2022 CVEs (page 166)
Page 166 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31183 | Critical | 9.1 | 2022-08-01 | fs2 is a compositional, streaming I/O library for Scala. When establishing a server-mode `TLSSocket` using `fs2-io` on Node.js, the parameter `requestCert = tr… |
CVE-2022-31182 | Medium | 5.3 | 2022-08-01 | Discourse is the an open source discussion platform. In affected versions a maliciously crafted request for static assets could cause error responses to be cac… |
CVE-2022-31181 | Critical | 9.8 | 2022-08-01 | PrestaShop is an Open Source e-commerce platform. In versions from 1.6.0.10 and before 1.7.8.7 PrestaShop is subject to an SQL injection vulnerability which ca… |
CVE-2022-31180 | Critical | 9.8 | 2022-08-01 | Shescape is a simple shell escape package for JavaScript. Affected versions were found to have insufficient escaping of white space when interpolating output… |
CVE-2022-31179 | High | 8.1 | 2022-08-01 | Shescape is a simple shell escape package for JavaScript. Versions prior to 1.5.8 were found to be subject to code injection on windows. This impacts users tha… |
CVE-2022-31178 | Medium | 4.3 | 2022-08-01 | eLabFTW is an electronic lab notebook manager for research teams. A vulnerability was discovered which allows a logged in user to read a template without being… |
CVE-2022-31177 | Low | 2.7 | 2022-08-01 | Flask-AppBuilder is an application development framework built on top of Flask python framework. In versions prior to 4.1.3 an authenticated Admin user could q… |
CVE-2022-31173 | High | 7.5 | 2022-08-01 | Juniper is a GraphQL server library for Rust. Affected versions of Juniper are vulnerable to uncontrolled recursion resulting in a program crash. This issue ha… |
CVE-2022-31155 | Medium | 4.3 | 2022-08-01 | Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ sa… |
CVE-2022-31154 | Medium | 6.4 | 2022-08-01 | Sourcegraph is an opensource code search and navigation engine. It is possible for an authenticated Sourcegraph user to edit the Code Monitors owned by any oth… |
CVE-2022-31148 | Medium | 5.4 | 2022-08-01 | Shopware is an open source e-commerce software. In versions from 5.7.0 a persistent cross site scripting (XSS) vulnerability exists in the customer module. Use… |
CVE-2022-31128 | Medium | 5.4 | 2022-08-01 | Tuleap is a Free & Open Source Suite to improve management of software developments and collaboration. In affected versions Tuleap does not properly verify per… |
CVE-2022-31109 | High | 7.2 | 2022-08-01 | laminas-diactoros is a PHP package containing implementations of the PSR-7 HTTP message interfaces and PSR-17 HTTP message factory interfaces. Applications tha… |
CVE-2022-34307 | Medium | 4.3 | 2022-08-01 | IBM CICS TX 11.1 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http… |
CVE-2022-34164 | Medium | 5.5 | 2022-08-01 | IBM CICS TX 11.1 could allow a local user to impersonate another legitimate user due to improper input validation. IBM X-Force ID: 229338. |
CVE-2022-34163 | Medium | 6.1 | 2022-08-01 | IBM CICS TX 11.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct va… |
CVE-2022-34162 | Medium | 6.1 | 2022-08-01 | IBM CICS TX 11.1 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote atta… |
CVE-2022-34161 | High | 8.8 | 2022-08-01 | IBM CICS TX 11.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a use… |
CVE-2022-33955 | Medium | 6.8 | 2022-08-01 | IBM CICS TX 11.1 could allow allow an attacker with physical access to the system to execute code due using a back and refresh attack. IBM X-Force ID: 229312. |
CVE-2022-30699 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting… |
CVE-2022-30698 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting a… |
CVE-2022-2598 | Medium | 6.5 | 2022-08-01 | Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100. |
CVE-2022-2596 | Medium | 5.9 | 2022-08-01 | Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10. |
CVE-2022-2595 | Critical | 10.0 | 2022-08-01 | Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1. |
CVE-2022-2589 | Medium | 6.1 | 2022-08-01 | Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3. |
CVE-2022-2581 | High | 7.8 | 2022-08-01 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104. |
CVE-2022-2580 | High | 7.8 | 2022-08-01 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102. |
CVE-2022-2571 | High | 7.8 | 2022-08-01 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101. |
CVE-2022-36343 | Low | 3.4 | 2022-08-01 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at Word… |
CVE-2022-36302 | High | 8.8 | 2022-08-01 | File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access different resources, w… |
CVE-2022-36301 | Critical | 9.8 | 2022-08-01 | BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device password. |
CVE-2022-34567 | High | 8.8 | 2022-08-01 | An issue in \Roaming\Mango\Plugins of University of Texas Multi-image Analysis GUI (Mango) 4.1 allows attackers to escalate privileges via crafted plugins. |
CVE-2022-34154 | High | 7.2 | 2022-08-01 | Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress. |
CVE-2022-2509 | High | 7.5 | 2022-08-01 | A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verif… |
CVE-2022-26445 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26444 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26443 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26442 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26441 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26440 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26439 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26438 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26437 | Critical | 9.8 | 2022-08-01 | In httpclient, there is a possible out of bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional executio… |
CVE-2022-26436 | Medium | 4.4 | 2022-08-01 | In emi mpu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privile… |
CVE-2022-26435 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-26434 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-26433 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-26432 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-26431 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-26430 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-26429 | High | 7.8 | 2022-08-01 | In cta, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of privilege… |
CVE-2022-26428 | Medium | 6.4 | 2022-08-01 | In video codec, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-26427 | Medium | 6.7 | 2022-08-01 | In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-26426 | Medium | 6.7 | 2022-08-01 | In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-21792 | Medium | 6.7 | 2022-08-01 | In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-21791 | Medium | 4.4 | 2022-08-01 | In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2022-21790 | Medium | 4.4 | 2022-08-01 | In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2022-21789 | Medium | 6.4 | 2022-08-01 | In audio ipi, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-21788 | Medium | 6.7 | 2022-08-01 | In scp, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-2370 | Medium | 6.5 | 2022-08-01 | The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any aut… |
CVE-2022-2369 | Medium | 4.3 | 2022-08-01 | The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs o… |
CVE-2022-2328 | Medium | 4.8 | 2022-08-01 | The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-… |
CVE-2022-2325 | Medium | 4.8 | 2022-08-01 | The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users su… |
CVE-2022-2317 | Critical | 9.8 | 2022-08-01 | The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user sup… |
CVE-2022-2305 | Medium | 4.8 | 2022-08-01 | The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2022-2278 | Medium | 4.8 | 2022-08-01 | The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege… |
CVE-2022-2273 | High | 8.8 | 2022-08-01 | The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escal… |
CVE-2022-2260 | Medium | 6.5 | 2022-08-01 | The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which… |
CVE-2022-2245 | High | 8.8 | 2022-08-01 | The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in… |
CVE-2022-2241 | Medium | 6.1 | 2022-08-01 | The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to m… |
CVE-2022-2215 | Medium | 4.8 | 2022-08-01 | The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to… |
CVE-2022-2184 | High | 8.8 | 2022-08-01 | The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by att… |
CVE-2022-2181 | Medium | 6.1 | 2022-08-01 | The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard… |
CVE-2022-2171 | Medium | 5.4 | 2022-08-01 | The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admi… |
CVE-2022-2170 | Medium | 4.8 | 2022-08-01 | The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users… |
CVE-2022-26310 | High | 7.3 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module cou… |
CVE-2022-26309 | Low | 3.7 | 2022-08-01 | Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group. |
CVE-2022-26308 | Low | 3.7 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could cre… |
CVE-2022-1950 | Critical | 9.8 | 2022-08-01 | The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthent… |
CVE-2022-1906 | Medium | 6.1 | 2022-08-01 | The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unaut… |
CVE-2022-1600 | Medium | 5.3 | 2022-08-01 | The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypa… |
CVE-2022-1585 | High | 7.5 | 2022-08-01 | The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visito… |
CVE-2022-1561 | Medium | 4.0 | 2022-08-01 | Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to… |
CVE-2022-1324 | Medium | 4.8 | 2022-08-01 | The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform… |
CVE-2022-0598 | Medium | 4.8 | 2022-08-01 | The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-… |
CVE-2022-27255 | Critical | 9.8 | 2022-08-01 | In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to remote… |
CVE-2022-36799 | High | 7.2 | 2022-08-01 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of… |
CVE-2022-35716 | Medium | 6.5 | 2022-08-01 | IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 through 7.2.3.0 could allow an authenticate… |
CVE-2022-34338 | Medium | 6.5 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types… |
CVE-2022-33169 | Medium | 6.5 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Forc… |
CVE-2022-32750 | Medium | 5.4 | 2022-08-01 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting… |
CVE-2022-31776 | High | 8.8 | 2022-08-01 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request f… |
CVE-2022-31775 | Critical | 9.1 | 2022-08-01 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entit… |
CVE-2022-31774 | Medium | 5.4 | 2022-08-01 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting… |
CVE-2022-30616 | High | 7.2 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulati… |
CVE-2022-2591 | High | 7.5 | 2022-08-01 | A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reboot. The manipulati… |
CVE-2022-22505 | High | 7.5 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow IBM tenant credentials to be exposed. IBM X-Force ID: 22728… |
CVE-2022-22334 | Medium | 4.3 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information from a tenant of which they should not have access. IBM X-Fo… |
CVE-2022-22326 | Low | 3.3 | 2022-08-01 | IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and fil… |
CVE-2022-33994 | Low | 3.0 | 2022-07-30 | The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS… |