2022 CVEs (page 128)
Page 128 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3039 | High | 8.8 | 2022-09-26 | Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-3038 | High | 8.8 | 2022-09-26 | Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2022-2998 | High | 8.8 | 2022-09-26 | Use after free in Browser Creation in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who had convinced a user to engage in a specific UI inter… |
CVE-2022-2861 | Medium | 6.5 | 2022-09-26 | Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install a malicious extensi… |
CVE-2022-2860 | Medium | 6.5 | 2022-09-26 | Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to bypass cookie prefix restrictions via a crafte… |
CVE-2022-2859 | High | 8.8 | 2022-09-26 | Use after free in Chrome OS Shell in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who convinced a user to engage in specific UI interactions… |
CVE-2022-2858 | High | 8.8 | 2022-09-26 | Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via specific UI intera… |
CVE-2022-2857 | High | 8.8 | 2022-09-26 | Use after free in Blink in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-2856 | Medium | 6.5 | 2022-09-26 | Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a… |
CVE-2022-2855 | High | 8.8 | 2022-09-26 | Use after free in ANGLE in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-2854 | High | 8.8 | 2022-09-26 | Use after free in SwiftShader in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-2853 | High | 8.8 | 2022-09-26 | Heap buffer overflow in Downloads in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker who had compromised the renderer process to pot… |
CVE-2022-2852 | High | 8.8 | 2022-09-26 | Use after free in FedCM in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-40785 | High | 8.8 | 2022-09-26 | Unsanitized input when setting a locale file leads to shell injection in mIPC camera firmware 5.3.1.2003161406. This allows an attacker to gain remote code exe… |
CVE-2022-3103 | High | 7.8 | 2022-09-26 | off-by-one in io_uring module. |
CVE-2022-28722 | Critical | 9.8 | 2022-09-26 | Certain HP Print Products are potentially vulnerable to Buffer Overflow. |
CVE-2022-28721 | Critical | 9.8 | 2022-09-26 | Certain HP Print Products are potentially vulnerable to Remote Code Execution. |
CVE-2022-40485 | Critical | 9.8 | 2022-09-26 | Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /package_detail.php. |
CVE-2022-40484 | Critical | 9.8 | 2022-09-26 | Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_edit.php. |
CVE-2022-40483 | Critical | 9.8 | 2022-09-26 | Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding_details.php. |
CVE-2022-3204 | High | 7.5 | 2022-09-26 | A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack w… |
CVE-2022-39245 | High | 8.4 | 2022-09-26 | Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow… |
CVE-2022-39243 | High | 8.4 | 2022-09-26 | NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang… |
CVE-2022-39219 | High | 8.5 | 2022-09-26 | Bifrost is a middleware package which can synchronize MySQL/MariaDB binlog data to other types of databases. Versions 1.8.6-release and prior are vulnerable to… |
CVE-2022-40928 | High | 7.2 | 2022-09-26 | Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_application. |
CVE-2022-40927 | High | 7.2 | 2022-09-26 | Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_designation. |
CVE-2022-40926 | High | 7.2 | 2022-09-26 | Online Leave Management System v1.0 is vulnerable to SQL Injection via /leave_system/classes/Master.php?f=delete_leave_type. |
CVE-2022-40925 | High | 7.2 | 2022-09-26 | Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_event" file of the "Events" module in the backgr… |
CVE-2022-40924 | High | 7.2 | 2022-09-26 | Zoo Management System v1.0 has an arbitrary file upload vulnerability in the picture upload point of the "save_animal" file of the "Animals" module in the back… |
CVE-2022-40404 | High | 8.8 | 2022-09-26 | Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/select.php. |
CVE-2022-40403 | High | 7.2 | 2022-09-26 | Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/feature_edit.php. |
CVE-2022-40402 | High | 8.8 | 2022-09-26 | Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_assign.php. |
CVE-2022-3299 | Medium | 4.3 | 2022-09-26 | A vulnerability was found in Open5GS up to 2.4.10. It has been declared as problematic. Affected by this vulnerability is an unknown functionality in the libra… |
CVE-2022-3295 | High | 7.5 | 2022-09-26 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2022-3135 | Medium | 4.8 | 2022-09-26 | The SEO Smart Links WordPress plugin through 3.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2022-3119 | High | 7.5 | 2022-09-26 | The OAuth client Single Sign On WordPress plugin before 3.0.4 does not have authorisation and CSRF when updating its settings, which could allow unauthenticate… |
CVE-2022-3098 | Medium | 4.3 | 2022-09-26 | The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2022-3076 | High | 7.2 | 2022-09-26 | The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the… |
CVE-2022-3074 | Medium | 4.8 | 2022-09-26 | The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks. |
CVE-2022-3070 | Medium | 4.8 | 2022-09-26 | The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scrip… |
CVE-2022-3069 | Medium | 4.8 | 2022-09-26 | The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Script… |
CVE-2022-3062 | Medium | 6.1 | 2022-09-26 | The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scrip… |
CVE-2022-3025 | Medium | 5.4 | 2022-09-26 | The Bitcoin / Altcoin Faucet WordPress plugin through 1.6.0 does not have any CSRF check when saving its settings, allowing attacker to make a logged in admin… |
CVE-2022-3024 | Medium | 5.4 | 2022-09-26 | The Simple Bitcoin Faucets WordPress plugin through 1.7.0 does not have any authorisation and CSRF in an AJAX action, allowing any authenticated users, such as… |
CVE-2022-2987 | High | 7.5 | 2022-09-26 | The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (whi… |
CVE-2022-2926 | Medium | 4.9 | 2022-09-26 | The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and rea… |
CVE-2022-2903 | High | 7.2 | 2022-09-26 | The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when… |
CVE-2022-2405 | Medium | 4.3 | 2022-09-26 | The WP Popup Builder WordPress plugin before 1.2.9 does not have authorisation and CSRF check in an AJAX action, allowing any authenticated users, such as subs… |
CVE-2022-2404 | Medium | 6.1 | 2022-09-26 | The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross… |
CVE-2022-2352 | High | 7.2 | 2022-09-26 | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.7 does not have proper authorisation in some AJAX actions, which could allow high privilege users su… |
CVE-2022-1755 | Medium | 5.4 | 2022-09-26 | The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cros… |
CVE-2022-1613 | Medium | 5.3 | 2022-09-26 | The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it po… |
CVE-2022-3301 | Low | 2.4 | 2022-09-26 | Improper Cleanup on Thrown Exception in GitHub repository ikus060/rdiffweb prior to 2.4.8. |
CVE-2022-38970 | Medium | 6.5 | 2022-09-26 | ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhe… |
CVE-2022-36159 | High | 8.8 | 2022-09-26 | Contec FXA3200 version 1.13 and under were discovered to contain a hard coded hash password for root stored in the component /etc/shadow. As the password stren… |
CVE-2022-36158 | High | 8.0 | 2022-09-26 | Contec FXA3200 version 1.13.00 and under suffers from Insecure Permissions in the Wireless LAN Manager interface which allows malicious actors to execute Linux… |
CVE-2022-38553 | Medium | 6.1 | 2022-09-26 | Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter. |
CVE-2022-21797 | High | 7.3 | 2022-09-26 | The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement. |
CVE-2022-21169 | High | 7.3 | 2022-09-26 | The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitiz… |
CVE-2022-41352 | Critical | 9.8 | 2022-09-26 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15 and 9.0. An attacker can upload arbitrary files through amavis via a cpio loophole (extraction to… |
CVE-2022-41347 | High | 7.8 | 2022-09-26 | An issue was discovered in Zimbra Collaboration (ZCS) 8.8.x and 9.x (e.g., 8.8.15). The Sudo configuration permits the zimbra user to execute the NGINX binary… |
CVE-2022-41343 | High | 7.5 | 2022-09-25 | registerFont in FontMetrics.php in Dompdf before 2.0.1 allows remote file inclusion because a URI validation failure does not halt font registration, as demons… |
CVE-2022-3297 | High | 7.8 | 2022-09-25 | Use After Free in GitHub repository vim/vim prior to 9.0.0579. |
CVE-2022-3296 | High | 7.8 | 2022-09-25 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0577. |
CVE-2022-41340 | High | 7.5 | 2022-09-24 | The secp256k1-js package before 1.1.0 for Node.js implements ECDSA without required r and s validation, leading to signature forgery. |
CVE-2022-23464 | Medium | 4.3 | 2022-09-24 | Nepxion Discovery is a solution for Spring Cloud. Discovery is vulnerable to a potential Server-Side Request Forgery (SSRF). RouterResourceImpl uses RestTempla… |
CVE-2022-23463 | Critical | 9.4 | 2022-09-24 | Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is e… |
CVE-2022-23461 | Medium | 5.4 | 2022-09-24 | Jodit Editor is a WYSIWYG editor written in pure TypeScript without the use of additional libraries. Jodit Editor is vulnerable to XSS attacks when pasting spe… |
CVE-2022-39242 | Medium | 5.3 | 2022-09-24 | Frontier is an Ethereum compatibility layer for Substrate. Prior to commit d3beddc6911a559a3ecc9b3f08e153dbe37a8658, the worst case weight was always accounted… |
CVE-2022-39240 | Medium | 5.4 | 2022-09-24 | MyGraph is a permission management system. Versions prior to 1.0.4 are vulnerable to a storage XSS vulnerability leading to Remote Code Execution. This issue i… |
CVE-2022-36025 | Critical | 9.1 | 2022-09-24 | Besu is a Java-based Ethereum client. In versions newer than 22.1.3 and prior to 22.7.1, Besu is subject to an Incorrect Conversion between Numeric Types. An e… |
CVE-2022-40122 | Critical | 9.8 | 2022-09-23 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer_action.php. |
CVE-2022-40121 | Critical | 9.8 | 2022-09-23 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/manage_customers.php. |
CVE-2022-40120 | Critical | 9.8 | 2022-09-23 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/customer_transactions.php. |
CVE-2022-40119 | Critical | 9.8 | 2022-09-23 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search_term parameter at /net-banking/transactions.php. |
CVE-2022-40118 | Critical | 9.8 | 2022-09-23 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/send_funds_action.php. |
CVE-2022-40117 | Critical | 9.8 | 2022-09-23 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_customer.php. |
CVE-2022-40116 | Critical | 9.8 | 2022-09-23 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the search parameter at /net-banking/beneficiary.php. |
CVE-2022-40115 | Critical | 9.8 | 2022-09-23 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/delete_beneficiary.php. |
CVE-2022-40114 | Critical | 9.8 | 2022-09-23 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/edit_customer.php. |
CVE-2022-40113 | Critical | 9.8 | 2022-09-23 | Online Banking System v1.0 was discovered to contain a SQL injection vulnerability via the cust_id parameter at /net-banking/send_funds.php. |
CVE-2022-3278 | Medium | 5.5 | 2022-09-23 | NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0552. |
CVE-2022-32814 | High | 7.8 | 2022-09-23 | A type confusion issue was addressed with improved state handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5… |
CVE-2022-22629 | High | 8.8 | 2022-09-23 | A buffer overflow issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iTunes 12.12.3 for W… |
CVE-2022-40630 | Medium | 6.5 | 2022-09-23 | This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to im… |
CVE-2022-40132 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Seriously Simple Podcasting plugin <= 2.16.0 at WordPress, leading to plugin settings change. |
CVE-2022-40107 | High | 7.5 | 2022-09-23 | Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formexeCommand function. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-40106 | High | 7.5 | 2022-09-23 | Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the set_local_time function. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-40105 | High | 7.5 | 2022-09-23 | Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterGet function. This vulnerability allows attackers to cause a Denia… |
CVE-2022-40104 | High | 7.5 | 2022-09-23 | Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDget function. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-40103 | Medium | 5.5 | 2022-09-23 | Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formSetAutoPing function. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-40102 | High | 7.5 | 2022-09-23 | Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formwrlSSIDset function. This vulnerability allows attackers to cause a Denial of S… |
CVE-2022-40101 | High | 7.5 | 2022-09-23 | Tenda i9 v1.0.0.8(3828) was discovered to contain a buffer overflow via the formWifiMacFilterSet function. This vulnerability allows attackers to cause a Denia… |
CVE-2022-40100 | Critical | 9.8 | 2022-09-23 | Tenda i9 v1.0.0.8(3828) was discovered to contain a command injection vulnerability via the FormexeCommand function. |
CVE-2022-3263 | High | 7.8 | 2022-09-23 | The security descriptor of Measuresoft ScadaPro Server version 6.7 has inconsistent permissions, which could allow a local user with limited privileges to modi… |
CVE-2022-38704 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history. |
CVE-2022-38454 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io Image Optimizer plugin <= 2.6.5 at WordPress. |
CVE-2022-38439 | Medium | 5.4 | 2022-09-23 | Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convinc… |
CVE-2022-38438 | Medium | 5.4 | 2022-09-23 | Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convinc… |
CVE-2022-38079 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress. |