2022 CVEs (page 170)
Page 170 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34749 | High | 7.5 | 2022-07-25 | In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge c… |
CVE-2022-34577 | Critical | 9.8 | 2022-07-25 | A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2022-34576 | High | 7.5 | 2022-07-25 | A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request. |
CVE-2022-34575 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fct… |
CVE-2022-34574 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tft… |
CVE-2022-34573 | Medium | 6.3 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings via accessing the pa… |
CVE-2022-34572 | Medium | 5.7 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt. |
CVE-2022-34571 | High | 8.0 | 2022-07-25 | An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary co… |
CVE-2022-34570 | High | 7.5 | 2022-07-25 | WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the mess… |
CVE-2022-35131 | Critical | 9.0 | 2022-07-25 | Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. |
CVE-2022-34907 | Critical | 9.8 | 2022-07-25 | An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to gain acc… |
CVE-2022-34906 | High | 7.5 | 2022-07-25 | A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to decrypt sensiti… |
CVE-2022-36375 | High | 7.2 | 2022-07-25 | Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress. |
CVE-2022-35873 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User inte… |
CVE-2022-35872 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). User inte… |
CVE-2022-35871 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentic… |
CVE-2022-35870 | High | 7.8 | 2022-07-25 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Although… |
CVE-2022-35869 | Critical | 9.8 | 2022-07-25 | This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). Authentica… |
CVE-2022-34966 | High | 7.5 | 2022-07-25 | OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an HTML injection vulnerability via the location parameter at http://ip_addre… |
CVE-2022-23000 | High | 7.3 | 2022-07-25 | The Western Digital My Cloud Web App [https://os5.mycloud.com/] uses a weak SSLContext when attempting to configure port forwarding rules. This was enabled to… |
CVE-2022-22999 | High | 8.2 | 2022-07-25 | Western Digital My Cloud devices are vulnerable to a cross side scripting vulnerability that can allow a malicious user with elevated privileges access to driv… |
CVE-2022-35288 | Medium | 6.5 | 2022-07-25 | IBM Security Verify Information Queue 10.0.2 could allow a user to obtain sensitive information that could be used in further attacks against the system. IBM X… |
CVE-2022-35287 | High | 7.5 | 2022-07-25 | IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authen… |
CVE-2022-35285 | High | 8.8 | 2022-07-25 | IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized ac… |
CVE-2022-35284 | High | 7.5 | 2022-07-25 | IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X… |
CVE-2022-34962 | Medium | 5.4 | 2022-07-25 | OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Group Timeline modu… |
CVE-2022-33969 | High | 7.2 | 2022-07-25 | Authenticated WordPress Options Change vulnerability in Biplob Adhikari's Flipbox plugin <= 2.6.0 at WordPress. |
CVE-2022-2059 | Low | 3.5 | 2022-07-25 | In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can… |
CVE-2022-2032 | Low | 3.5 | 2022-07-25 | In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can… |
CVE-2022-24992 | High | 7.5 | 2022-07-25 | A vulnerability in the component process.php of QR Code Generator v5.2.7 allows attackers to perform directory traversal. |
CVE-2022-34965 | High | 7.2 | 2022-07-25 | OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/… |
CVE-2022-24083 | Critical | 9.8 | 2022-07-25 | Password authentication bypass vulnerability for local accounts can be used to bypass local authentication checks. |
CVE-2022-35653 | Medium | 6.1 | 2022-07-25 | A reflected XSS issue was identified in the LTI module of Moodle. The vulnerability exists due to insufficient sanitization of user-supplied data in the LTI mo… |
CVE-2022-35652 | Medium | 6.1 | 2022-07-25 | An open redirect issue was found in Moodle due to improper sanitization of user-supplied data in mobile auto-login feature. A remote attacker can create a link… |
CVE-2022-35651 | Medium | 6.1 | 2022-07-25 | A stored XSS and blind SSRF vulnerability was found in Moodle, occurs due to insufficient sanitization of user-supplied data in the SCORM track details. A remo… |
CVE-2022-35650 | High | 7.5 | 2022-07-25 | The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. This insufficient path checks results in arbitrary… |
CVE-2022-35649 | Critical | 9.8 | 2022-07-25 | The vulnerability was found in Moodle, occurs due to improper input validation when parsing PostScript code. An omitted execution parameter results in a remote… |
CVE-2022-34964 | Medium | 4.8 | 2022-07-25 | OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the SitePages module. |
CVE-2022-34963 | Medium | 5.4 | 2022-07-25 | OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the News Feed module. |
CVE-2022-34961 | Medium | 5.4 | 2022-07-25 | OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Users Timeline modu… |
CVE-2022-33965 | Critical | 9.3 | 2022-07-25 | Multiple Unauthenticated SQL Injection (SQLi) vulnerabilities in Osamaesh WP Visitor Statistics plugin <= 5.7 at WordPress. |
CVE-2022-2131 | High | 8.5 | 2022-07-25 | OpenKM Community Edition in its 6.3.10 version and before was using XMLReader parser in XMLTextExtractor.java file without the required security flags, allowin… |
CVE-2022-26307 | High | 8.8 | 2022-07-25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master… |
CVE-2022-26306 | High | 7.5 | 2022-07-25 | LibreOffice supports the storage of passwords for web connections in the user’s configuration database. The stored passwords are encrypted with a single master… |
CVE-2022-26305 | High | 7.5 | 2022-07-25 | An Improper Certificate Validation vulnerability in LibreOffice existed where determining if a macro was signed by a trusted author was done by only matching t… |
CVE-2022-2523 | Medium | 6.1 | 2022-07-25 | Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2. |
CVE-2022-2522 | High | 7.8 | 2022-07-25 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. |
CVE-2022-2514 | Medium | 6.1 | 2022-07-25 | The time and filter parameters in Fava prior to v1.22 are vulnerable to reflected XSS due to the lack of escaping of error messages which contained the paramet… |
CVE-2022-21802 | Medium | 5.4 | 2022-07-25 | The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager. |
CVE-2022-1314 | High | 8.8 | 2022-07-25 | Type confusion in V8 in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1313 | High | 8.8 | 2022-07-25 | Use after free in tab groups in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1312 | Critical | 9.6 | 2022-07-25 | Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a malicious extension to potentially perf… |
CVE-2022-1311 | High | 8.8 | 2022-07-25 | Use after free in shell in Google Chrome on ChromeOS prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2022-1310 | High | 8.8 | 2022-07-25 | Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HT… |
CVE-2022-1309 | Critical | 9.6 | 2022-07-25 | Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform a sandbox escape vi… |
CVE-2022-1308 | High | 8.8 | 2022-07-25 | Use after free in BFCache in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1307 | Medium | 4.3 | 2022-07-25 | Inappropriate implementation in full screen in Google Chrome on Android prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the Omnibox (… |
CVE-2022-1306 | Medium | 4.3 | 2022-07-25 | Inappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) vi… |
CVE-2022-1305 | High | 8.8 | 2022-07-25 | Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1232 | High | 8.8 | 2022-07-25 | Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0670 | Critical | 9.1 | 2022-07-25 | A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vul… |
CVE-2022-2341 | Medium | 4.8 | 2022-07-25 | The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2022-2340 | Medium | 4.8 | 2022-07-25 | The W-DALIL WordPress plugin through 2.0 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Store… |
CVE-2022-2299 | Medium | 5.4 | 2022-07-25 | The Allow SVG Files WordPress plugin through 1.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicio… |
CVE-2022-2240 | High | 8.8 | 2022-07-25 | The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quo… |
CVE-2022-2239 | Medium | 4.8 | 2022-07-25 | The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cro… |
CVE-2022-2219 | High | 7.2 | 2022-07-25 | The Unyson WordPress plugin before 2.7.27 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scr… |
CVE-2022-2189 | Medium | 6.1 | 2022-07-25 | The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which coul… |
CVE-2022-2115 | Medium | 6.1 | 2022-07-25 | The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected… |
CVE-2022-2072 | Medium | 6.1 | 2022-07-25 | The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-… |
CVE-2022-2071 | Medium | 6.1 | 2022-07-25 | The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some o… |
CVE-2022-1551 | Medium | 6.5 | 2022-07-25 | The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other use… |
CVE-2022-1539 | High | 8.8 | 2022-07-25 | The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injectio… |
CVE-2022-0899 | Medium | 6.1 | 2022-07-25 | The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leadin… |
CVE-2022-0594 | Medium | 5.3 | 2022-07-25 | The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action… |
CVE-2022-29709 | High | 7.5 | 2022-07-25 | CommuniLink Internet Limited CLink Office v2.0 was discovered to contain multiple SQL injection vulnerabilities via the username and password parameters. |
CVE-2022-36450 | High | 8.0 | 2022-07-25 | Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL. |
CVE-2022-36446 | Critical | 9.8 | 2022-07-25 | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. |
CVE-2022-36444 | High | 8.6 | 2022-07-25 | An issue was discovered in Atos Unify OpenScape SBC 9 and 10 before 10R2.2.1, Atos Unify OpenScape Branch 9 and 10 before version 10R2.1.1, and Atos Unify Open… |
CVE-2022-24294 | High | 7.5 | 2022-07-24 | A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be explo… |
CVE-2022-36415 | High | 7.8 | 2022-07-23 | A DLL hijacking vulnerability exists in the uninstaller in Scooter Beyond Compare 1.8a through 4.4.2 before 4.4.3 when installed via the EXE installer. The uni… |
CVE-2022-36414 | Medium | 6.7 | 2022-07-23 | There is an elevation of privilege breakout vulnerability in the Windows EXE installer in Scooter Beyond Compare 4.2.0 through 4.4.2 before 4.4.3. Affected ver… |
CVE-2022-1146 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Resource Timing in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted HTML… |
CVE-2022-1145 | High | 7.5 | 2022-07-23 | Use after free in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2022-1144 | High | 8.8 | 2022-07-23 | Use after free in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to potent… |
CVE-2022-1143 | High | 8.8 | 2022-07-23 | Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to… |
CVE-2022-1142 | High | 8.8 | 2022-07-23 | Heap buffer overflow in WebUI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to… |
CVE-2022-1141 | High | 8.8 | 2022-07-23 | Use after free in File Manager in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to… |
CVE-2022-1139 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Background Fetch API in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to leak cross-origin data via a crafted… |
CVE-2022-1138 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscur… |
CVE-2022-1137 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Extensions in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to… |
CVE-2022-1136 | High | 8.8 | 2022-07-23 | Use after free in Tab Strip in Google Chrome prior to 100.0.4896.60 allowed an attacker who convinced a user to install a malicious extension to potentially ex… |
CVE-2022-1135 | High | 8.8 | 2022-07-23 | Use after free in Shopping Cart in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via standard feature u… |
CVE-2022-1134 | High | 8.8 | 2022-07-23 | Type confusion in V8 in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1133 | High | 8.8 | 2022-07-23 | Use after free in WebRTC Perf in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1132 | Medium | 6.1 | 2022-07-23 | Inappropriate implementation in Virtual Keyboard in Google Chrome on Chrome OS prior to 100.0.4896.60 allowed a local attacker to bypass navigation restriction… |
CVE-2022-1131 | High | 8.8 | 2022-07-23 | Use after free in Cast UI in Google Chrome prior to 100.0.4896.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-1130 | High | 8.1 | 2022-07-23 | Insufficient validation of trust input in WebOTP in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to send arbitrary intents from an… |
CVE-2022-1129 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 100.0.4896.60 allowed a remote attacker to spoof the contents of the Omni… |
CVE-2022-1128 | Medium | 6.5 | 2022-07-23 | Inappropriate implementation in Web Share API in Google Chrome on Windows prior to 100.0.4896.60 allowed an attacker on the local network segment to leak cross… |