2022 CVEs (page 143)
Page 143 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36065 | High | 7.5 | 2022-09-06 | GrowthBook is an open-source platform for feature flagging and A/B testing. With some self-hosted configurations in versions prior to 2022-08-29, attackers can… |
CVE-2022-36064 | Medium | 5.9 | 2022-09-06 | Shescape is a shell escape package for JavaScript. An Inefficient Regular Expression Complexity vulnerability impacts users that use Shescape to escape argumen… |
CVE-2022-36061 | Medium | 6.5 | 2022-09-06 | Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.35, read only calls between contracts can generate smart contracts… |
CVE-2022-26861 | High | 7.9 | 2022-09-06 | Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending m… |
CVE-2022-26860 | High | 7.5 | 2022-09-06 | Dell BIOS versions contain a stack-based buffer overflow vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI to… |
CVE-2022-26859 | Medium | 6.1 | 2022-09-06 | Dell BIOS contains a race condition vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI in order to bypass secu… |
CVE-2022-26858 | Medium | 6.1 | 2022-09-06 | Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sen… |
CVE-2022-3134 | High | 7.8 | 2022-09-06 | Use After Free in GitHub repository vim/vim prior to 9.0.0389. |
CVE-2022-37253 | Medium | 5.4 | 2022-09-06 | Persistent cross-site scripting (XSS) in Crime Reporting System 1.0 allows a remote attacker to introduce arbitary Javascript via manipulation of an unsanitize… |
CVE-2022-37185 | High | 7.5 | 2022-09-06 | SQL injection vulnerability exists in the school information query interface (repschoolproj.php) of the EMS 6.2 system of the Office of the Thai Basic Educatio… |
CVE-2022-36058 | High | 7.5 | 2022-09-06 | Elrond go is the go implementation for the Elrond Network protocol. In versions prior to 1.3.34, anyone who uses elrond-go to process blocks (historical or act… |
CVE-2022-36057 | Medium | 5.4 | 2022-09-06 | Discourse-Chat is an asynchronous messaging plugin for the Discourse open-source discussion platform. Users of Discourse Chat can be affected by admin users in… |
CVE-2022-36044 | High | 7.8 | 2022-09-06 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting dat… |
CVE-2022-36043 | High | 7.8 | 2022-09-06 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to a double free in bobj.c:rz_bin_reloc_st… |
CVE-2022-36041 | High | 7.8 | 2022-09-06 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when parsing Mac… |
CVE-2022-36040 | High | 7.8 | 2022-09-06 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting dat… |
CVE-2022-32277 | Medium | 5.3 | 2022-09-06 | Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to c… |
CVE-2022-37771 | Medium | 6.7 | 2022-09-06 | IObit Malware Fighter v9.2 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes wi… |
CVE-2022-36670 | Medium | 6.7 | 2022-09-06 | PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify p… |
CVE-2022-36042 | High | 7.8 | 2022-09-06 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to an out-of-bounds write when getting dat… |
CVE-2022-36039 | High | 7.8 | 2022-09-06 | Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.4.0 and prior are vulnerable to out-of-bounds write when parsing DEX fi… |
CVE-2022-36038 | High | 8.8 | 2022-09-06 | CircuitVerse is an open-source platform which allows users to construct digital logic circuits online. A remote code execution (RCE) vulnerability in CircuitVe… |
CVE-2022-36032 | Medium | 5.3 | 2022-09-06 | ReactPHP HTTP is a streaming HTTP client and server implementation for ReactPHP. In ReactPHP's HTTP server component versions starting with 0.7.0 and prior to… |
CVE-2022-31792 | Medium | 5.4 | 2022-09-06 | A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potent… |
CVE-2022-31791 | High | 7.8 | 2022-09-06 | WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root pe… |
CVE-2022-31789 | Critical | 9.8 | 2022-09-06 | An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arb… |
CVE-2022-3026 | Medium | 6.5 | 2022-09-06 | The WP Users Exporter plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.2 via the 'Export Users' functionality. This ma… |
CVE-2022-38131 | Medium | 6.1 | 2022-09-06 | RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites. |
CVE-2022-36425 | Medium | 5.4 | 2022-09-06 | Broken Access Control vulnerability in Beaver Builder plugin <= 2.5.4.3 at WordPress. |
CVE-2022-35931 | Low | 2.7 | 2022-09-06 | Nextcloud Password Policy is an app that enables a Nextcloud server admin to define certain rules for passwords. Prior to versions 22.2.10, 23.0.7, and 24.0.3… |
CVE-2022-35847 | Medium | 6.3 | 2022-09-06 | An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface 7.2.0, 7.0.0 through 7.0.3… |
CVE-2022-34867 | High | 7.3 | 2022-09-06 | Unauthenticated Sensitive Information Disclosure vulnerability in WP Libre Form 2 plugin <= 2.0.8 at WordPress allows attackers to list and delete submissions… |
CVE-2022-34656 | Medium | 4.8 | 2022-09-06 | Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress. |
CVE-2022-33177 | Medium | 5.4 | 2022-09-06 | Cross-Site Request Forgery (CSRF) vulnerability in WPdevelop/Oplugins Booking Calendar plugin <= 9.2.1 at WordPress leading to Translations Update. |
CVE-2022-32264 | High | 7.5 | 2022-09-06 | sys/netinet/tcp_timer.h in FreeBSD before 7.0 contains a denial-of-service (DoS) vulnerability due to improper handling of TSopt on TCP connections. NOTE: This… |
CVE-2022-31860 | Critical | 9.8 | 2022-09-06 | An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule. |
CVE-2022-31790 | High | 7.5 | 2022-09-06 | WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious requ… |
CVE-2022-30298 | High | 7.0 | 2022-09-06 | An improper privilege management vulnerability [CWE-269] in Fortinet FortiSOAR before 7.2.1 allows a GUI user who has already found a way to modify system file… |
CVE-2022-2945 | Medium | 4.9 | 2022-09-06 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.5.3 via the 'type'… |
CVE-2022-2943 | Medium | 4.9 | 2022-09-06 | The WordPress Infinite Scroll – Ajax Load More plugin for Wordpress is vulnerable to arbitrary file reading in versions up to, and including, 5.5.3 due to insu… |
CVE-2022-2941 | Medium | 5.5 | 2022-09-06 | The WP-UserOnline plugin for WordPress has multiple Stored Cross-Site Scripting vulnerabilities in versions up to, and including 2.88.0. This is due to the fac… |
CVE-2022-2939 | Medium | 5.3 | 2022-09-06 | The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possi… |
CVE-2022-2936 | Medium | 6.4 | 2022-09-06 | The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Video Link values that can be added to an Image Hover in… |
CVE-2022-2935 | Medium | 6.4 | 2022-09-06 | The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Media Image URL value that can be added to an Image… |
CVE-2022-2934 | Medium | 6.4 | 2022-09-06 | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Image URL' value found in the Media block in ve… |
CVE-2022-2735 | High | 7.8 | 2022-09-06 | A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemo… |
CVE-2022-2718 | High | 7.2 | 2022-09-06 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the jooms… |
CVE-2022-2717 | High | 7.2 | 2022-09-06 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to SQL Injection via the 'orderby' parameter on the jooms… |
CVE-2022-2716 | Medium | 6.4 | 2022-09-06 | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Editor' block in versions up to, and inclu… |
CVE-2022-2695 | Medium | 6.4 | 2022-09-06 | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the medi… |
CVE-2022-2633 | High | 7.5 | 2022-09-06 | The All-in-One Video Gallery plugin for WordPress is vulnerable to arbitrary file downloads and blind server-side request forgery via the 'dl' parameter found… |
CVE-2022-2542 | High | 8.8 | 2022-09-06 | The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. Thi… |
CVE-2022-2541 | High | 8.8 | 2022-09-06 | The uContext for Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This i… |
CVE-2022-2540 | High | 8.8 | 2022-09-06 | The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 1.4.5. This i… |
CVE-2022-2518 | High | 8.8 | 2022-09-06 | The Stockists Manager for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.2.1. This is due t… |
CVE-2022-2517 | Medium | 6.4 | 2022-09-06 | The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Caption - On Hover' value associated with image… |
CVE-2022-2516 | Medium | 6.4 | 2022-09-06 | The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post/page 'Title' value in versions up to, and in… |
CVE-2022-2515 | Medium | 6.4 | 2022-09-06 | The Simple Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `pro_version_activation_code` parameter in versions up to, and incl… |
CVE-2022-2473 | Medium | 5.5 | 2022-09-06 | The WP-UserOnline plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘templates[browsingpage][text]' parameter in versions up to, and in… |
CVE-2022-2462 | Medium | 5.3 | 2022-09-06 | The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and incl… |
CVE-2022-2461 | Medium | 5.3 | 2022-09-06 | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and includin… |
CVE-2022-2442 | High | 7.2 | 2022-09-06 | The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to… |
CVE-2022-2438 | High | 7.2 | 2022-09-06 | The Broken Link Checker plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 1.1… |
CVE-2022-2436 | High | 8.8 | 2022-09-06 | The Download Manager plugin for WordPress is vulnerable to deserialization of untrusted input via the 'file[package_dir]' parameter in versions up to, and incl… |
CVE-2022-2434 | High | 8.8 | 2022-09-06 | The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and incl… |
CVE-2022-2433 | High | 7.5 | 2022-09-06 | The WordPress Infinite Scroll – Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' paramete… |
CVE-2022-2432 | High | 8.8 | 2022-09-06 | The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23. This is due to mi… |
CVE-2022-2431 | High | 8.1 | 2022-09-06 | The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file ty… |
CVE-2022-2430 | Medium | 6.4 | 2022-09-06 | The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versions up to, and inclu… |
CVE-2022-2429 | Medium | 6.5 | 2022-09-06 | The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Util… |
CVE-2022-2402 | Medium | 6.5 | 2022-09-06 | The vulnerability in the driver dlpfde.sys enables a user logged into the system to perform system calls leading to kernel stack overflow, resulting in a syste… |
CVE-2022-2233 | High | 8.8 | 2022-09-06 | The Banner Cycler plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce protectio… |
CVE-2022-29062 | Medium | 6.3 | 2022-09-06 | Multiple relative path traversal vulnerabilities [CWE-23] in Fortinet FortiSOAR before 7.2.1 allows an authenticated attacker to write to the underlying filesy… |
CVE-2022-29058 | High | 7.8 | 2022-09-06 | An improper neutralization of special elements [CWE-89] used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiAP 6.0.0 through 6… |
CVE-2022-29053 | Low | 2.3 | 2022-09-06 | A missing cryptographic steps vulnerability [CWE-325] in the functions that encrypt the keytab files in FortiOS version 7.2.0, 7.0.0 through 7.0.5 and below 7… |
CVE-2022-28885 | Medium | 4.3 | 2022-09-06 | A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash while parsing the sca… |
CVE-2022-28884 | Medium | 4.3 | 2022-09-06 | A Denial-of-Service vulnerability was discovered in the F-Secure and WithSecure products where aerdl.dll may go into an infinite loop when unpacking PE files… |
CVE-2022-27664 | High | 7.5 | 2022-09-06 | In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutd… |
CVE-2022-27491 | Medium | 6.8 | 2022-09-06 | A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through 7.113, 6.001 throug… |
CVE-2022-26470 | Medium | 6.7 | 2022-09-06 | In aie, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2022-26469 | High | 7.8 | 2022-09-06 | In MtkEmail, there is a possible escalation of privilege due to fragment injection. This could lead to local escalation of privilege with no additional executi… |
CVE-2022-26468 | Medium | 6.6 | 2022-09-06 | In preloader (usb), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, for an attacker wh… |
CVE-2022-26467 | Medium | 6.7 | 2022-09-06 | In rpmb, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-26466 | Medium | 6.7 | 2022-09-06 | In audio ipi, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privil… |
CVE-2022-26465 | Medium | 6.7 | 2022-09-06 | In audio ipi, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2022-26464 | Medium | 6.7 | 2022-09-06 | In vow, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2022-26463 | Medium | 4.4 | 2022-09-06 | In vow, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileg… |
CVE-2022-26462 | Medium | 4.4 | 2022-09-06 | In vow, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileg… |
CVE-2022-26461 | Medium | 6.7 | 2022-09-06 | In vow, there is a possible undefined behavior due to an API misuse. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-26460 | Medium | 6.7 | 2022-09-06 | In vow, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privil… |
CVE-2022-26459 | Medium | 4.4 | 2022-09-06 | In vow, there is a possible out of bounds read due to an integer overflow. This could lead to local information disclosure with System execution privileges nee… |
CVE-2022-26458 | Medium | 6.7 | 2022-09-06 | In vow, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-26457 | Medium | 6.7 | 2022-09-06 | In vow, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-26456 | Medium | 4.4 | 2022-09-06 | In vow, there is a possible information disclosure due to a symbolic link following. This could lead to local information disclosure with System execution priv… |
CVE-2022-26455 | Medium | 6.7 | 2022-09-06 | In gz, there is a possible memory corruption due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-26454 | Medium | 6.7 | 2022-09-06 | In teei, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-26453 | Medium | 6.7 | 2022-09-06 | In teei, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges neede… |
CVE-2022-26451 | Medium | 6.7 | 2022-09-06 | In ged, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-26450 | Medium | 6.4 | 2022-09-06 | In apusys, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-26449 | Medium | 6.7 | 2022-09-06 | In apusys, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privil… |