2022 CVEs (page 130)
Page 130 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40866 | Critical | 9.8 | 2022-09-23 | Tenda W20E router V15.11.0.6 (US_W20EV4.0br_V15.11.0.6(1068_1546_841)_CN_TDC) contains a stack overflow vulnerability in the function formSetDebugCfg with requ… |
CVE-2022-40861 | High | 7.2 | 2022-09-23 | Tenda AC18 router V15.03.05.19 contains a stack overflow vulnerability in the formSetQosBand->FUN_0007db78 function with the request /goform/SetNetControlList/ |
CVE-2022-40855 | Critical | 9.8 | 2022-09-23 | Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. This vulnerability allows… |
CVE-2022-40854 | Critical | 9.8 | 2022-09-23 | Tenda AC18 router contained a stack overflow vulnerability in /goform/fast_setting_wifi_set |
CVE-2022-40851 | Critical | 9.8 | 2022-09-23 | Tenda AC15 V15.03.05.19 contained a stack overflow via the function fromAddressNat. |
CVE-2022-40672 | Medium | 4.8 | 2022-09-23 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress. |
CVE-2022-40671 | Medium | 4.3 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress. |
CVE-2022-40310 | Medium | 4.3 | 2022-09-23 | Authenticated (subscriber+) Race Condition vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress allows attackers to increase/decrease… |
CVE-2022-40195 | Medium | 4.8 | 2022-09-23 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PCA Predict plugin <= 1.0.3 at WordPress. |
CVE-2022-40193 | Medium | 6.1 | 2022-09-23 | Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress. |
CVE-2022-3257 | Low | 3.1 | 2022-09-23 | Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows auth… |
CVE-2022-38460 | Medium | 5.4 | 2022-09-23 | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress. |
CVE-2022-38085 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress. |
CVE-2022-38061 | Medium | 6.2 | 2022-09-23 | Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress. |
CVE-2022-37342 | Medium | 4.8 | 2022-09-23 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability Add Shortcodes Actions And Filters plugin <= 2.0.9 at WordPress. |
CVE-2022-37328 | Low | 3.4 | 2022-09-23 | Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in Themes Awesome History Timeline plugin <= 1.0.5 at WordPress. |
CVE-2022-36791 | Medium | 5.4 | 2022-09-23 | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Awesome UG Torro Forms plugin <= 1.0.16 at WordPress. |
CVE-2022-36388 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress. |
CVE-2022-35238 | Medium | 6.5 | 2022-09-23 | Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress. |
CVE-2022-23144 | Critical | 9.1 | 2022-09-23 | There is a broken access control vulnerability in ZTE ZXvSTB product. Due to improper permission control, attackers could use this vulnerability to delete the… |
CVE-2022-40869 | Critical | 9.8 | 2022-09-23 | Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function fromDhcpListClient with a combined parameter "list*" ("%s%d","l… |
CVE-2022-40865 | Critical | 9.8 | 2022-09-23 | Tenda AC15 and AC18 routers V15.03.05.19 contain heap overflow vulnerabilities in the function setSchedWifi with the request /goform/openSchedWifi/ |
CVE-2022-40864 | Critical | 9.8 | 2022-09-23 | Tenda AC15 and AC18 routers V15.03.05.19 contain stack overflow vulnerabilities in the function setSmartPowerManagement with the request /goform/PowerSaveSet |
CVE-2022-40862 | Critical | 9.8 | 2022-09-23 | Tenda AC15 and AC18 router V15.03.05.19 contains stack overflow vulnerability in the function fromNatStaticSetting with the request /goform/NatStaticSetting |
CVE-2022-40860 | Critical | 9.8 | 2022-09-23 | Tenda AC15 router V15.03.05.19 contains a stack overflow vulnerability in the function formSetQosBand->FUN_0007dd20 with request /goform/SetNetControlList |
CVE-2022-40853 | Critical | 9.8 | 2022-09-23 | Tenda AC15 router V15.03.05.19 contains a stack overflow via the list parameter at /goform/fast_setting_wifi_set |
CVE-2022-40213 | Medium | 4.1 | 2022-09-23 | Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in GS Testimonial Slider plugin <= 1.9.6 at WordPress. |
CVE-2022-40093 | High | 7.2 | 2022-09-23 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/update_tax.php. |
CVE-2022-40092 | High | 7.2 | 2022-09-23 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/update_payment.php. |
CVE-2022-40091 | High | 7.2 | 2022-09-23 | Online Tours & Travels Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tour/admin/update_packages.php. |
CVE-2022-3144 | Medium | 4.4 | 2022-09-23 | The Wordfence Security – Firewall & Malware Scan plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 7.6.0 via a… |
CVE-2022-38703 | Low | 3.4 | 2022-09-23 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress |
CVE-2022-38095 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress. |
CVE-2022-37339 | Medium | 4.1 | 2022-09-23 | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Meet My Team plugin <= 2.0.5 at WordPress. |
CVE-2022-37338 | Medium | 4.1 | 2022-09-23 | Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in Blossom Recipe Maker plugin <= 1.0.7 at WordPress. |
CVE-2022-37330 | Medium | 5.4 | 2022-09-23 | Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA Crossword plugin <= 1.1.10 at WordPress. |
CVE-2022-36798 | Medium | 5.4 | 2022-09-23 | Cross-Site Request Forgery (CSRF) vulnerability in Topdigitaltrends Mega Addons For WPBakery Page Builder plugin <= 4.2.7 at WordPress. |
CVE-2022-35257 | High | 7.8 | 2022-09-23 | A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local access to a Windows dev… |
CVE-2022-35252 | Low | 3.7 | 2022-09-23 | When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver migh… |
CVE-2022-30121 | Medium | 6.7 | 2022-09-23 | The “LANDesk(R) Management Agent” service exposes a socket and once connected, it is possible to launch commands only for signed executables. This is a securit… |
CVE-2022-2937 | Medium | 6.4 | 2022-09-23 | The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Title & Description values that can be added to an I… |
CVE-2022-27492 | High | 7.8 | 2022-09-23 | An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file. |
CVE-2022-3236 | Critical | 9.8 | 2022-09-23 | A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. |
CVE-2022-2347 | High | 7.7 | 2022-09-23 | There exists an unchecked length field in UBoot. The U-Boot DFU implementation does not bound the length field in USB DFU download setup packets, and it does n… |
CVE-2022-40716 | Medium | 6.5 | 2022-09-23 | HashiCorp Consul and Consul Enterprise up to 1.11.8, 1.12.4, and 1.13.1 do not check for multiple SAN URI values in a CSR on the internal RPC endpoint, enablin… |
CVE-2022-2566 | Critical | 9.0 | 2022-09-23 | A heap out-of-bounds memory write exists in FFMPEG since version 5.1. The size calculation in `build_open_gop_key_points()` goes through all entries in the loo… |
CVE-2022-40979 | Medium | 4.4 | 2022-09-23 | In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executable |
CVE-2022-38936 | High | 7.5 | 2022-09-23 | An issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wmessage.c:137. |
CVE-2022-2785 | Medium | 6.7 | 2022-09-23 | There exists an arbitrary memory read within the Linux Kernel BPF - Constants provided to fill pointers in structs passed in to bpf_sys_bpf are not verified an… |
CVE-2022-3269 | Critical | 9.8 | 2022-09-23 | Session Fixation in GitHub repository ikus060/rdiffweb prior to 2.4.7. |
CVE-2022-33683 | Medium | 5.9 | 2022-09-23 | Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is di… |
CVE-2022-33682 | Medium | 5.9 | 2022-09-23 | TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client… |
CVE-2022-33681 | Medium | 5.9 | 2022-09-23 | Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack. Connections from th… |
CVE-2022-24280 | Medium | 6.5 | 2022-09-23 | Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsa… |
CVE-2022-39239 | Medium | 6.1 | 2022-09-23 | netlify-ipx is an on-Demand image optimization for Netlify using ipx. In versions prior to 1.2.3, an attacker can bypass the source image domain allowlist by s… |
CVE-2022-39238 | Medium | 4.2 | 2022-09-23 | Arvados is an open source platform for managing and analyzing biomedical big data. In versions prior to 2.4.3, when using Portable Authentication Modules (PAM)… |
CVE-2022-39231 | Low | 3.7 | 2022-09-23 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.16, or from 5.0.0 to 5.2.6, v… |
CVE-2022-26112 | Critical | 9.8 | 2022-09-23 | In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy… |
CVE-2022-39230 | Medium | 6.5 | 2022-09-23 | fhir-works-on-aws-authz-smart is an implementation of the authorization interface from the FHIR Works interface. Versions 3.1.1 and 3.1.2 are subject to Exposu… |
CVE-2022-39227 | Critical | 9.1 | 2022-09-23 | python-jwt is a module for generating and verifying JSON Web Tokens. Versions prior to 3.3.4 are subject to Authentication Bypass by Spoofing, resulting in ide… |
CVE-2022-39225 | Medium | 4.3 | 2022-09-23 | Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In versions prior to 4.10.15, or 5.0.0 and above prior… |
CVE-2022-41322 | High | 7.8 | 2022-09-23 | In Kitty before 0.26.2, insufficient validation in the desktop notification escape sequence can lead to arbitrary code execution. The user must display attacke… |
CVE-2022-41320 | Medium | 6.5 | 2022-09-23 | Veritas System Recovery (VSR) versions 18 and 21 store a network destination password in the Windows registry during configuration of the backup configuration… |
CVE-2022-41319 | Medium | 6.1 | 2022-09-23 | A Reflected Cross-Site Scripting (XSS) vulnerability affects the Veritas Desktop Laptop Option (DLO) application login page (aka the DLOServer/restore/login.js… |
CVE-2022-35951 | High | 7.0 | 2022-09-23 | Redis is an in-memory database that persists on disk. Versions 7.0.0 and above, prior to 7.0.5 are vulnerable to an Integer Overflow. Executing an `XAUTOCLAIM`… |
CVE-2022-37235 | Critical | 9.8 | 2022-09-23 | Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There i… |
CVE-2022-37232 | Critical | 9.8 | 2022-09-23 | Netgear N300 wireless router wnr2000v4-V1.0.0.70 is vulnerable to Buffer Overflow via uhttpd. There is a stack overflow vulnerability caused by strcpy. |
CVE-2022-40298 | High | 8.8 | 2022-09-23 | Crestron AirMedia for Windows before 5.5.1.84 has insecure inherited permissions, which leads to a privilege escalation vulnerability found in the AirMedia Win… |
CVE-2022-38573 | Critical | 9.8 | 2022-09-23 | 10-Strike Network Inventory Explorer v9.3 was discovered to contain a buffer overflow via the Add Computers function. |
CVE-2022-30426 | High | 7.8 | 2022-09-23 | There is a stack buffer overflow vulnerability, which could lead to arbitrary code execution in UEFI DXE driver on some Acer products. An attack could exploit… |
CVE-2022-40089 | Critical | 9.8 | 2022-09-22 | A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerabilit… |
CVE-2022-40088 | Medium | 6.1 | 2022-09-22 | Simple College Website v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /college_website/index.php?page=… |
CVE-2022-40087 | Critical | 9.8 | 2022-09-22 | Simple College Website v1.0 was discovered to contain an arbitrary file write vulnerability via the function file_put_contents(). This vulnerability allows att… |
CVE-2022-36934 | Critical | 9.8 | 2022-09-22 | An integer overflow in WhatsApp could result in remote code execution in an established video call. |
CVE-2022-31937 | Critical | 9.8 | 2022-09-22 | Netgear N300 wireless router wnr2000v4-V1.0.0.70 was discovered to contain a stack overflow via strcpy in uhttpd. |
CVE-2022-23458 | Medium | 6.1 | 2022-09-22 | Toast UI Grid is a component to display and edit data. Versions prior to 4.21.3 are vulnerable to cross-site scripting attacks when pasting specially crafted c… |
CVE-2022-37234 | High | 7.8 | 2022-09-22 | Netgear Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router R7000-V1.0.11.134_10.2.119 is vulnerable to Buffer Overflow via the wl binary in firmware. There i… |
CVE-2022-3274 | Low | 3.5 | 2022-09-22 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.7. |
CVE-2022-36062 | High | 7.6 | 2022-09-22 | Grafana is an open-source platform for monitoring and observability. In versions prior to 8.5.13, 9.0.9, and 9.1.6, Grafana is subject to Improper Preservation… |
CVE-2022-35894 | Medium | 6.0 | 2022-09-22 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The SMI handler for the FwBlockServiceSmm driver uses an untrusted pointer as the loca… |
CVE-2022-34026 | High | 7.5 | 2022-09-22 | ICEcoder v8.1 allows attackers to execute a directory traversal. |
CVE-2022-40935 | High | 7.2 | 2022-09-22 | Online Pet Shop We App v1.0 is vulnerable to SQL Injection via /pet_shop/classes/Master.php?f=delete_category,id. |
CVE-2022-40934 | High | 7.2 | 2022-09-22 | Online Pet Shop We App v1.0 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_sub_category,id |
CVE-2022-40933 | High | 7.2 | 2022-09-22 | Online Pet Shop We App v1.0 by oretnom23 is vulnerable to SQL injection via /pet_shop/classes/Master.php?f=delete_order,id. |
CVE-2022-35039 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e20a0. |
CVE-2022-35038 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b064d. |
CVE-2022-35037 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6adb1e. |
CVE-2022-35036 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e1fc8. |
CVE-2022-35035 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b559f. |
CVE-2022-35034 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e7e3d. |
CVE-2022-35032 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6b6a8f. |
CVE-2022-35031 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969. |
CVE-2022-35030 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954. |
CVE-2022-35029 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea. |
CVE-2022-35028 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbbb6. |
CVE-2022-35027 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7. |
CVE-2022-35026 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b. |
CVE-2022-35025 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x5266a8. |
CVE-2022-35024 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S. |
CVE-2022-35023 | Medium | 6.5 | 2022-09-22 | OTFCC commit 617837b was discovered to contain a segmentation violation via /lib/x86_64-linux-gnu/libc.so.6+0xbb384. |