.5 | 2022-10-07 | An unauthenticated Denial of Service (DoS) vulnerability exists in the handling of certain SSID strings by Aruba InstantOS and ArubaOS 10. Successful exploitat… |
CVE-2022-37893 | High | 7.8 | 2022-10-07 | An authenticated command injection vulnerability exists in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of this vulnerabi… |
CVE-2022-42092 | High | 7.2 | 2022-10-07 | Backdrop CMS 1.22.0 has Unrestricted File Upload vulnerability via 'themes' that allows attackers to Remote Code Execution. Note: Third parties dispute this an… |
CVE-2022-41515 | High | 7.2 | 2022-10-07 | Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_p… |
CVE-2022-41514 | High | 7.2 | 2022-10-07 | Open Source SACCO Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /sacco_shield/ajax.php?action=delete_l… |
CVE-2022-41513 | High | 7.2 | 2022-10-07 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /diagnostic/edittest.php. |
CVE-2022-41512 | High | 7.2 | 2022-10-07 | An arbitrary file upload vulnerability in the component /php_action/editFile.php of Online Diagnostic Lab Management System v1.0 allows attackers to execute ar… |
CVE-2022-41414 | Medium | 5.3 | 2022-10-07 | An insecure default in the component auth.login.prompt.enabled of Liferay Portal v7.0.0 through v7.4.2 allows attackers to enumerate usernames, site names, and… |
CVE-2022-37892 | Medium | 5.4 | 2022-10-07 | A vulnerability in the Aruba InstantOS and ArubaOS 10 web management interface could allow an unauthenticated remote attacker to conduct a stored cross-site sc… |
CVE-2022-37891 | Critical | 9.8 | 2022-10-07 | Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in th… |
CVE-2022-37890 | Critical | 9.8 | 2022-10-07 | Unauthenticated buffer overflow vulnerabilities exist within the Aruba InstantOS and ArubaOS 10 web management interface. Successful exploitation results in th… |
CVE-2022-37889 | Critical | 9.8 | 2022-10-07 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2022-37887 | Critical | 9.8 | 2022-10-07 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2022-37886 | Critical | 9.8 | 2022-10-07 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2022-37885 | Critical | 9.8 | 2022-10-07 | There are buffer overflow vulnerabilities in multiple underlying services that could lead to unauthenticated remote code execution by sending specially crafted… |
CVE-2022-21936 | High | 8.1 | 2022-10-07 | On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP… |
CVE-2022-41291 | Medium | 6.5 | 2022-10-07 | IBM InfoSphere Information Server 11.7 does not invalidate session after logout which could allow an authenticated user to impersonate another user on the syst… |
CVE-2022-36772 | Medium | 6.5 | 2022-10-07 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a privileged user. |
CVE-2022-34308 | Medium | 5.5 | 2022-10-07 | IBM CICS TX 11.1 could allow a local user to cause a denial of service due to improper load handling. IBM X-Force ID: 229437. |
CVE-2022-30613 | Medium | 5.5 | 2022-10-07 | IBM QRadar SIEM 7.4 and 7.5 could disclose sensitive information via a local service to a privileged user. IBM X-Force ID: 227366. |
CVE-2022-22493 | High | 8.8 | 2022-10-07 | IBM WebSphere Automation for Cloud Pak for Watson AIOps 1.4.2 is vulnerable to cross-site request forgery, caused by improper cookie attribute setting. IBM X-F… |
CVE-2022-22480 | High | 7.5 | 2022-10-07 | IBM QRadar SIEM 7.4 and 7.5 data node rebalancing does not function correctly when using encrypted hosts which could result in information disclosure. IBM X-Fo… |
CVE-2022-39878 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in Samsung Checkout prior to version 5.0.55.3 allows attackers to access sensitive information via implicit intent broadc… |
CVE-2022-39877 | Medium | 4.0 | 2022-10-07 | Improper access control vulnerability in ProfileSharingAccount in Group Sharing prior to versions 13.0.6.15 in Android S(12), 13.0.6.14 in Android R(11) and be… |
CVE-2022-39876 | Medium | 5.9 | 2022-10-07 | Insertion of Sensitive Information into Log in PushRegIdUpdateClient of SReminder prior to 8.2.01.13 allows attacker to access device IMEI. |
CVE-2022-39875 | Medium | 5.1 | 2022-10-07 | Improper component protection vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. |
CVE-2022-39874 | Medium | 4.0 | 2022-10-07 | Sensitive log information leakage vulnerability in Samsung Account prior to version 13.5.0 allows attackers to unauthorized logout. |
CVE-2022-39873 | Medium | 4.3 | 2022-10-07 | Improper authorization vulnerability in Samsung Internet prior to version 18.0.4.14 allows physical attackers to add bookmarks in secret mode without user auth… |
CVE-2022-39872 | Medium | 5.9 | 2022-10-07 | Improper restriction of broadcasting Intent in ShareLive prior to version 13.2.03.5 leaks MAC address of the connected Bluetooth device. |