2022 CVEs (page 171)
Page 171 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1127 | High | 8.8 | 2022-07-23 | Use after free in QR Code Generator in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interacti… |
CVE-2022-1125 | High | 8.8 | 2022-07-23 | Use after free in Portals in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who convinced a user to engage in specific user interaction to pote… |
CVE-2022-1096 | High | 8.8 | 2022-07-23 | Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-34115 | Critical | 9.8 | 2022-07-22 | DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId. |
CVE-2022-34114 | High | 8.8 | 2022-07-22 | Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. |
CVE-2022-34113 | Critical | 9.8 | 2022-07-22 | An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. |
CVE-2022-34112 | Medium | 6.5 | 2022-07-22 | An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved… |
CVE-2022-25759 | Critical | 9.9 | 2022-07-22 | The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload. |
CVE-2022-34853 | Medium | 4.1 | 2022-07-22 | Multiple Authenticated (contributor or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress. |
CVE-2022-34839 | Medium | 5.9 | 2022-07-22 | Authentication Bypass vulnerability in CodexShaper's WP OAuth2 Server plugin <= 1.0.1 at WordPress. |
CVE-2022-34650 | Medium | 4.1 | 2022-07-22 | Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress. |
CVE-2022-33960 | High | 8.5 | 2022-07-22 | Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. |
CVE-2022-33901 | Medium | 5.3 | 2022-07-22 | Unauthenticated Arbitrary File Read vulnerability in MultiSafepay plugin for WooCommerce plugin <= 4.13.1 at WordPress. |
CVE-2022-33191 | Medium | 4.1 | 2022-07-22 | Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress. |
CVE-2022-30998 | Critical | 9.1 | 2022-07-22 | Multiple Authenticated (subscriber or higher user role) SQL Injection (SQLi) vulnerabilities in WooPlugins.co's Homepage Product Organizer for WooCommerce plug… |
CVE-2022-29495 | Medium | 5.4 | 2022-07-22 | Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.11 at WordPress allows an attacker to update plugin settings. |
CVE-2022-27235 | Medium | 6.3 | 2022-07-22 | Multiple Broken Access Control vulnerabilities in Social Share Buttons by Supsystic plugin <= 2.2.3 at WordPress. |
CVE-2022-0980 | High | 8.8 | 2022-07-22 | Use after free in New Tab Page in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially… |
CVE-2022-0979 | High | 8.8 | 2022-07-22 | Use after free in Safe Browsing in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user int… |
CVE-2022-0978 | High | 8.8 | 2022-07-22 | Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-2511 | Medium | 4.3 | 2022-07-22 | Cross-site Scripting (XSS) vulnerability in the "commonuserinterface" component of BlueSpice allows an attacker to inject arbitrary HTML into a page using the… |
CVE-2022-2510 | Medium | 4.3 | 2022-07-22 | Cross-site Scripting (XSS) vulnerability in "Extension:ExtendedSearch" of Hallo Welt! GmbH BlueSpice allows attacker to inject arbitrary HTML (XSS) on page "Sp… |
CVE-2022-28879 | Medium | 4.3 | 2022-07-22 | A Denial-of-Service (DoS) vulnerability was discovered in F-Secure Atlant and in certain WithSecure products whereby the scanning the aepack.dll component can… |
CVE-2022-28878 | Medium | 4.3 | 2022-07-22 | A Denial-of-Service vulnerability was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed APK file it is possible that c… |
CVE-2022-34983 | Critical | 9.8 | 2022-07-22 | The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party. |
CVE-2022-34982 | Critical | 9.8 | 2022-07-22 | The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party. |
CVE-2022-34981 | Critical | 9.8 | 2022-07-22 | The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party. |
CVE-2022-34520 | Medium | 5.5 | 2022-07-22 | Radare2 v5.7.2 was discovered to contain a NULL pointer dereference via the function r_bin_file_xtr_load_buffer at bin/bfile.c. This vulnerability allows attac… |
CVE-2022-34509 | Critical | 9.8 | 2022-07-22 | The wikifaces package in PyPI v1.0 included a code execution backdoor inserted by a third party. |
CVE-2022-34503 | Medium | 6.5 | 2022-07-22 | QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows attackers to cause a Denial of… |
CVE-2022-34502 | Medium | 5.5 | 2022-07-22 | Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows atta… |
CVE-2022-34501 | Critical | 9.8 | 2022-07-22 | The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party. |
CVE-2022-34500 | Critical | 9.8 | 2022-07-22 | The bin-collect package in PyPI before v0.1 included a code execution backdoor inserted by a third party. |
CVE-2022-34037 | High | 7.5 | 2022-07-22 | An out-of-bounds read in the rewrite function at /modules/caddyhttp/rewrite/rewrite.go in Caddy v2.5.1 allows attackers to cause a Denial of Service (DoS) via… |
CVE-2022-2470 | Medium | 6.1 | 2022-07-22 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.21. |
CVE-2022-2143 | Critical | 9.8 | 2022-07-22 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. |
CVE-2022-2142 | High | 8.1 | 2022-07-22 | The affected product is vulnerable to a SQL injection with high attack complexity, which may allow an unauthorized attacker to disclose information. |
CVE-2022-2139 | Medium | 6.5 | 2022-07-22 | The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code. |
CVE-2022-2138 | High | 8.2 | 2022-07-22 | The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resu… |
CVE-2022-2137 | Medium | 4.9 | 2022-07-22 | The affected product is vulnerable to two SQL injections that require high privileges for exploitation and may allow an unauthorized attacker to disclose infor… |
CVE-2022-2136 | High | 8.8 | 2022-07-22 | The affected product is vulnerable to multiple SQL injections that require low privileges for exploitation and may allow an unauthorized attacker to disclose i… |
CVE-2022-2135 | High | 7.5 | 2022-07-22 | The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information. |
CVE-2022-1655 | Medium | 6.5 | 2022-07-22 | An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOn… |
CVE-2022-36131 | Medium | 6.1 | 2022-07-22 | The Better PDF Exporter add-on 10.0.0 for Atlassian Jira is prone to stored XSS via a crafted description to the PDF Templates overview page. |
CVE-2022-31168 | Medium | 5.4 | 2022-07-22 | Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API… |
CVE-2022-2327 | High | 7.5 | 2022-07-22 | io_uring use work_flags to determine which identity need to grab from the calling process to make sure it is consistent with the calling process when executing… |
CVE-2022-31172 | High | 7.5 | 2022-07-22 | OpenZeppelin Contracts is a library for smart contract development. Versions 4.1.0 until 4.7.1 are vulnerable to the SignatureChecker reverting. `SignatureChec… |
CVE-2022-31170 | High | 7.5 | 2022-07-22 | OpenZeppelin Contracts is a library for smart contract development. Versions 4.0.0 until 4.7.1 are vulnerable to ERC165Checker reverting instead of returning `… |
CVE-2022-31169 | Medium | 5.9 | 2022-07-22 | Wasmtime is a standalone runtime for WebAssembly. There is a bug in Wasmtime's code generator, Cranelift, for AArch64 targets where constant divisors can resul… |
CVE-2022-31164 | High | 7.5 | 2022-07-22 | Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged… |
CVE-2022-31163 | High | 7.5 | 2022-07-22 | TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as th… |
CVE-2022-31162 | High | 7.5 | 2022-07-22 | Slack Morphism is an async client library for Rust. Prior to 0.41.0, it was possible for Slack OAuth client information to leak in application debug logs. Stri… |
CVE-2022-2495 | Medium | 4.8 | 2022-07-22 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.21. |
CVE-2022-2494 | Medium | 5.4 | 2022-07-22 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0. |
CVE-2022-2493 | High | 8.1 | 2022-07-22 | Data Access from Outside Expected Data Manager Component in GitHub repository openemr/openemr prior to 7.0.0. |
CVE-2022-20916 | Medium | 6.1 | 2022-07-22 | A vulnerability in the web-based management interface of Cisco IoT Control Center could allow an unauthenticated, remote attacker to conduct a cross-site scrip… |
CVE-2022-20913 | Medium | 4.9 | 2022-07-22 | A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to write arbitrary files on an affected device. This vulnerability is du… |
CVE-2022-20912 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20911 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20910 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20909 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-20908 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-20907 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-20906 | Medium | 6.0 | 2022-07-22 | Multiple vulnerabilities in Cisco Nexus Dashboard could allow an authenticated, local attacker to elevate privileges on an affected device. These vulnerabiliti… |
CVE-2022-20904 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20903 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20902 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20901 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20900 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20899 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20898 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20897 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20896 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20895 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20894 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20893 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-20892 | Medium | 4.7 | 2022-07-22 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-0977 | Critical | 9.6 | 2022-07-21 | Use after free in Browser UI in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user inte… |
CVE-2022-0976 | High | 8.8 | 2022-07-21 | Heap buffer overflow in GPU in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0975 | High | 8.8 | 2022-07-21 | Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0974 | High | 8.8 | 2022-07-21 | Use after free in Splitscreen in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user int… |
CVE-2022-0973 | Critical | 9.6 | 2022-07-21 | Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0972 | High | 8.8 | 2022-07-21 | Use after free in Extensions in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially ex… |
CVE-2022-0971 | High | 8.8 | 2022-07-21 | Use after free in Blink Layout in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who had compromised the renderer process to potentia… |
CVE-2022-20891 | Medium | 4.7 | 2022-07-21 | Multiple vulnerabilities in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authenticated… |
CVE-2022-34487 | Critical | 9.8 | 2022-07-21 | Unauthenticated Arbitrary Option Update vulnerability in biplob018's Shortcode Addons plugin <= 3.0.2 at WordPress. |
CVE-2022-33198 | Critical | 9.8 | 2022-07-21 | Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress. |
CVE-2022-31475 | Medium | 5.5 | 2022-07-21 | Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. |
CVE-2022-30536 | Low | 3.4 | 2022-07-21 | Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress. |
CVE-2022-28700 | Critical | 9.1 | 2022-07-21 | Authenticated Arbitrary File Creation via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress. |
CVE-2022-35899 | High | 7.8 | 2022-07-21 | There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creatin… |
CVE-2022-30337 | Medium | 5.4 | 2022-07-21 | Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin <= 4.4.8 at WordPress allows an attacker to update the social settings. |
CVE-2022-28666 | Medium | 5.3 | 2022-07-21 | Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option… |
CVE-2022-36313 | Medium | 5.5 | 2022-07-21 | An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file type detector to g… |
CVE-2022-34767 | Medium | 5.9 | 2022-07-21 | Web page which "wizardpwd.asp" ALLNET Router model WR0500AC is prone to Authorization bypass vulnerability – the password, located at "admin" allows changing t… |
CVE-2022-32430 | High | 7.5 | 2022-07-21 | An access control issue in Lin CMS Spring Boot v0.2.1 allows attackers to access the backend information and functions within the application. |
CVE-2022-32289 | Medium | 5.4 | 2022-07-21 | Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change. |
CVE-2022-30628 | Medium | 4.8 | 2022-07-21 | It was possible to download all receipts without authentication. Must first access the API https://XXXX.supersmart.me/services/v4/customer/signin to get a TOKE… |
CVE-2022-28877 | Medium | 4.3 | 2022-07-21 | This vulnerability allows local user to delete arbitrary file in the system and bypassing security protection which can be abused for local privilege escalatio… |
CVE-2022-28861 | Medium | 5.9 | 2022-07-21 | The server in Citilog 8.0 allows an attacker (in a man in the middle position between the server and its smart camera Axis M1125) to see FTP credentials in a c… |