2022 CVEs (page 129)
Page 129 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36340 | Medium | 6.5 | 2022-09-23 | Unauthenticated Optin Campaign Cache Deletion vulnerability in MailOptin plugin <= 1.2.49.0 at WordPress. |
CVE-2022-35893 | High | 8.2 | 2022-09-23 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM memory corruption vulnerability in the FvbServicesRuntimeDxe driver allows an a… |
CVE-2022-35251 | Medium | 5.4 | 2022-09-23 | A cross-site scripting vulnerability exists in Rocket.chat <v5 due to style injection in the complete chat window, an adversary is able to manipulate not only… |
CVE-2022-35250 | Medium | 4.3 | 2022-09-23 | A privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate privileges for any authenticated user to view Direct messages… |
CVE-2022-35249 | Medium | 4.3 | 2022-09-23 | A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channe… |
CVE-2022-35248 | High | 8.8 | 2022-09-23 | A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the… |
CVE-2022-35247 | Medium | 4.3 | 2022-09-23 | A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak chann… |
CVE-2022-35246 | Medium | 4.3 | 2022-09-23 | A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method th… |
CVE-2022-32853 | High | 7.1 | 2022-09-23 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS… |
CVE-2022-32852 | High | 7.1 | 2022-09-23 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.5. Processing a maliciously crafted AppleScr… |
CVE-2022-32851 | High | 7.1 | 2022-09-23 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS… |
CVE-2022-32849 | Medium | 5.5 | 2022-09-23 | An information disclosure issue was addressed by removing the vulnerable code. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, tvOS 15.6… |
CVE-2022-32848 | Medium | 5.5 | 2022-09-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may be able to capture a user’s scre… |
CVE-2022-32847 | Critical | 9.1 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Monterey 12… |
CVE-2022-32845 | Critical | 10.0 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to break o… |
CVE-2022-32843 | High | 7.1 | 2022-09-23 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS… |
CVE-2022-32842 | High | 7.8 | 2022-09-23 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Monterey 12.5. An app… |
CVE-2022-32841 | Medium | 5.5 | 2022-09-23 | The issue was addressed with improved memory handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Processing… |
CVE-2022-32832 | Medium | 6.7 | 2022-09-23 | The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Mon… |
CVE-2022-32831 | High | 7.1 | 2022-09-23 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monter… |
CVE-2022-32829 | High | 7.8 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to execute arbitrary co… |
CVE-2022-32828 | Medium | 5.5 | 2022-09-23 | The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, tvOS 15.6, macOS Monterey 12.5. An app may be able to d… |
CVE-2022-32826 | High | 7.8 | 2022-09-23 | An authorization issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 1… |
CVE-2022-32825 | Medium | 5.5 | 2022-09-23 | The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Mon… |
CVE-2022-32823 | Medium | 5.5 | 2022-09-23 | A memory initialization issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7… |
CVE-2022-32821 | High | 7.8 | 2022-09-23 | A memory corruption issue was addressed with improved validation. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5… |
CVE-2022-32820 | High | 7.8 | 2022-09-23 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7… |
CVE-2022-32819 | High | 7.8 | 2022-09-23 | A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macO… |
CVE-2022-32818 | Medium | 5.5 | 2022-09-23 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.5. An app may be able to leak sensitive kernel state. |
CVE-2022-32817 | Medium | 5.5 | 2022-09-23 | An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Montere… |
CVE-2022-32816 | Medium | 6.5 | 2022-09-23 | The issue was addressed with improved UI handling. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. Visiting a web… |
CVE-2022-32815 | High | 7.8 | 2022-09-23 | The issue was addressed with improved memory handling. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, tvOS 15.6, macOS Mon… |
CVE-2022-32807 | High | 7.1 | 2022-09-23 | This issue was addressed with improved file handling. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An a… |
CVE-2022-32805 | Medium | 5.5 | 2022-09-23 | The issue was addressed with improved handling of caches. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5… |
CVE-2022-32801 | High | 7.8 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to gain root privileges. |
CVE-2022-32800 | Medium | 5.5 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. An app may… |
CVE-2022-32799 | Medium | 5.9 | 2022-09-23 | An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in Security Update 2022-005 Catalina, macOS Monterey 12.5. A user… |
CVE-2022-32798 | High | 7.8 | 2022-09-23 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Monterey 12.5. An app may be able to gain elevated priv… |
CVE-2022-32797 | High | 7.1 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in Security Update 2022-005 Catalina, macOS Big Sur 11.6.8, macOS Monterey 12.5. Processing… |
CVE-2022-32796 | High | 7.8 | 2022-09-23 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.5. An app may be able to execute arbitrary cod… |
CVE-2022-32792 | High | 8.8 | 2022-09-23 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, watchOS 8.7, tvOS 15.6, macOS Monte… |
CVE-2022-32790 | High | 7.5 | 2022-09-23 | This issue was addressed with improved checks. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey 12.4, macOS Big Sur 11.6… |
CVE-2022-32789 | Medium | 5.5 | 2022-09-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.5. An app may be able to bypass Privacy preferences. |
CVE-2022-32787 | High | 8.8 | 2022-09-23 | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Big Sur 11.6.8, watchOS 8.7, t… |
CVE-2022-32786 | Medium | 5.5 | 2022-09-23 | An issue in the handling of environment variables was addressed with improved validation. This issue is fixed in Security Update 2022-005 Catalina, macOS Big S… |
CVE-2022-32785 | Medium | 5.5 | 2022-09-23 | A null pointer dereference was addressed with improved validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, Security Update 2022-005 Catalina, macOS Bi… |
CVE-2022-32783 | Medium | 5.5 | 2022-09-23 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4. An app may gain unauthorized access to Bluetooth. |
CVE-2022-32782 | Medium | 4.4 | 2022-09-23 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4. An app with root privileges may be able to access private in… |
CVE-2022-32781 | Medium | 4.4 | 2022-09-23 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5, Security Update 2022-005 Catalina… |
CVE-2022-32229 | Medium | 4.3 | 2022-09-23 | A information disclosure vulnerability exists in Rockert.Chat <v5 due to /api/v1/chat.getThreadsList lack of sanitization of user inputs and can therefore leak… |
CVE-2022-32228 | Medium | 4.3 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 since the getReadReceipts Meteor server method does not properly filter… |
CVE-2022-32227 | Medium | 6.5 | 2022-09-23 | A cleartext transmission of sensitive information exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 relating to Oauth tokens by having the permission "view-full-o… |
CVE-2022-32226 | Medium | 4.3 | 2022-09-23 | An improper access control vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to input data in the getUsersOfRoom Meteor server method is not typ… |
CVE-2022-32220 | Medium | 6.5 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v5 due to the getUserMentionsByChannel meteor server method discloses messages from private chan… |
CVE-2022-32219 | Medium | 4.3 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v4.7.5 which allowed the "users.list" REST endpoint gets a query parameter from JSON and runs Us… |
CVE-2022-32218 | Medium | 4.3 | 2022-09-23 | An information disclosure vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 due to the actionLinkHandler method was found to allow Message ID Enumer… |
CVE-2022-32217 | Medium | 5.3 | 2022-09-23 | A cleartext storage of sensitive information exists in Rocket.Chat <v4.6.4 due to Oauth token being leaked in plaintext in Rocket.chat logs. |
CVE-2022-32211 | High | 8.8 | 2022-09-23 | A SQL injection vulnerability exists in Rocket.Chat <v3.18.6, <v4.4.4 and <v4.7.3 which can allow an attacker to retrieve a reset password token through or a 2… |
CVE-2022-30124 | Medium | 6.8 | 2022-09-23 | An improper authentication vulnerability exists in Rocket.Chat Mobile App <4.14.1.22788 that allowed an attacker with physical access to a mobile device to byp… |
CVE-2022-28886 | Medium | 4.3 | 2022-09-23 | A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.so/aerdl.dll may go into an infinite loop when unpacking P… |
CVE-2022-26707 | Medium | 5.5 | 2022-09-23 | An issue in the handling of environment variables was addressed with improved validation. This issue is fixed in macOS Monterey 12.4. A user may be able to vie… |
CVE-2022-26700 | High | 8.8 | 2022-09-23 | A memory corruption issue was addressed with improved state management. This issue is fixed in tvOS 15.5, watchOS 8.6, iOS 15.5 and iPadOS 15.5, macOS Monterey… |
CVE-2022-22637 | High | 8.8 | 2022-09-23 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS 15.4, tvO… |
CVE-2022-22628 | High | 8.8 | 2022-09-23 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPadOS… |
CVE-2022-22624 | High | 8.8 | 2022-09-23 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.3, iOS 15.4 and iPadOS 15.4, tvOS 15.4, Safari 1… |
CVE-2022-22610 | High | 8.8 | 2022-09-23 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4 and iPad… |
CVE-2022-40748 | Medium | 5.4 | 2022-09-23 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-40629 | High | 7.5 | 2022-09-23 | This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to in… |
CVE-2022-40359 | Medium | 6.1 | 2022-09-23 | Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php. |
CVE-2022-40358 | Medium | 5.4 | 2022-09-23 | An issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload. |
CVE-2022-36944 | Critical | 9.8 | 2022-09-23 | Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. On its own, it cannot be exploited. There is only a risk in conjunction with Java… |
CVE-2022-36338 | High | 8.2 | 2022-09-23 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. An SMM callout vulnerability in the SMM driver FwBlockServiceSmm, creating SMM, leads… |
CVE-2022-35721 | Medium | 5.4 | 2022-09-23 | IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the W… |
CVE-2022-35099 | Medium | 5.5 | 2022-09-23 | SWFTools commit 772e55a2 was discovered to contain a stack overflow via ImageStream::getPixel(unsigned char*) at /xpdf/Stream.cc. |
CVE-2022-35098 | Medium | 5.5 | 2022-09-23 | SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via GfxICCBasedColorSpace::getDefaultColor(GfxColor*) at /xpdf/GfxState.cc. |
CVE-2022-35097 | Medium | 5.5 | 2022-09-23 | SWFTools commit 772e55a2 was discovered to contain a segmentation violation via FoFiTrueType::writeTTF at /xpdf/FoFiTrueType.cc. |
CVE-2022-35096 | Medium | 5.5 | 2022-09-23 | SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via draw_stroke at /gfxpoly/stroke.c. |
CVE-2022-35095 | Medium | 5.5 | 2022-09-23 | SWFTools commit 772e55a2 was discovered to contain a segmentation violation via InfoOutputDev::type3D1 at /pdf/InfoOutputDev.cc. |
CVE-2022-35094 | Medium | 5.5 | 2022-09-23 | SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*) at /xpdf/Stream.cc. |
CVE-2022-35093 | Medium | 5.5 | 2022-09-23 | SWFTools commit 772e55a2 was discovered to contain a global buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc. |
CVE-2022-35092 | Medium | 5.5 | 2022-09-23 | SWFTools commit 772e55a2 was discovered to contain a segmentation violation via convert_gfxline at /gfxpoly/convert.c. |
CVE-2022-35091 | Medium | 5.5 | 2022-09-23 | SWFTools commit 772e55a2 was discovered to contain a floating point exception (FPE) via DCTStream::readMCURow() at /xpdf/Stream.cc.ow() |
CVE-2022-34348 | High | 7.1 | 2022-09-23 | IBM Sterling Partner Engagement Manager 6.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could ex… |
CVE-2022-22423 | Medium | 5.5 | 2022-09-23 | IBM Common Cryptographic Architecture (CCA 5.x MTM for 4767 and CCA 7.x MTM for 4769) could allow a local user to cause a denial of service due to improper inp… |
CVE-2022-40628 | Critical | 9.8 | 2022-09-23 | This vulnerability exists in Tacitine Firewall, all versions of EN6200-PRIME QUAD-35 and EN6200-PRIME QUAD-100 between 19.1.1 to 22.20.1 (inclusive), due to im… |
CVE-2022-40215 | Low | 3.4 | 2022-09-23 | Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in Tabs plugin <= 3.7.1 at WordPress. |
CVE-2022-40194 | Medium | 5.3 | 2022-09-23 | Unauthenticated Sensitive Information Disclosure vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress |
CVE-2022-40188 | High | 7.5 | 2022-09-23 | Knot Resolver before 5.5.3 allows remote attackers to cause a denial of service (CPU consumption) because of algorithmic complexity. During an attack, an autho… |
CVE-2022-38742 | High | 8.1 | 2022-09-23 | Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is vulnerable to a heap-based buffer overflow. An attacker could send a specifically crafte… |
CVE-2022-38470 | Medium | 4.3 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. |
CVE-2022-38134 | Medium | 4.3 | 2022-09-23 | Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. |
CVE-2022-36417 | Medium | 6.1 | 2022-09-23 | Multiple Stored Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in 3D Tag Cloud plugin <= 3.8 at WordPress. |
CVE-2022-2973 | High | 8.6 | 2022-09-23 | MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) uses a NULL pointer in certain situa… |
CVE-2022-2972 | Critical | 10.0 | 2022-09-23 | MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) is vulnerable to a stack-based buffe… |
CVE-2022-2971 | High | 8.6 | 2022-09-23 | MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) accesses a resource using an incompa… |
CVE-2022-2970 | Critical | 10.0 | 2022-09-23 | MZ Automation's libIEC61850 (versions 1.4 and prior; version 1.5 prior to commit a3b04b7bc4872a5a39e5de3fdc5fbde52c09e10e) does not sanitize input before memcp… |
CVE-2022-2070 | Critical | 9.8 | 2022-09-23 | In Grandstream GSD3710 in its 1.0.11.13 version, it's possible to overflow the stack since it doesn't check the param length before using the sscanf instructio… |
CVE-2022-2025 | Critical | 9.8 | 2022-09-23 | an attacker with knowledge of user/pass of Grandstream GSD3710 in its 1.0.11.13 version, could overflow the stack since it doesn't check the param length befor… |
CVE-2022-40868 | Critical | 9.8 | 2022-09-23 | Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formDelDhcpRule with the… |
CVE-2022-40867 | Critical | 9.8 | 2022-09-23 | Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formIPMacBindDel with the… |