2022 CVEs (page 166)
Page 166 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-30699 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting… |
CVE-2022-30698 | Medium | 6.5 | 2022-08-01 | NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting a… |
CVE-2022-2598 | Medium | 6.5 | 2022-08-01 | Out-of-bounds Write to API in GitHub repository vim/vim prior to 9.0.0100. |
CVE-2022-2596 | Medium | 5.9 | 2022-08-01 | Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10. |
CVE-2022-2595 | Critical | 10.0 | 2022-08-01 | Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1. |
CVE-2022-2589 | Medium | 6.1 | 2022-08-01 | Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.3. |
CVE-2022-2581 | High | 7.8 | 2022-08-01 | Out-of-bounds Read in GitHub repository vim/vim prior to 9.0.0104. |
CVE-2022-2580 | High | 7.8 | 2022-08-01 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0102. |
CVE-2022-2571 | High | 7.8 | 2022-08-01 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0101. |
CVE-2022-36343 | Low | 3.4 | 2022-08-01 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at Word… |
CVE-2022-36302 | High | 8.8 | 2022-08-01 | File path manipulation vulnerability in BF-OS version 3.00 up to and including 3.83 allows an attacker to modify the file path to access different resources, w… |
CVE-2022-36301 | Critical | 9.8 | 2022-08-01 | BF-OS version 3.x up to and including 3.83 do not enforce strong passwords which may allow a remote attacker to brute-force the device password. |
CVE-2022-34567 | High | 8.8 | 2022-08-01 | An issue in \Roaming\Mango\Plugins of University of Texas Multi-image Analysis GUI (Mango) 4.1 allows attackers to escalate privileges via crafted plugins. |
CVE-2022-34154 | High | 7.2 | 2022-08-01 | Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress. |
CVE-2022-2509 | High | 7.5 | 2022-08-01 | A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verif… |
CVE-2022-26445 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26444 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26443 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26442 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26441 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26440 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26439 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26438 | Medium | 6.7 | 2022-08-01 | In wifi driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-26437 | Critical | 9.8 | 2022-08-01 | In httpclient, there is a possible out of bounds write due to uninitialized data. This could lead to remote escalation of privilege with no additional executio… |
CVE-2022-26436 | Medium | 4.4 | 2022-08-01 | In emi mpu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privile… |
CVE-2022-26435 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-26434 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-26433 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-26432 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-26431 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-26430 | Medium | 6.7 | 2022-08-01 | In mailbox, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege with System execution privileges ne… |
CVE-2022-26429 | High | 7.8 | 2022-08-01 | In cta, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of privilege… |
CVE-2022-26428 | Medium | 6.4 | 2022-08-01 | In video codec, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-26427 | Medium | 6.7 | 2022-08-01 | In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-26426 | Medium | 6.7 | 2022-08-01 | In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-21792 | Medium | 6.7 | 2022-08-01 | In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-21791 | Medium | 4.4 | 2022-08-01 | In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2022-21790 | Medium | 4.4 | 2022-08-01 | In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution priv… |
CVE-2022-21789 | Medium | 6.4 | 2022-08-01 | In audio ipi, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-21788 | Medium | 6.7 | 2022-08-01 | In scp, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileg… |
CVE-2022-2370 | Medium | 6.5 | 2022-08-01 | The YaySMTP WordPress plugin before 2.2.1 does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any aut… |
CVE-2022-2369 | Medium | 4.3 | 2022-08-01 | The YaySMTP WordPress plugin before 2.2.1 does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs o… |
CVE-2022-2328 | Medium | 4.8 | 2022-08-01 | The Flexi Quote Rotator WordPress plugin through 0.9.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-… |
CVE-2022-2325 | Medium | 4.8 | 2022-08-01 | The Invitation Based Registrations WordPress plugin through 2.2.84 does not sanitise and escape some of its settings, which could allow high privilege users su… |
CVE-2022-2317 | Critical | 9.8 | 2022-08-01 | The Simple Membership WordPress plugin before 4.1.3 allows user to change their membership at the registration stage due to insufficient checking of a user sup… |
CVE-2022-2305 | Medium | 4.8 | 2022-08-01 | The WordPress Popup WordPress plugin through 1.9.3.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2022-2278 | Medium | 4.8 | 2022-08-01 | The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not validate, sanitise and escape some of its settings, which could allow high privilege… |
CVE-2022-2273 | High | 8.8 | 2022-08-01 | The Simple Membership WordPress plugin before 4.1.3 does not properly validate the membership_level parameter when editing a profile, allowing members to escal… |
CVE-2022-2260 | Medium | 6.5 | 2022-08-01 | The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which… |
CVE-2022-2245 | High | 8.8 | 2022-08-01 | The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in… |
CVE-2022-2241 | Medium | 6.1 | 2022-08-01 | The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to m… |
CVE-2022-2215 | Medium | 4.8 | 2022-08-01 | The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to… |
CVE-2022-2184 | High | 8.8 | 2022-08-01 | The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by att… |
CVE-2022-2181 | Medium | 6.1 | 2022-08-01 | The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard… |
CVE-2022-2171 | Medium | 5.4 | 2022-08-01 | The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admi… |
CVE-2022-2170 | Medium | 4.8 | 2022-08-01 | The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users… |
CVE-2022-26310 | High | 7.3 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper authorization in User Management where any authenticated user with access to the User Management module cou… |
CVE-2022-26309 | Low | 3.7 | 2022-08-01 | Pandora FMS v7.0NG.759 allows Cross-Site Request Forgery in Bulk operation (User operation) resulting in elevation of privilege to Administrator group. |
CVE-2022-26308 | Low | 3.7 | 2022-08-01 | Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration (Credential store) where a user with the role of Operator (Write) could cre… |
CVE-2022-1950 | Critical | 9.8 | 2022-08-01 | The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthent… |
CVE-2022-1906 | Medium | 6.1 | 2022-08-01 | The Copyright Proof WordPress plugin through 4.16 does not sanitise and escape a parameter before outputting it back via an AJAX action available to both unaut… |
CVE-2022-1600 | Medium | 5.3 | 2022-08-01 | The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypa… |
CVE-2022-1585 | High | 7.5 | 2022-08-01 | The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visito… |
CVE-2022-1561 | Medium | 4.0 | 2022-08-01 | Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to… |
CVE-2022-1324 | Medium | 4.8 | 2022-08-01 | The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform… |
CVE-2022-0598 | Medium | 4.8 | 2022-08-01 | The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-… |
CVE-2022-27255 | Critical | 9.8 | 2022-08-01 | In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. This allows an attacker to remote… |
CVE-2022-36799 | High | 7.2 | 2022-08-01 | This issue exists to document that a security improvement in the way that Jira Server and Data Center use templates has been implemented. Affected versions of… |
CVE-2022-35716 | Medium | 6.5 | 2022-08-01 | IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 through 7.2.3.0 could allow an authenticate… |
CVE-2022-34338 | Medium | 6.5 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could disclose sensitive information due to improper privilege management for storage provider types… |
CVE-2022-33169 | Medium | 6.5 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to insufficiently protected credentials for users created via a bulk upload. IBM X-Forc… |
CVE-2022-32750 | Medium | 5.4 | 2022-08-01 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting… |
CVE-2022-31776 | High | 8.8 | 2022-08-01 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request f… |
CVE-2022-31775 | Critical | 9.1 | 2022-08-01 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entit… |
CVE-2022-31774 | Medium | 5.4 | 2022-08-01 | IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting… |
CVE-2022-30616 | High | 7.2 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a privileged user to elevate their privilege to platform administrator through manipulati… |
CVE-2022-2591 | High | 7.5 | 2022-08-01 | A vulnerability classified as critical has been found in TEM FLEX-1085 1.6.0. Affected is an unknown function of the file /sistema/flash/reboot. The manipulati… |
CVE-2022-22505 | High | 7.5 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow IBM tenant credentials to be exposed. IBM X-Force ID: 22728… |
CVE-2022-22334 | Medium | 4.3 | 2022-08-01 | IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 could allow a user to access information from a tenant of which they should not have access. IBM X-Fo… |
CVE-2022-22326 | Low | 3.3 | 2022-08-01 | IBM Datapower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.5, and 2018.4.1.0 through 2018.4.1.18 could allow unauthorized viewing of logs and fil… |
CVE-2022-33994 | Low | 3.0 | 2022-07-30 | The Gutenberg plugin through 13.7.3 for WordPress allows stored XSS by the Contributor role via an SVG document to the "Insert from URL" feature. NOTE: the XSS… |
CVE-2022-36336 | High | 7.8 | 2022-07-30 | A link following vulnerability in the scanning function of Trend Micro Apex One and Worry-Free Business Security agents could allow a local attacker to escalat… |
CVE-2022-35234 | High | 7.1 | 2022-07-30 | Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read… |
CVE-2022-33158 | High | 7.8 | 2022-07-30 | Trend Micro VPN Proxy Pro version 5.2.1026 and below contains a vulnerability involving some overly permissive folders in a key directory which could allow a l… |
CVE-2022-30083 | Critical | 9.8 | 2022-07-30 | EllieGrid Android Application version 3.4.1 is vulnerable to Code Injection. The application appears to evaluate user input as code (remote). |
CVE-2022-34531 | Critical | 9.8 | 2022-07-29 | DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php. |
CVE-2022-34528 | High | 8.8 | 2022-07-29 | D-Link DSL-3782 v1.03 and below was discovered to contain a stack overflow via the function getAttrValue. |
CVE-2022-34527 | High | 8.8 | 2022-07-29 | D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte_4C0160. |
CVE-2022-34526 | Medium | 6.5 | 2022-07-29 | A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via… |
CVE-2022-34496 | Critical | 9.8 | 2022-07-29 | Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature. |
CVE-2022-36447 | High | 7.5 | 2022-07-29 | An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0. Previously minted tokens minted on the Chia blockchain using the CAT1 standard can be in… |
CVE-2022-2324 | High | 7.5 | 2022-07-29 | Improperly Implemented Security Check vulnerability in the SonicWall Hosted Email Security leads to bypass of Capture ATP security service in the appliance. Th… |
CVE-2022-22280 | Critical | 9.8 | 2022-07-29 | Improper Neutralization of Special Elements used in an SQL Command leading to Unauthenticated SQL Injection vulnerability, impacting SonicWall GMS 9.3.1-SP2-Ho… |
CVE-2022-2323 | High | 8.8 | 2022-07-29 | Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. Th… |
CVE-2022-27866 | High | 7.8 | 2022-07-29 | A maliciously crafted TIFF file when consumed through DesignReview.exe application can be forced to read beyond allocated boundaries when parsing the TIFF file… |
CVE-2022-27865 | High | 7.8 | 2022-07-29 | A maliciously crafted TGA or PCX file may be used to write beyond the allocated buffer through DesignReview.exe application while parsing TGA and PCX files. Th… |
CVE-2022-27864 | High | 8.8 | 2022-07-29 | A Double Free vulnerability allows remote attackers to execute arbitrary code through DesignReview.exe application on PDF files within affected installations… |
CVE-2022-36378 | Medium | 4.8 | 2022-07-29 | Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at WordPress. |
CVE-2022-2414 | High | 7.5 | 2022-07-29 | Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retriev… |
CVE-2022-23004 | Medium | 5.3 | 2022-07-29 | When computing a shared secret or point multiplication on the NIST P-256 curve using a public key with an X coordinate of zero, an error is returned from the l… |