2022 CVEs (page 136)
Page 136 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37248 | Medium | 5.4 | 2022-09-16 | Craft CMS 4.2.0.1 is vulnerable to Cross Site Scripting (XSS) via src/helpers/Cp.php. |
CVE-2022-35195 | High | 7.2 | 2022-09-16 | TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php |
CVE-2022-35193 | High | 7.2 | 2022-09-16 | TestLink v1.9.20 was discovered to contain a SQL injection vulnerability via /lib/execute/execNavigator.php. |
CVE-2022-38833 | High | 7.2 | 2022-09-16 | School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/modstudent/index.php?view=view&id=. |
CVE-2022-38832 | High | 7.2 | 2022-09-16 | School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/department/index.php?view=edit&id=. |
CVE-2022-38831 | Critical | 9.8 | 2022-09-16 | Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/SetNetControlList |
CVE-2022-38830 | Critical | 9.8 | 2022-09-16 | Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/setIPv6Status. |
CVE-2022-38829 | Critical | 9.8 | 2022-09-16 | Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/setMacFilterCfg. |
CVE-2022-38828 | Critical | 9.8 | 2022-09-16 | TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi |
CVE-2022-38827 | Critical | 9.8 | 2022-09-16 | TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi |
CVE-2022-38826 | Critical | 9.8 | 2022-09-16 | In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi. |
CVE-2022-38823 | Critical | 9.8 | 2022-09-16 | In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample. |
CVE-2022-37250 | Medium | 5.4 | 2022-09-16 | Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting (XSS) in /admin/myaccount. |
CVE-2022-3176 | High | 7.8 | 2022-09-16 | There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will se… |
CVE-2022-38846 | Medium | 5.9 | 2022-09-16 | EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may cap… |
CVE-2022-38845 | Medium | 6.1 | 2022-09-16 | Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file contai… |
CVE-2022-38844 | High | 8.0 | 2022-09-16 | CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of execu… |
CVE-2022-38843 | High | 8.8 | 2022-09-16 | EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may exec… |
CVE-2022-38808 | High | 8.8 | 2022-09-16 | ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface. |
CVE-2022-3223 | Medium | 6.1 | 2022-09-16 | Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1. |
CVE-2022-40152 | Medium | 6.5 | 2022-09-16 | Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. If the parser is running on user supplie… |
CVE-2022-40151 | Medium | 6.5 | 2022-09-16 | Those using Xstream to seralize XML data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may… |
CVE-2022-40150 | Medium | 6.5 | 2022-09-16 | Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input… |
CVE-2022-40149 | Medium | 6.5 | 2022-09-16 | Those using Jettison to parse untrusted XML or JSON data may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input… |
CVE-2022-2913 | Medium | 4.3 | 2022-09-16 | The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and b… |
CVE-2022-2912 | Medium | 4.3 | 2022-09-16 | The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value perfor… |
CVE-2022-2887 | Medium | 4.8 | 2022-09-16 | The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scr… |
CVE-2022-2877 | Medium | 5.3 | 2022-09-16 | The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat… |
CVE-2022-2863 | Medium | 4.9 | 2022-09-16 | The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowin… |
CVE-2022-2799 | Medium | 4.8 | 2022-09-16 | The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cros… |
CVE-2022-2798 | High | 8.0 | 2022-09-16 | The Affiliates Manager WordPress plugin before 2.9.14 does not validate and sanitise the affiliate data, which could allow users registering as affiliate to pe… |
CVE-2022-2737 | Medium | 4.8 | 2022-09-16 | The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2022-2669 | Medium | 6.1 | 2022-09-16 | The WP Taxonomy Import WordPress plugin through 1.0.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cr… |
CVE-2022-2655 | Medium | 6.1 | 2022-09-16 | The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading t… |
CVE-2022-2654 | Medium | 6.1 | 2022-09-16 | The Classima WordPress theme before 2.1.11 and some of its required plugins (Classified Listing before 2.2.14, Classified Listing Pro before 2.0.20, Classified… |
CVE-2022-2635 | Medium | 4.8 | 2022-09-16 | The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2022-2575 | Medium | 4.8 | 2022-09-16 | The WBW Currency Switcher for WooCommerce WordPress plugin before 1.6.6 does not sanitise and escape some of its settings, which could allow high privilege use… |
CVE-2022-2351 | Medium | 4.8 | 2022-09-16 | The Post SMTP Mailer/Email Log WordPress plugin before 2.1.4 does not escape some of its settings before outputting them in the admins dashboard, allowing high… |
CVE-2022-1194 | High | 8.8 | 2022-09-16 | The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exp… |
CVE-2022-25708 | Critical | 9.8 | 2022-09-16 | Memory corruption in WLAN due to buffer copy without checking size of input while parsing keys in Snapdragon Connectivity, Snapdragon Mobile |
CVE-2022-25706 | High | 8.2 | 2022-09-16 | Information disclosure in Bluetooth driver due to buffer over-read while reading l2cap length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2022-25696 | High | 8.4 | 2022-09-16 | Memory corruption in display due to time-of-check time-of-use race condition during map or unmap in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivit… |
CVE-2022-25693 | High | 8.4 | 2022-09-16 | Memory corruption in graphics due to use-after-free while graphics profiling in Snapdragon Connectivity, Snapdragon Mobile |
CVE-2022-25690 | High | 7.5 | 2022-09-16 | Information disclosure in WLAN due to improper validation of array index while parsing crafted ANQP action frames in Snapdragon Auto, Snapdragon Compute, Snapd… |
CVE-2022-25688 | High | 7.3 | 2022-09-16 | Memory corruption in video due to buffer overflow while parsing ps video clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Cons… |
CVE-2022-25686 | High | 7.3 | 2022-09-16 | Memory corruption in video module due to buffer overflow while processing WAV file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon… |
CVE-2022-25670 | High | 7.5 | 2022-09-16 | Denial of service in WLAN HOST due to buffer over read while unpacking frames in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consu… |
CVE-2022-25669 | High | 7.5 | 2022-09-16 | Denial of service in video due to buffer over read while parsing MP4 clip in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer… |
CVE-2022-25656 | High | 8.4 | 2022-09-16 | Possible integer overflow and memory corruption due to improper validation of buffer size sent to write to console when computing the payload size in Snapdrago… |
CVE-2022-25654 | Medium | 6.7 | 2022-09-16 | Memory corruption in kernel due to improper input validation while processing ION commands in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Consumer IOT… |
CVE-2022-25653 | Medium | 6.8 | 2022-09-16 | Information disclosure in video due to buffer over-read while processing avi file in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snap… |
CVE-2022-25652 | Critical | 9.0 | 2022-09-16 | Cryptographic issues in BSP due to improper hash verification in Snapdragon Wired Infrastructure and Networking |
CVE-2022-22105 | Critical | 9.4 | 2022-09-16 | Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdr… |
CVE-2022-22095 | High | 8.4 | 2022-09-16 | Memory corruption in synx driver due to use-after-free condition in the synx driver due to accessing object handles without acquiring lock in Snapdragon Comput… |
CVE-2022-22094 | High | 7.8 | 2022-09-16 | memory corruption in Kernel due to race condition while getting mapping reference in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Sn… |
CVE-2022-22093 | High | 7.8 | 2022-09-16 | Memory corruption or temporary denial of service due to improper handling of concurrent hypervisor operations to attach or detach IRQs from virtual interrupt s… |
CVE-2022-22092 | High | 7.8 | 2022-09-16 | Memory corruption in kernel due to use after free issue in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile |
CVE-2022-22091 | High | 7.5 | 2022-09-16 | Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity… |
CVE-2022-22089 | High | 8.4 | 2022-09-16 | Memory corruption in audio while playing record due to improper list handling in two threads in Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables |
CVE-2022-22081 | High | 8.4 | 2022-09-16 | Memory corruption in audio module due to integer overflow in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables |
CVE-2022-22074 | High | 8.4 | 2022-09-16 | Memory Corruption during wma file playback due to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Sn… |
CVE-2022-22066 | High | 8.4 | 2022-09-16 | Memory corruption occurs while processing command received from HLOS due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivi… |
CVE-2022-36536 | Critical | 9.8 | 2022-09-16 | An issue in the component post_applogin.php of Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below allows attackers to escalate privil… |
CVE-2022-36534 | High | 8.8 | 2022-09-16 | Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain multiple remote code execution (RCE) vulnerabilities via… |
CVE-2022-36533 | Medium | 5.4 | 2022-09-16 | Super Flexible Software GmbH & Co. KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2022-36532 | High | 8.8 | 2022-09-16 | Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a maliciou… |
CVE-2022-35415 | High | 7.8 | 2022-09-16 | An improper input validation in NI System Configuration Manager before 22.5 may allow a privileged user to potentially enable escalation of privilege via local… |
CVE-2022-34002 | Medium | 6.5 | 2022-09-16 | The ‘document’ parameter of PDS Vista 7’s /application/documents/display.aspx page is vulnerable to a Local File Inclusion vulnerability which allows an low-pr… |
CVE-2022-26959 | Critical | 10.0 | 2022-09-16 | There are two full (read/write) Blind/Time-based SQL injection vulnerabilities in the Northstar Club Management version 6.3 application. The vulnerabilities ex… |
CVE-2022-39215 | High | 8.3 | 2022-09-15 | Tauri is a framework for building binaries for all major desktop platforms. Due to missing canonicalization when `readDir` is called recursively, it was possib… |
CVE-2022-39213 | High | 7.5 | 2022-09-15 | go-cvss is a Go module to manipulate Common Vulnerability Scoring System (CVSS). In affected versions when a full CVSS v2.0 vector string is parsed using `Pars… |
CVE-2022-36075 | Low | 2.6 | 2022-09-15 | Nextcloud files access control is a nextcloud app to manage access control for files. Users with limited access can see file names in certain cases where they… |
CVE-2022-36074 | Medium | 6.4 | 2022-09-15 | Nextcloud server is an open source personal cloud product. Affected versions of this package are vulnerable to Information Exposure which fails to strip the Au… |
CVE-2022-29240 | High | 8.1 | 2022-09-15 | Scylla is a real-time big data database that is API-compatible with Apache Cassandra and Amazon DynamoDB. When decompressing CQL frame received from user, Scyl… |
CVE-2022-27561 | High | 7.5 | 2022-09-15 | There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf). |
CVE-2022-38334 | Medium | 5.5 | 2022-09-15 | XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc. |
CVE-2022-38814 | Medium | 5.4 | 2022-09-15 | A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scr… |
CVE-2022-38326 | Critical | 9.8 | 2022-09-15 | Tenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the page parameter at /gofor… |
CVE-2022-38325 | Critical | 9.8 | 2022-09-15 | Tenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the filePath parameter at /g… |
CVE-2022-37260 | High | 7.5 | 2022-09-15 | A Regular Expression Denial of Service (ReDoS) flaw was found in stealjs steal 2.2.4 via the input variable in main.js. |
CVE-2022-39209 | High | 7.5 | 2022-09-15 | cmark-gfm is GitHub's fork of cmark, a CommonMark parsing and rendering library and program in C. In versions prior to 0.29.0.gfm.6 a polynomial time complexit… |
CVE-2022-38535 | High | 7.2 | 2022-09-15 | TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function. |
CVE-2022-38534 | High | 7.2 | 2022-09-15 | TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function. |
CVE-2022-40663 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is… |
CVE-2022-40662 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is… |
CVE-2022-40661 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is… |
CVE-2022-40660 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is… |
CVE-2022-40659 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is… |
CVE-2022-40658 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is… |
CVE-2022-40657 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is… |
CVE-2022-40656 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 13.2.0.21165. User interaction is r… |
CVE-2022-40655 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is… |
CVE-2022-40654 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40653 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40652 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40651 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40650 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40649 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40648 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |
CVE-2022-40647 | High | 7.8 | 2022-09-15 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ansys SpaceClaim 2022 R1. User interaction is required to exp… |