2022 CVEs (page 157)
Page 157 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2180 | Critical | 9.8 | 2022-08-15 | The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an un… |
CVE-2022-2152 | Medium | 4.8 | 2022-08-15 | The Duplicate Page and Post WordPress plugin before 2.8 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross… |
CVE-2022-2116 | Medium | 6.1 | 2022-08-15 | The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected… |
CVE-2022-35949 | Medium | 5.3 | 2022-08-12 | undici is an HTTP/1.1 client, written from scratch for Node.js.`undici` is vulnerable to SSRF (Server-side Request Forgery) when an application takes in **user… |
CVE-2022-35942 | Critical | 9.3 | 2022-08-12 | Improper input validation on the `contains` LoopBack filter may allow for arbitrary SQL injection. When the extended filter property `contains` is permitted to… |
CVE-2022-35956 | Medium | 5.8 | 2022-08-12 | This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for… |
CVE-2022-35953 | High | 7.1 | 2022-08-12 | BookWyrm is a social network for tracking your reading, talking about books, writing reviews, and discovering what to read next. Some links in BookWyrm may be… |
CVE-2022-35943 | Medium | 5.9 | 2022-08-12 | Shield is an authentication and authorization framework for CodeIgniter 4. This vulnerability may allow [SameSite Attackers](https://canitakeyoursubdomain.name… |
CVE-2022-38183 | Medium | 6.5 | 2022-08-12 | In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to an… |
CVE-2022-37397 | High | 8.3 | 2022-08-12 | An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticat… |
CVE-2022-2804 | Medium | 6.3 | 2022-08-12 | A vulnerability was found in SourceCodester Zoo Management System. It has been classified as critical. Affected is an unknown function of the file /pages/apply… |
CVE-2022-2803 | Medium | 6.3 | 2022-08-12 | A vulnerability was found in SourceCodester Zoo Management System and classified as critical. This issue affects some unknown processing of the file /pages/ani… |
CVE-2022-2802 | High | 7.3 | 2022-08-12 | A vulnerability has been found in SourceCodester Gas Agency Management System and classified as critical. This vulnerability affects unknown code of the file g… |
CVE-2022-2801 | Medium | 6.3 | 2022-08-12 | A vulnerability, which was classified as critical, was found in SourceCodester Automated Beer Parlour Billing System. This affects an unknown part of the compo… |
CVE-2022-2800 | Medium | 4.3 | 2022-08-12 | A vulnerability, which was classified as problematic, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functional… |
CVE-2022-2624 | High | 8.8 | 2022-08-12 | Heap buffer overflow in PDF in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interactions to p… |
CVE-2022-2623 | High | 8.8 | 2022-08-12 | Use after free in Offline in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interact… |
CVE-2022-2622 | Medium | 6.5 | 2022-08-12 | Insufficient validation of untrusted input in Safe Browsing in Google Chrome on Windows prior to 104.0.5112.79 allowed a remote attacker to bypass download res… |
CVE-2022-2621 | High | 8.8 | 2022-08-12 | Use after free in Extensions in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2022-2620 | High | 8.8 | 2022-08-12 | Use after free in WebUI in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user interact… |
CVE-2022-2619 | Medium | 4.3 | 2022-08-12 | Insufficient validation of untrusted input in Settings in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious… |
CVE-2022-2618 | Medium | 6.5 | 2022-08-12 | Insufficient validation of untrusted input in Internals in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to bypass download restrictions via a… |
CVE-2022-2617 | High | 8.8 | 2022-08-12 | Use after free in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extension to potential… |
CVE-2022-2616 | Medium | 6.5 | 2022-08-12 | Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious extensio… |
CVE-2022-2615 | Medium | 6.5 | 2022-08-12 | Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-2614 | High | 8.8 | 2022-08-12 | Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-2613 | High | 8.8 | 2022-08-12 | Use after free in Input in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enage in specific user interacti… |
CVE-2022-2612 | Medium | 6.5 | 2022-08-12 | Side-channel information leakage in Keyboard input in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who had compromised the renderer process t… |
CVE-2022-2611 | Medium | 4.3 | 2022-08-12 | Inappropriate implementation in Fullscreen API in Google Chrome on Android prior to 104.0.5112.79 allowed a remote attacker to spoof the contents of the Omnibo… |
CVE-2022-2610 | Medium | 6.5 | 2022-08-12 | Insufficient policy enforcement in Background Fetch in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to leak cross-origin data via a crafted H… |
CVE-2022-2609 | High | 8.8 | 2022-08-12 | Use after free in Nearby Share in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user i… |
CVE-2022-2608 | High | 8.8 | 2022-08-12 | Use after free in Overview Mode in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user… |
CVE-2022-2607 | High | 8.8 | 2022-08-12 | Use after free in Tab Strip in Google Chrome on Chrome OS prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific user inte… |
CVE-2022-2606 | High | 8.8 | 2022-08-12 | Use after free in Managed devices API in Google Chrome prior to 104.0.5112.79 allowed a remote attacker who convinced a user to enable a specific Enterprise po… |
CVE-2022-2605 | Medium | 6.5 | 2022-08-12 | Out of bounds read in Dawn in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-2604 | High | 8.8 | 2022-08-12 | Use after free in Safe Browsing in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2022-2603 | High | 8.8 | 2022-08-12 | Use after free in Omnibox in Google Chrome prior to 104.0.5112.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-2587 | Critical | 9.8 | 2022-08-12 | Out of bounds write in Chrome OS Audio Server in Google Chrome on Chrome OS prior to 102.0.5005.125 allowed a remote attacker to potentially exploit heap corru… |
CVE-2022-2797 | Medium | 6.3 | 2022-08-12 | A vulnerability classified as critical was found in SourceCodester Student Information System. Affected by this vulnerability is an unknown functionality of th… |
CVE-2022-35980 | High | 7.5 | 2022-08-12 | OpenSearch Security is a plugin for OpenSearch that offers encryption, authentication and authorization. Versions 2.0.0.0 and 2.1.0.0 of the security plugin ar… |
CVE-2022-35932 | Low | 3.5 | 2022-08-12 | Nextcloud Talk is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.7, 13.0.7, and 14.0.3, password protected conversations are suscepti… |
CVE-2022-35590 | Medium | 4.8 | 2022-08-12 | A cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "end_date" Parameter |
CVE-2022-35589 | Medium | 4.8 | 2022-08-12 | A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_time" Parameter. |
CVE-2022-35587 | Medium | 4.8 | 2022-08-12 | A cross-site scripting (XSS) issue in the Fork version 5.9.3 allows remote attackers to inject JavaScript via the "publish_on_date" Parameter |
CVE-2022-35585 | Medium | 4.8 | 2022-08-12 | A stored cross-site scripting (XSS) issue in the ForkCMS version 5.9.3 allows remote attackers to inject JavaScript via the "start_date" Parameter |
CVE-2022-37423 | High | 7.5 | 2022-08-12 | Neo4j APOC (Awesome Procedures on Cypher) before 4.3.0.7 and 4.x before 4.4.0.8 allows Directory Traversal to sibling directories via apoc.log.stream. |
CVE-2022-37044 | Medium | 6.1 | 2022-08-12 | In Zimbra Collaboration Suite (ZCS) 8.8.15, the URL at /h/search?action accepts parameters called extra, title, and onload that are partially sanitised and lea… |
CVE-2022-37043 | Medium | 5.7 | 2022-08-12 | An issue was discovered in the webmail component in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. When using preauth, CSRF tokens are not checked on some PO… |
CVE-2022-37042 | Critical | 9.8 | 2022-08-12 | Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authenticatio… |
CVE-2022-37041 | High | 7.5 | 2022-08-12 | An issue was discovered in ProxyServlet.java in the /proxy servlet in Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0. The value of the X-Forwarded-Host header… |
CVE-2022-35561 | High | 7.5 | 2022-08-12 | A stack overflow vulnerability exists in /goform/WifiMacFilterSet in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of… |
CVE-2022-35560 | High | 7.5 | 2022-08-12 | A stack overflow vulnerability exists in /goform/wifiSSIDset in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of servi… |
CVE-2022-35559 | Critical | 9.8 | 2022-08-12 | A stack overflow vulnerability exists in /goform/setAutoPing in Tenda W6 V1.0.0.9(4122), which allows an attacker to construct ping1 parameters and ping2 param… |
CVE-2022-35558 | High | 7.5 | 2022-08-12 | A stack overflow vulnerability exists in /goform/WifiMacFilterGet in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of… |
CVE-2022-35557 | High | 7.5 | 2022-08-12 | A stack overflow vulnerability exists in /goform/wifiSSIDget in Tenda W6 V1.0.0.9(4122) version, which can be exploited by attackers to cause a denial of servi… |
CVE-2022-35555 | Critical | 9.8 | 2022-08-12 | A command injection vulnerability exists in /goform/exeCommand in Tenda W6 V1.0.0.9(4122), which allows attackers to construct cmdinput parameters for arbitrar… |
CVE-2022-28636 | High | 7.4 | 2022-08-12 | A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Light… |
CVE-2022-28635 | High | 7.4 | 2022-08-12 | A potential local arbitrary code execution and a local denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Light… |
CVE-2022-28634 | Medium | 6.7 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged us… |
CVE-2022-28633 | High | 7.3 | 2022-08-12 | A local disclosure of sensitive information and a local unauthorized data modification vulnerability were discovered in HPE Integrated Lights-Out 5 (iLO 5) fir… |
CVE-2022-28632 | High | 8.8 | 2022-08-12 | A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO… |
CVE-2022-28631 | High | 8.8 | 2022-08-12 | A potential arbitrary code execution and a denial of service (DoS) vulnerability within an isolated process were discovered in HPE Integrated Lights-Out 5 (iLO… |
CVE-2022-28630 | High | 7.3 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user c… |
CVE-2022-28629 | High | 7.8 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A low privileged user… |
CVE-2022-28628 | High | 8.4 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user c… |
CVE-2022-28627 | High | 8.4 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. An unprivileged user c… |
CVE-2022-28626 | Medium | 6.7 | 2022-08-12 | A local arbitrary code execution vulnerability was discovered in HPE Integrated Lights-Out 5 (iLO 5) firmware version(s): Prior to 2.71. A highly privileged us… |
CVE-2022-20362 | High | 8.8 | 2022-08-12 | In Bluetooth, there is a possible out of bounds write due to an integer overflow. This could lead to remote code execution over Bluetooth with no additional ex… |
CVE-2022-20342 | Low | 3.3 | 2022-08-12 | In WiFi, there is a possible disclosure of WiFi password to the end user due to an insecure default value. This could lead to local information disclosure with… |
CVE-2022-20341 | Medium | 5.5 | 2022-08-12 | In ConnectivityService, there is a possible bypass of network permissions due to a missing permission check. This could lead to local information disclosure of… |
CVE-2022-20340 | Low | 3.3 | 2022-08-12 | In SELinux policy, there is a possible way of inferring which websites are being opened in the browser due to a missing permission check. This could lead to lo… |
CVE-2022-20339 | Low | 3.3 | 2022-08-12 | In Android, there is a possible access of network neighbor table information due to an insecure SEpolicy configuration. This could lead to local information di… |
CVE-2022-20338 | Low | 3.3 | 2022-08-12 | In HierarchicalUri.readFrom of Uri.java, there is a possible way to craft a malformed Uri object due to improper input validation. This could lead to a local e… |
CVE-2022-20336 | Low | 3.3 | 2022-08-12 | In Settings, there is a possible installed application disclosure due to a missing permission check. This could lead to local information disclosure of applica… |
CVE-2022-20335 | Low | 3.3 | 2022-08-12 | In Wifi Slice, there is a possible way to adjust Wi-Fi settings even when the permission has been disabled due to a missing permission check. This could lead t… |
CVE-2022-20334 | Medium | 6.5 | 2022-08-12 | In Bluetooth, there are possible process crashes due to dereferencing a null pointer. This could lead to remote denial of service with no additional execution… |
CVE-2022-20333 | Medium | 6.5 | 2022-08-12 | In Bluetooth, there is a possible crash due to a missing null check. This could lead to remote denial of service with no additional execution privileges needed… |
CVE-2022-20332 | Medium | 5.5 | 2022-08-12 | In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Thi… |
CVE-2022-20331 | High | 7.8 | 2022-08-12 | In the Framework, there is a possible way to enable a work profile without user consent due to a tapjacking/overlay attack. This could lead to local escalation… |
CVE-2022-20330 | Low | 3.5 | 2022-08-12 | In Bluetooth, there is a possible way to connect or disconnect bluetooth devices without user awareness due to a missing permission check. This could lead to l… |
CVE-2022-20329 | High | 7.8 | 2022-08-12 | In Wifi, there is a possible way to enable Wifi without permissions due to a missing permission check. This could lead to local escalation of privilege with no… |
CVE-2022-20328 | Low | 3.3 | 2022-08-12 | In PackageManager, there is a possible way to determine whether an app is installed due to a missing permission check. This could lead to local information dis… |
CVE-2022-20327 | Low | 2.8 | 2022-08-12 | In Wi-Fi, there is a possible way to retrieve the WiFi SSID without location permissions due to a missing permission check. This could lead to local informatio… |
CVE-2022-20326 | Medium | 5.5 | 2022-08-12 | In Telephony, there is a possible disclosure of SIM identifiers due to a missing permission check. This could lead to local information disclosure with User ex… |
CVE-2022-20325 | High | 7.8 | 2022-08-12 | In Media, there is a possible code execution due to a use after free. This could lead to local escalation of privilege with no additional execution privileges… |
CVE-2022-20324 | Medium | 5.5 | 2022-08-12 | In Framework, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. This cou… |
CVE-2022-20323 | Medium | 5.5 | 2022-08-12 | In PackageManager, there is a possible package installation disclosure due to a missing permission check. This could lead to local information disclosure with… |
CVE-2022-20322 | Medium | 5.5 | 2022-08-12 | In PackageManager, there is a possible installed package disclosure due to a missing permission check. This could lead to local information disclosure with no… |
CVE-2022-20321 | Low | 3.3 | 2022-08-12 | In Settings, there is a possible way for an application without permissions to read content of WiFi QR codes due to a missing permission check. This could lead… |
CVE-2022-20320 | Low | 3.3 | 2022-08-12 | In ActivityManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2022-20319 | High | 7.8 | 2022-08-12 | In DreamServices, there is a possible way to launch arbitrary protected activities due to a confused deputy. This could lead to local escalation of privilege w… |
CVE-2022-20318 | Low | 3.3 | 2022-08-12 | In PackageInstaller, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. T… |
CVE-2022-20317 | Medium | 5.5 | 2022-08-12 | In SystemUI, there is a possible way to unexpectedly enable the external speaker due to a logic error in the code. This could lead to local information disclos… |
CVE-2022-20316 | Low | 3.3 | 2022-08-12 | In ContentResolver, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disclosure. Th… |
CVE-2022-20315 | Low | 3.3 | 2022-08-12 | In ActivityManager, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure wit… |
CVE-2022-20314 | Medium | 6.7 | 2022-08-12 | In KeyChain, there is a possible spoof keychain chooser activity request due to improper input validation. This could lead to local escalation of privilege wit… |
CVE-2022-20313 | Medium | 6.8 | 2022-08-12 | In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2022-20312 | Medium | 5.5 | 2022-08-12 | In WifiP2pManager, there is a possible toobtain WiFi P2P MAC address without user consent due to missing permission check. This could lead to local information… |
CVE-2022-20311 | Low | 3.3 | 2022-08-12 | In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check. This could lead to local information d… |
CVE-2022-20310 | Low | 3.3 | 2022-08-12 | In Telecomm, there is a possible disclosure of registered self managed phone accounts due to a missing permission check. This could lead to local information d… |