2022 CVEs (page 153)
Page 153 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1932 | Medium | 6.1 | 2022-08-22 | The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflect… |
CVE-2022-1322 | Medium | 4.8 | 2022-08-22 | The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users… |
CVE-2022-1251 | Medium | 4.3 | 2022-08-22 | The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a u… |
CVE-2022-0446 | Medium | 4.8 | 2022-08-22 | The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Si… |
CVE-2022-2932 | Medium | 6.1 | 2022-08-22 | Cross-site Scripting (XSS) - Reflected in GitHub repository bustle/mobiledoc-kit prior to 0.14.2. |
CVE-2022-2890 | Medium | 5.4 | 2022-08-22 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-2930 | High | 7.8 | 2022-08-22 | Unverified Password Change in GitHub repository octoprint/octoprint prior to 1.8.3. |
CVE-2022-1340 | Medium | 5.4 | 2022-08-22 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-2927 | Critical | 9.8 | 2022-08-22 | Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7. |
CVE-2022-2841 | Low | 2.7 | 2022-08-22 | A vulnerability was found in CrowdStrike Falcon 6.31.14505.0/6.42.15610/6.44.15806. It has been classified as problematic. Affected is an unknown function of t… |
CVE-2022-36251 | Medium | 6.1 | 2022-08-22 | Clinic's Patient Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via patients.php. |
CVE-2022-36198 | Critical | 9.8 | 2022-08-22 | Multiple SQL injections detected in Bus Pass Management System 1.0 via buspassms/admin/view-enquiry.php, buspassms/admin/pass-bwdates-reports-details.php, busp… |
CVE-2022-34916 | Critical | 9.8 | 2022-08-21 | Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data… |
CVE-2022-2885 | Medium | 4.8 | 2022-08-21 | Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. |
CVE-2022-30036 | High | 8.8 | 2022-08-21 | MA Lighting grandMA2 Light has a password of root for the root account. NOTE: The vendor's position is that the product was designed for isolated networks. Als… |
CVE-2022-2921 | High | 8.8 | 2022-08-21 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation… |
CVE-2022-38493 | High | 7.5 | 2022-08-20 | Rhonabwy 0.9.99 through 1.1.x before 1.1.7 doesn't check the RSA private key length before RSA-OAEP decryption. This allows attackers to cause a Denial of Serv… |
CVE-2022-2909 | Medium | 6.3 | 2022-08-20 | A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script. It has been declared as critical. Affected by this vulnerability is an unknow… |
CVE-2022-36030 | Critical | 9.8 | 2022-08-20 | Project-nexus is a general-purpose blog website framework. Affected versions are subject to SQL injection due to a lack of sensitization of user input. This is… |
CVE-2022-35692 | Medium | 5.3 | 2022-08-19 | Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that co… |
CVE-2022-35554 | Medium | 6.1 | 2022-08-19 | Multiple reflected XSS vulnerabilities occur when handling error message of BPC SmartVista version 3.28.0 allowing an attacker to execute javascript code at cl… |
CVE-2022-2793 | Medium | 5.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-353 Missing Support for Integrity Check, and has no authentication or au… |
CVE-2022-2792 | Medium | 6.6 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-284 Improper Access Control, and stores project data in a directory with… |
CVE-2022-2790 | Medium | 5.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulenrable to CWE-347 Improper Verification of Cryptographic Signature, and does not prope… |
CVE-2022-2789 | Medium | 4.7 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.00 and prior is vulnerable to CWE-345 Insufficient Verification of Data Authenticity, and can display logi… |
CVE-2022-36233 | Medium | 5.5 | 2022-08-19 | Tenda AC9 V15.03.2.13 is vulnerable to Buffer Overflow via httpd, form_fast_setting_wifi_set. httpd. |
CVE-2022-36171 | High | 8.1 | 2022-08-19 | MapGIS IGServer 10.5.6.11 is vulnerable to Arbitrary file deletion. |
CVE-2022-36157 | High | 8.8 | 2022-08-19 | XXL-JOB all versions as of 11 July 2022 are vulnerable to Insecure Permissions resulting in the ability to execute admin function with low Privilege account. |
CVE-2022-37175 | Critical | 9.8 | 2022-08-19 | Tenda ac15 firmware V15.03.05.18 httpd server has stack buffer overflow in /goform/formWifiBasicSet. |
CVE-2022-36170 | High | 8.8 | 2022-08-19 | MapGIS 10.5 Pro IGServer has hardcoded credentials in the front-end and can lead to escalation of privileges and arbitrary file deletion. |
CVE-2022-36031 | Medium | 6.5 | 2022-08-19 | Directus is a free and open-source data platform for headless content management. The Directus process can be aborted by having an authorized user update the `… |
CVE-2022-36009 | Medium | 5.0 | 2022-08-19 | gomatrixserverlib is a Go library for matrix protocol federation. Dendrite is a Matrix homeserver written in Go, an alternative to Synapse. The power level par… |
CVE-2022-36008 | High | 7.1 | 2022-08-19 | Frontier is Substrate's Ethereum compatibility layer. A security issue was discovered affecting parsing of the RPC result of the exit reason in case of EVM rev… |
CVE-2022-2788 | Low | 3.9 | 2022-08-19 | Emerson Electric's Proficy Machine Edition Version 9.80 and prior is vulnerable to CWE-29 Path Traversal: '\..\Filename', also known as a ZipSlip attack, throu… |
CVE-2022-23460 | Medium | 5.9 | 2022-08-19 | Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx json parsing may lead to stack exhaustion in an address san… |
CVE-2022-23459 | High | 8.1 | 2022-08-19 | Jsonxx or Json++ is a JSON parser, writer and reader written in C++. In affected versions of jsonxx use of the Value class may lead to memory corruption via a… |
CVE-2022-22489 | Critical | 9.1 | 2022-08-19 | IBM MQ 8.0, (9.0, 9.1, 9.2 LTS), and (9.1 and 9.2 CD) are vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attack… |
CVE-2022-0542 | Medium | 6.1 | 2022-08-19 | Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0. |
CVE-2022-37254 | Medium | 5.4 | 2022-08-19 | DolphinPHP 1.5.1 is vulnerable to Cross Site Scripting (XSS) via Background - > System - > system function - > configuration management. |
CVE-2022-36579 | High | 8.8 | 2022-08-19 | Wellcms 2.2.0 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-36578 | Critical | 9.8 | 2022-08-19 | jizhicms v2.3.1 has SQL injection in the background. |
CVE-2022-36577 | High | 8.8 | 2022-08-19 | An issue was discovered in jizhicms v2.3.1. There is a CSRF vulnerability that can add a admin. |
CVE-2022-36225 | High | 8.8 | 2022-08-19 | EyouCMS V1.5.8-UTF8-SP1 is vulnerable to Cross Site Request Forgery (CSRF) via the background, column management function and add. |
CVE-2022-36224 | High | 8.8 | 2022-08-19 | XunRuiCMS V4.5.6 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-36606 | Critical | 9.8 | 2022-08-19 | Ywoa before v6.1 was discovered to contain a SQL injection vulnerability via /oa/setup/checkPool?database. |
CVE-2022-36605 | Critical | 9.8 | 2022-08-19 | Yimioa v6.1 was discovered to contain a SQL injection vulnerability via the orderbyGET parameter. |
CVE-2022-36263 | High | 7.3 | 2022-08-19 | StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. An attacker can execute arbitrary code via a crafted .exe file. |
CVE-2022-35201 | Critical | 9.8 | 2022-08-19 | Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability. |
CVE-2022-34624 | Medium | 5.9 | 2022-08-19 | Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request. |
CVE-2022-34621 | Medium | 6.5 | 2022-08-19 | Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user passwords and other… |
CVE-2022-34615 | Critical | 9.8 | 2022-08-19 | Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks. |
CVE-2022-36220 | Critical | 9.8 | 2022-08-19 | Kiosk breakout (without quit password) in Safe Exam Browser (Windows) <3.4.0, which allows an attacker to achieve code execution via the browsers' print dialog. |
CVE-2022-35910 | Medium | 5.4 | 2022-08-19 | In Jellyfin before 10.8, stored XSS allows theft of an admin access token. |
CVE-2022-35909 | High | 8.8 | 2022-08-19 | In Jellyfin before 10.8, the /users endpoint has incorrect access control for admin functionality. |
CVE-2022-2889 | High | 7.8 | 2022-08-19 | Use After Free in GitHub repository vim/vim prior to 9.0.0225. |
CVE-2022-29805 | Critical | 9.8 | 2022-08-19 | A Java Deserialization vulnerability in the Fishbowl Server in Fishbowl Inventory before 2022.4.1 allows remote attackers to execute arbitrary code via a craft… |
CVE-2022-1021 | Medium | 5.4 | 2022-08-19 | Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0. |
CVE-2022-2886 | Medium | 5.0 | 2022-08-19 | A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is… |
CVE-2022-2075 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service targeting the build information request validation. |
CVE-2022-2074 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service using the Variable Project Template. |
CVE-2022-2049 | High | 7.5 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. |
CVE-2022-1901 | Medium | 5.3 | 2022-08-19 | In affected versions of Octopus Deploy it is possible to unmask sensitive variables by using variable preview. |
CVE-2022-35167 | High | 8.8 | 2022-08-19 | Printix Cloud Print Management v1.3.1149.0 for Windows was discovered to contain insecure permissions. |
CVE-2022-35540 | Critical | 9.8 | 2022-08-18 | Hardcoded JWT Secret in AgileConfig <1.6.8 Server allows remote attackers to use the generated JWT token to gain administrator access. |
CVE-2022-36947 | Critical | 9.8 | 2022-08-18 | Unsafe Parsing of a PNG tRNS chunk in FastStone Image Viewer through 7.5 results in a stack buffer overflow. |
CVE-2022-34488 | High | 7.8 | 2022-08-18 | Improper buffer restrictions in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalati… |
CVE-2022-34345 | Medium | 6.2 | 2022-08-18 | Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation… |
CVE-2022-33209 | High | 7.8 | 2022-08-18 | Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation… |
CVE-2022-32579 | High | 7.2 | 2022-08-18 | Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of… |
CVE-2022-30944 | Medium | 5.5 | 2022-08-18 | Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow a privileged user to potentially enable information disclos… |
CVE-2022-30601 | Critical | 9.8 | 2022-08-18 | Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable information d… |
CVE-2022-28858 | High | 7.8 | 2022-08-18 | Improper buffer restriction in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalatio… |
CVE-2022-28697 | Medium | 6.8 | 2022-08-18 | Improper access control in firmware for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable escalation of… |
CVE-2022-27493 | High | 7.8 | 2022-08-18 | Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable an escalation… |
CVE-2022-37770 | Medium | 6.5 | 2022-08-18 | libjpeg commit 281daa9 was discovered to contain a segmentation fault via LineMerger::GetNextLowpassLine at linemerger.cpp. This vulnerability allows attackers… |
CVE-2022-37769 | Medium | 6.5 | 2022-08-18 | libjpeg commit 281daa9 was discovered to contain a segmentation fault via HuffmanDecoder::Get at huffmandecoder.hpp. This vulnerability allows attackers to cau… |
CVE-2022-37768 | High | 7.5 | 2022-08-18 | libjpeg commit 281daa9 was discovered to contain an infinite loop via the component Frame::ParseTrailer. |
CVE-2022-37049 | High | 7.8 | 2022-08-18 | The component tcpprep in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in parse_mpls at common/get.c:150. NOTE: this is different fro… |
CVE-2022-37048 | High | 7.8 | 2022-08-18 | The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_l2len_protocol at common/get.c:344. NOTE: this is di… |
CVE-2022-37047 | High | 7.8 | 2022-08-18 | The component tcprewrite in Tcpreplay v4.4.1 was discovered to contain a heap-based buffer overflow in get_ipv6_next at common/get.c:713. NOTE: this is differe… |
CVE-2022-36729 | Critical | 9.8 | 2022-08-18 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /librarian/del.php. |
CVE-2022-36728 | Critical | 9.8 | 2022-08-18 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the RollNo parameter at /staff/delstu.php. |
CVE-2022-36727 | Critical | 9.8 | 2022-08-18 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /staff/delete.php. |
CVE-2022-36725 | Critical | 9.8 | 2022-08-18 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the M_Id parameter at /student/dele.php. |
CVE-2022-36722 | Critical | 9.8 | 2022-08-18 | Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the title parameter at /librarian/history.php. |
CVE-2022-35213 | Medium | 6.1 | 2022-08-18 | Ecommerce-CodeIgniter-Bootstrap before commit 56465f was discovered to contain a cross-site scripting (XSS) vulnerability via the function base_url() at /blog/… |
CVE-2022-35212 | Medium | 6.1 | 2022-08-18 | osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error(). |
CVE-2022-30296 | High | 7.5 | 2022-08-18 | Insufficiently protected credentials in the Intel(R) Datacenter Group Event iOS application, all versions, may allow an unauthenticated user to potentially ena… |
CVE-2022-2568 | Medium | 6.5 | 2022-08-18 | A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify… |
CVE-2022-29507 | Medium | 5.5 | 2022-08-18 | Insufficiently protected credentials in the Intel(R) Team Blue mobile application in all versions may allow an authenticated user to potentially enable informa… |
CVE-2022-28757 | High | 8.8 | 2022-08-18 | The Zoom Client for Meetings for macOS (Standard and for IT Admin) starting with version 5.7.3 and before 5.11.6 contains a vulnerability in the auto update pr… |
CVE-2022-28709 | Medium | 4.4 | 2022-08-18 | Improper access control in the firmware for some Intel(R) E810 Ethernet Controllers before version 1.6.1.9 may allow a privileged user to potentially enable de… |
CVE-2022-28696 | High | 7.8 | 2022-08-18 | Uncontrolled search path in the Intel(R) Distribution for Python before version 2022.0.3 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2022-27500 | Medium | 5.5 | 2022-08-18 | Incorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enable information di… |
CVE-2022-26844 | High | 7.8 | 2022-08-18 | Insufficiently protected credentials in the installation binaries for Intel(R) SEAPI in all versions may allow an authenticated user to potentially enable esca… |
CVE-2022-26374 | High | 7.8 | 2022-08-18 | Uncontrolled search path in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of privi… |
CVE-2022-26373 | Medium | 5.5 | 2022-08-18 | Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially enable information… |
CVE-2022-26344 | High | 7.8 | 2022-08-18 | Incorrect default permissions in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of… |
CVE-2022-26074 | Medium | 4.4 | 2022-08-18 | Incomplete cleanup in a firmware subsystem for Intel(R) SPS before versions SPS_E3_04.08.04.330.0 and SPS_E3_04.01.04.530.0 may allow a privileged user to pote… |
CVE-2022-26017 | High | 8.0 | 2022-08-18 | Improper access control in the Intel(R) DSA software for before version 22.2.14 may allow an authenticated user to potentially enable escalation of privilege v… |