2022 CVEs (page 134)
Page 134 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40071 | High | 7.5 | 2022-09-19 | Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, formSetDeviceName. |
CVE-2022-40070 | High | 7.5 | 2022-09-19 | Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via bin/httpd, function: formSetFirewallCfg. |
CVE-2022-40069 | High | 7.5 | 2022-09-19 | ]Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: fromSetSysTime. |
CVE-2022-40068 | High | 7.5 | 2022-09-19 | Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetQosBand. |
CVE-2022-40067 | High | 7.5 | 2022-09-19 | Tenda AC21 V 16.03.08.15 is vulnerable to Buffer Overflow via /bin/httpd, function: formSetVirtualSer. |
CVE-2022-3142 | High | 8.8 | 2022-09-19 | The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The… |
CVE-2022-3141 | High | 8.8 | 2022-09-19 | The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page… |
CVE-2022-3036 | Medium | 4.8 | 2022-09-19 | The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2022-3021 | Medium | 4.8 | 2022-09-19 | The Slickr Flickr WordPress plugin through 2.8.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site S… |
CVE-2022-38880 | Critical | 9.8 | 2022-09-19 | The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The affected version is 0.1.0. |
CVE-2022-38341 | High | 7.1 | 2022-09-19 | Safe Software FME Server v2021.2.5 and below does not employ server-side validation. |
CVE-2022-2958 | High | 8.8 | 2022-09-19 | The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authe… |
CVE-2022-2840 | Critical | 9.8 | 2022-09-19 | The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX a… |
CVE-2022-2754 | Critical | 9.8 | 2022-09-19 | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using them in SQL statements… |
CVE-2022-2753 | Medium | 6.1 | 2022-09-19 | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated a… |
CVE-2022-2710 | Medium | 4.8 | 2022-09-19 | The Scroll To Top WordPress plugin before 1.4.1 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cr… |
CVE-2022-2709 | Medium | 4.8 | 2022-09-19 | The Float to Top Button WordPress plugin through 2.3.6 does not escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2022-2567 | Medium | 4.8 | 2022-09-19 | The Form Builder CP WordPress plugin before 1.2.32 does not sanitise and escape some of its form settings, which could allow high privilege users such as admin… |
CVE-2022-1591 | Medium | 4.3 | 2022-09-19 | The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to ma… |
CVE-2022-1580 | Medium | 4.3 | 2022-09-19 | The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contain… |
CVE-2022-38617 | High | 8.8 | 2022-09-19 | SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf. |
CVE-2022-40778 | Medium | 5.4 | 2022-09-19 | A stored Cross-Site Scripting (XSS) vulnerability in OPSWAT MetaDefender ICAP Server before 4.13.0 allows attackers to execute arbitrary JavaScript or HTML bec… |
CVE-2022-3235 | High | 7.8 | 2022-09-18 | Use After Free in GitHub repository vim/vim prior to 9.0.0490. |
CVE-2022-40775 | Medium | 5.5 | 2022-09-18 | An issue was discovered in Bento4 through 1.6.0-639. A NULL pointer dereference occurs in AP4_StszAtom::WriteFields. |
CVE-2022-40774 | Medium | 5.5 | 2022-09-18 | An issue was discovered in Bento4 through 1.6.0-639. There is a NULL pointer dereference in AP4_StszAtom::GetSampleSize. |
CVE-2022-40769 | High | 7.5 | 2022-09-18 | profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from Ethereum vanity addresses and steal cr… |
CVE-2022-25873 | Medium | 4.6 | 2022-09-18 | The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' func… |
CVE-2022-40768 | Medium | 5.5 | 2022-09-18 | drivers/scsi/stex.c in the Linux kernel through 5.19.9 allows local users to obtain sensitive information from kernel memory because stex_queuecommand_lck lack… |
CVE-2022-40766 | Critical | 9.8 | 2022-09-18 | Modern Campus Omni CMS (formerly OU Campus) 10.2.4 allows login-page SQL injection via a '" OR 1 = 1 -- - , <?php' substring. |
CVE-2022-3234 | High | 7.8 | 2022-09-17 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. |
CVE-2022-3232 | Medium | 4.3 | 2022-09-17 | Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.5. |
CVE-2022-39960 | Medium | 5.3 | 2022-09-17 | The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all gro… |
CVE-2022-3231 | Medium | 5.4 | 2022-09-17 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0. |
CVE-2022-3173 | Medium | 4.3 | 2022-09-17 | Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10. |
CVE-2022-39217 | Medium | 5.8 | 2022-09-17 | some-natalie/ghas-to-csv (GitHub Advanced Security to CSV) is a GitHub action which scrapes the GitHub Advanced Security API and shoves it into a CSV. In affec… |
CVE-2022-39212 | Medium | 4.3 | 2022-09-17 | Nextcloud Talk is an open source chat, video & audio calls client for the Nextcloud platform. In affected versions an attacker could see the last video frame o… |
CVE-2022-39210 | Low | 3.2 | 2022-09-17 | Nextcloud android is the official Android client for the Nextcloud home server platform. Internal paths to the Nextcloud Android app files are not properly pro… |
CVE-2022-40300 | Critical | 9.8 | 2022-09-16 | Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multi… |
CVE-2022-39211 | Low | 3.0 | 2022-09-16 | Nextcloud server is an open source personal cloud platform. In affected versions it was found that locally running webservices can be found and requested erron… |
CVE-2022-36027 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When converting transposed convolutions using per-channel weight quantization the converter segfaul… |
CVE-2022-36017 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `Requantize` is given `input_min`, `input_max`, `requested_output_min`, `requested_output_max` t… |
CVE-2022-36016 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `tensorflow::full_type::SubstituteFromAttrs` receives a `FullTypeDef& t` that is not exactly t… |
CVE-2022-36015 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `RangeSize` receives values that do not fit into an `int64_t`, it crashes. We have patched the… |
CVE-2022-36014 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `mlir::tfg::TFOp::nameAttr` receives null type list attributes, it crashes. We have patched th… |
CVE-2022-36013 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `mlir::tfg::GraphDefImporter::ConvertNodeDef` tries to convert NodeDefs without an op name, it… |
CVE-2022-36012 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it crashe… |
CVE-2022-36011 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives… |
CVE-2022-36005 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_min_max_vars_gradient` receives input `min` or `max` that is… |
CVE-2022-36004 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `tf.random.gamma` receives large input shape and rates, it gives a `CHECK` fail that can trigg… |
CVE-2022-36003 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `RandomPoissonV2` receives large input shape and rates, it gives a `CHECK` fail that can trigg… |
CVE-2022-36002 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `Unbatch` receives a nonscalar input `id`, it gives a `CHECK` fail that can trigger a denial o… |
CVE-2022-36001 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `DrawBoundingBoxes` receives an input `boxes` that is not of dtype `float`, it gives a `CHECK`… |
CVE-2022-36000 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `mlir::tfg::ConvertGenericFunctionToFunctionDef` is given empty function attributes, it gives… |
CVE-2022-35999 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `Conv2DBackpropInput` receives empty `out_backprop` inputs (e.g. `[3, 1, 0, 1]`), the current… |
CVE-2022-35998 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `EmptyTensorList` receives an input `element_shape` with more than one dimension, it gives a `CH… |
CVE-2022-35997 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `tf.sparse.cross` receives an input `separator` that is not a scalar, it gives a `CHECK` fail th… |
CVE-2022-35996 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `Conv2D` is given empty `input` and the `filter` and `padding` sizes are valid, the output is al… |
CVE-2022-35995 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `AudioSummaryV2` receives an input `sample_rate` with more than one element, it gives a `CHECK… |
CVE-2022-35994 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `CollectiveGather` receives an scalar input `input`, it gives a `CHECK` fails that can be used… |
CVE-2022-35993 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `SetSize` receives an input `set_shape` that is not a 1D tensor, it gives a `CHECK` fails that… |
CVE-2022-35992 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `TensorListFromTensor` receives an `element_shape` of a rank greater than one, it gives a `CHE… |
CVE-2022-35991 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `TensorListScatter` and `TensorListScatterV2` receive an `element_shape` of a rank greater tha… |
CVE-2022-40762 | High | 7.5 | 2022-09-16 | A Memory Allocation with Excessive Size Value vulnerablity in the TEE_Realloc function in Samsung mTower through 0.3.0 allows a trusted application to trigger… |
CVE-2022-40761 | High | 7.5 | 2022-09-16 | The function tee_obj_free in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Service (DoS) by invoking the function TEE_Alloca… |
CVE-2022-40760 | High | 7.5 | 2022-09-16 | A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigger… |
CVE-2022-40759 | High | 7.5 | 2022-09-16 | A NULL pointer dereference issue in the TEE_MACCompareFinal function in Samsung mTower through 0.3.0 allows a trusted application to trigger a Denial of Servic… |
CVE-2022-40758 | High | 7.5 | 2022-09-16 | A Buffer Access with Incorrect Length Value vulnerablity in the TEE_CipherUpdate function in Samsung mTower through 0.3.0 allows a trusted application to trigg… |
CVE-2022-40757 | High | 7.5 | 2022-09-16 | A Buffer Access with Incorrect Length Value vulnerablity in the TEE_MACComputeFinal function in Samsung mTower through 0.3.0 allows a trusted application to tr… |
CVE-2022-40755 | Medium | 5.5 | 2022-09-16 | JasPer 3.0.6 allows denial of service via a reachable assertion in the function inttobits in libjasper/base/jas_image.c. |
CVE-2022-3217 | High | 7.5 | 2022-09-16 | When logging in to a VBASE runtime project via Web-Remote, the product uses XOR with a static initial key to obfuscate login messages. An unauthenticated remot… |
CVE-2022-37709 | Medium | 5.3 | 2022-09-16 | Tesla Model 3 V11.0(2022.4.5.1 6b701552d7a6) Tesla mobile app v4.23 is vulnerable to Authentication Bypass by spoofing. Tesla Model 3's Phone Key authenticatio… |
CVE-2022-37258 | Critical | 9.8 | 2022-09-16 | Prototype pollution vulnerability in function convertLater in npm-convert.js in stealjs steal 2.2.4 via the packageName variable in npm-convert.js. |
CVE-2022-37251 | Medium | 5.4 | 2022-09-16 | Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via Drafts. |
CVE-2022-37247 | Medium | 5.4 | 2022-09-16 | Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting (XSS) via /admin/settings/fields page. |
CVE-2022-36026 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizeAndDequantizeV3` is given a nonscalar `num_bits` input tensor, it results in a `CHECK`… |
CVE-2022-36019 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVarsPerChannel` is given `min` or `max` tensors of a rank other than one, it… |
CVE-2022-36018 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `RaggedTensorToVariant` is given a `rt_nested_splits` list that contains tensors of ranks other… |
CVE-2022-35990 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `tf.quantization.fake_quant_with_min_max_vars_per_channel_gradient` receives input `min` or `m… |
CVE-2022-35989 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `MaxPool` receives a window size input array `ksize` with dimensions greater than its input te… |
CVE-2022-35988 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. When `tf.linalg.matrix_rank` receives an empty input `a`, the GPU kernel gives a `CHECK` fail that… |
CVE-2022-35987 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. `DenseBincount` assumes its input tensor `weights` to either have the same shape as its input tenso… |
CVE-2022-35986 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `RaggedBincount` is given an empty input tensor `splits`, it results in a segfault that can be u… |
CVE-2022-35985 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `LRNGrad` is given an `output_image` input tensor that is not 4-D, it results in a `CHECK` fail… |
CVE-2022-35984 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. `ParameterizedTruncatedNormal` assumes `shape` is of type `int32`. A valid `shape` of type `int64`… |
CVE-2022-35983 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `Save` or `SaveSlices` is run over tensors of an unsupported `dtype`, it results in a `CHECK` fa… |
CVE-2022-35982 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `SparseBincount` is given inputs for `indices`, `values`, and `dense_shape` that do not make a v… |
CVE-2022-35981 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. `FractionalMaxPoolGrad` validates its inputs with `CHECK` failures instead of with returning errors… |
CVE-2022-35979 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedRelu` or `QuantizedRelu6` are given nonscalar inputs for `min_features` or `max_featur… |
CVE-2022-35194 | Medium | 5.4 | 2022-09-16 | TestLink v1.9.20 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /lib/inventory/inventoryView.php. |
CVE-2022-2333 | High | 8.8 | 2022-09-16 | If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4… |
CVE-2022-2332 | Medium | 6.2 | 2022-09-16 | A local unprivileged attacker may escalate to administrator privileges in Honeywell SoftMaster version 4.51, due to insecure permission assignment. |
CVE-2022-29489 | Medium | 4.3 | 2022-09-16 | Cross-Site Request Forgery (CSRF) vulnerability in Sucuri Security plugin <= 1.8.33 at WordPress leading to Event log entry creation. |
CVE-2022-28758 | High | 8.2 | 2022-09-16 | Zoom On-Premise Meeting Connector MMR before version 4.8.20220815.130 contains an improper access control vulnerability. As a result, a malicious actor could o… |
CVE-2022-35974 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizeDownAndShrinkRange` is given nonscalar inputs for `input_min` or `input_max`, it result… |
CVE-2022-35973 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedMatMul` is given nonscalar input for: `min_a`, `max_a`, `min_b`, or `max_b` It gives a… |
CVE-2022-35972 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedBiasAdd` is given `min_input`, `max_input`, `min_bias`, `max_bias` tensors of a nonzer… |
CVE-2022-35971 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `FakeQuantWithMinMaxVars` is given `min` or `max` tensors of a nonzero rank, it results in a `CH… |
CVE-2022-35970 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. If `QuantizedInstanceNorm` is given `x_min` or `x_max` tensors of a nonzero rank, it results in a s… |
CVE-2022-35969 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. The implementation of `Conv2DBackpropInput` requires `input_sizes` to be 4-dimensional. Otherwise… |
CVE-2022-35968 | Medium | 5.9 | 2022-09-16 | TensorFlow is an open source platform for machine learning. The implementation of `AvgPoolGrad` does not fully validate the input `orig_input_shape`. This resu… |