2022 CVEs (page 175)
Page 175 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2437 | Critical | 9.8 | 2022-07-18 | The Feed Them Social – for Twitter feed, Youtube and more plugin for WordPress is vulnerable to deserialization of untrusted input via the 'fts_url' parameter… |
CVE-2022-2435 | High | 8.8 | 2022-07-18 | The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to missing nonce protecti… |
CVE-2022-2224 | Medium | 5.4 | 2022-07-18 | The WordPress plugin Gallery for Social Photo is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.0.27 due to failure to properly… |
CVE-2022-2223 | Medium | 5.4 | 2022-07-18 | The WordPress plugin Image Slider is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1.121 due to failure to properly check for the… |
CVE-2022-2117 | Medium | 5.3 | 2022-07-18 | The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoin… |
CVE-2022-2108 | Medium | 6.5 | 2022-07-18 | The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capabil… |
CVE-2022-2101 | Medium | 6.4 | 2022-07-18 | The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2… |
CVE-2022-2039 | High | 8.8 | 2022-07-18 | The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing non… |
CVE-2022-2001 | High | 8.8 | 2022-07-18 | The DX Share Selection plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.4. This is due to missing nonce prot… |
CVE-2022-23745 | High | 7.5 | 2022-07-18 | A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not… |
CVE-2022-22304 | Medium | 6.1 | 2022-07-18 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiAuthenticator OWA Agent for Microsoft version 2.2 and 2.1 may all… |
CVE-2022-1912 | High | 8.8 | 2022-07-18 | The Button Widget Smartsoft plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing no… |
CVE-2022-1565 | High | 7.2 | 2022-07-18 | The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, a… |
CVE-2022-35741 | Critical | 9.8 | 2022-07-18 | Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) in… |
CVE-2022-34902 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34901 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34900 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (39313) Agent. An attacker must first obta… |
CVE-2022-34899 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34892 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. An attacker must firs… |
CVE-2022-34891 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. An attacker must firs… |
CVE-2022-34890 | High | 8.8 | 2022-07-18 | This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 17.1.1 (51537). An attacker must fir… |
CVE-2022-34889 | High | 8.2 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 17.1.1 (51537). An attacker must first obtain t… |
CVE-2022-2400 | Medium | 5.3 | 2022-07-18 | External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0. |
CVE-2022-23142 | Medium | 5.3 | 2022-07-18 | ZXEN CG200 has a DoS vulnerability. An attacker could construct and send a large number of HTTP GET requests in a short time, which can make the product manage… |
CVE-2022-35404 | High | 8.2 | 2022-07-18 | ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine. |
CVE-2022-32450 | High | 7.1 | 2022-07-18 | AnyDesk 7.0.9 allows a local user to gain SYSTEM privileges via a symbolic link because the user can write to their own %APPDATA% folder (used for ad.trace and… |
CVE-2022-30627 | Medium | 5.7 | 2022-07-18 | This vulnerability affects all of the company's products that also include the FW versions: update_i90_cv2.021_b20210104, update_i50_v1.0.55_b20200509, update_… |
CVE-2022-30626 | Medium | 6.3 | 2022-07-18 | Browsing the path: http://ip/wifi_ap_pata_get.cmd, will show in the name of the existing access point on the component, and a password in clear text. |
CVE-2022-30625 | Medium | 5.7 | 2022-07-18 | Directory listing is a web server function that displays the directory contents when there is no index file in a specific website directory. A directory listin… |
CVE-2022-30624 | Medium | 6.8 | 2022-07-18 | Browsing the admin.html page allows the user to reset the admin password. Also appears in the JS code for the password. |
CVE-2022-30623 | Medium | 5.9 | 2022-07-18 | The server checks the user's cookie in a non-standard way, and a value is entered in the cookie value name of the status and its value is set to true to bypass… |
CVE-2022-30621 | High | 7.6 | 2022-07-18 | Allows a remote user to read files on the camera's OS "GetFileContent.cgi". Reading arbitrary files on the camera's OS as root user. |
CVE-2022-30620 | High | 8.2 | 2022-07-18 | On Cellinx Camera with guest enabled, attacker with web access can elevate privileges to administrative: "1" to "0" privileges by changing the following cookie… |
CVE-2022-24692 | Medium | 5.4 | 2022-07-18 | An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The new menu option within the general Parameters page is vulnerable to stored XSS. The attack… |
CVE-2022-24691 | High | 7.1 | 2022-07-18 | An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A SQL Injection vulnerability allows authenticated users to taint database data and extract se… |
CVE-2022-24690 | High | 8.2 | 2022-07-18 | An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. A PresAbs.php SQL Injection vulnerability allows unauthenticated users to taint database data… |
CVE-2022-24689 | Medium | 5.3 | 2022-07-18 | An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. It mishandles access control. This allows a remote attacker to access account information page… |
CVE-2022-24688 | High | 8.8 | 2022-07-18 | An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via… |
CVE-2022-36127 | High | 7.5 | 2022-07-18 | A vulnerability in Apache SkyWalking NodeJS Agent prior to 0.5.1. The vulnerability will cause NodeJS services that has this agent installed to be unavailable… |
CVE-2022-33891 | High | 8.8 | 2022-07-18 | The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a… |
CVE-2022-27434 | Critical | 9.8 | 2022-07-18 | UNIT4 TETA Mobile Edition (ME) before 29.5.HF17 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting pag… |
CVE-2022-33903 | High | 7.5 | 2022-07-17 | Tor 0.4.7.x before 0.4.7.8 allows a denial of service via the wedging of RTT estimation. |
CVE-2022-32985 | Critical | 9.8 | 2022-07-17 | libnx_apl.so on Nexans FTTO GigaSwitch before 6.02N and 7.x before 7.02 implements a Backdoor Account for SSH logins on port 50200 or 50201. |
CVE-2022-31213 | High | 7.5 | 2022-07-17 | An issue was discovered in dbus-broker before 31. Multiple NULL pointer dereferences can be found when supplying a malformed XML config file. |
CVE-2022-31212 | High | 7.5 | 2022-07-17 | An issue was discovered in dbus-broker before 31. It depends on c-uitl/c-shquote to parse the DBus service's Exec line. c-shquote contains a stack-based buffer… |
CVE-2022-31211 | Critical | 9.8 | 2022-07-17 | An issue was discovered in Infiray IRAY-A8Z3 1.0.957. There is a blank root password for TELNET by default. |
CVE-2022-31210 | Critical | 9.8 | 2022-07-17 | An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The binary file /usr/local/sbin/webproject/set_param.cgi contains hardcoded credentials to the web applic… |
CVE-2022-31209 | Critical | 9.8 | 2022-07-17 | An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The firmware contains a potential buffer overflow by calling strcpy() without checking the string length… |
CVE-2022-31208 | High | 8.8 | 2022-07-17 | An issue was discovered in Infiray IRAY-A8Z3 1.0.957. The webserver contains an endpoint that can execute arbitrary commands by manipulating the cmd_string URL… |
CVE-2022-31202 | Medium | 6.5 | 2022-07-17 | The export function in SoftGuard Web (SGW) before 5.1.5 allows directory traversal to read an arbitrary local file via export or man.tcl. |
CVE-2022-31201 | Medium | 5.4 | 2022-07-17 | SoftGuard Web (SGW) before 5.1.5 allows HTML injection. |
CVE-2022-30982 | Medium | 5.4 | 2022-07-17 | An issue was discovered in Gentics CMS before 5.43.1. There is stored XSS in the profile description and in the username. |
CVE-2022-30981 | High | 8.8 | 2022-07-17 | An issue was discovered in Gentics CMS before 5.43.1. By uploading a malicious ZIP file, an attacker is able to deserialize arbitrary data and hence can potent… |
CVE-2022-28809 | High | 7.8 | 2022-07-17 | An issue was discovered in Open Design Alliance Drawings SDK before 2023.3. An Out-of-Bounds Read vulnerability exists when reading a DWG file with an invalid… |
CVE-2022-28808 | High | 7.8 | 2022-07-17 | An issue was discovered in Open Design Alliance Drawings SDK before 2023.3. An Out-of-Bounds Read vulnerability exists when reading DWG files in a recovery mod… |
CVE-2022-28807 | High | 7.8 | 2022-07-17 | An issue was discovered in Open Design Alliance Drawings SDK before 2023.2. An Out-of-Bounds Read vulnerability exists when rendering a .dwg file after it's op… |
CVE-2022-26482 | High | 7.2 | 2022-07-17 | An issue was discovered in Poly EagleEye Director II before 2.2.2.1. os.system command injection can be achieved by an admin. |
CVE-2022-26481 | High | 8.8 | 2022-07-17 | An issue was discovered in Poly Studio before 3.7.0. Command Injection can occur via the CN field of a Create Certificate Signing Request (CSR) action. |
CVE-2022-26479 | Critical | 9.8 | 2022-07-17 | An issue was discovered in Poly EagleEye Director II before 2.2.2.1. Existence of a certain file (which can be created via an rsync backdoor) causes all API ca… |
CVE-2022-32263 | High | 7.5 | 2022-07-17 | Pexip Infinity before 28.1 allows remote attackers to trigger a software abort via G.719. |
CVE-2022-29286 | High | 7.5 | 2022-07-17 | Pexip Infinity 27 before 28.0 allows remote attackers to trigger excessive resource consumption and termination because of registrar resource mishandling. |
CVE-2022-26352 | Critical | 9.8 | 2022-07-17 | An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose filename is n… |
CVE-2022-30622 | Medium | 5.3 | 2022-07-17 | Disclosure of information - the system allows you to view usernames and passwords without permissions, thus it will be possible to enter the system. Path acces… |
CVE-2022-27937 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger excessive resource consumption via H.264. |
CVE-2022-27936 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via H.323. |
CVE-2022-27935 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth. |
CVE-2022-27934 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via HTTP. |
CVE-2022-27933 | High | 8.2 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. |
CVE-2022-27932 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. |
CVE-2022-27931 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol. |
CVE-2022-27930 | Medium | 5.9 | 2022-07-17 | Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via single-sign-on if a random Universally Unique Identifier is guessed. |
CVE-2022-27929 | High | 7.5 | 2022-07-17 | Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via HTTP. |
CVE-2022-27928 | High | 7.5 | 2022-07-17 | Pexip Infinity 27.x before 27.3 allows remote attackers to trigger a software abort via the Session Initiation Protocol. |
CVE-2022-26657 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. |
CVE-2022-26656 | High | 8.2 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via One Touch Join. |
CVE-2022-26655 | High | 7.5 | 2022-07-17 | Pexip Infinity 27.x before 27.3 has Improper Input Validation. The client API allows remote attackers to trigger a software abort via a gateway call into Teams. |
CVE-2022-26654 | High | 7.5 | 2022-07-17 | Pexip Infinity before 27.3 allows remote attackers to force a software abort via HTTP. |
CVE-2022-25357 | Medium | 5.3 | 2022-07-17 | Pexip Infinity 27.x before 27.2 has Improper Access Control. An attacker can sometimes join a conference (call join) if it has a lock but not a PIN. |
CVE-2022-31260 | Medium | 6.5 | 2022-07-17 | In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value. |
CVE-2022-30550 | High | 8.8 | 2022-07-17 | An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args s… |
CVE-2022-35861 | High | 7.8 | 2022-07-17 | pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python ve… |
CVE-2022-32320 | High | 8.8 | 2022-07-17 | A Cross-Site Request Forgery (CSRF) in Ferdi through 5.8.1 and Ferdium through 6.0.0-nightly.98 allows attackers to read files via an uploaded file such as a s… |
CVE-2022-2222 | Medium | 4.9 | 2022-07-17 | The Download Monitor WordPress plugin before 4.5.91 does not ensure that files to be downloaded are inside the blog folders, and not sensitive, allowing high p… |
CVE-2022-2194 | Medium | 4.8 | 2022-07-17 | The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to per… |
CVE-2022-2187 | Medium | 6.1 | 2022-07-17 | The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which… |
CVE-2022-2186 | Medium | 4.8 | 2022-07-17 | The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Sit… |
CVE-2022-2173 | Medium | 6.1 | 2022-07-17 | The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin das… |
CVE-2022-2169 | Medium | 4.8 | 2022-07-17 | The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-… |
CVE-2022-2168 | Medium | 6.1 | 2022-07-17 | The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading… |
CVE-2022-2151 | Medium | 4.8 | 2022-07-17 | The Best Contact Management Software WordPress plugin through 3.7.3 does not sanitise and escape its settings, allowing high privilege users such as admin to p… |
CVE-2022-2149 | Medium | 4.8 | 2022-07-17 | The Very Simple Breadcrumb WordPress plugin through 1.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross… |
CVE-2022-2148 | Medium | 4.8 | 2022-07-17 | The LinkedIn Company Updates WordPress plugin through 1.5.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform c… |
CVE-2022-2146 | Medium | 6.1 | 2022-07-17 | The Import CSV Files WordPress plugin through 1.0 does not sanitise and escaped imported data before outputting them back in a page, and is lacking CSRF check… |
CVE-2022-2144 | Medium | 4.3 | 2022-07-17 | The Jquery Validation For Contact Form 7 WordPress plugin before 5.3 does not have CSRF check in place when updating its settings, which could allow attackers… |
CVE-2022-2133 | Medium | 5.3 | 2022-07-17 | The OAuth Single Sign On WordPress plugin before 6.22.6 doesn't validate that OAuth access token requests are legitimate, which allows attackers to log onto th… |
CVE-2022-2118 | Medium | 4.8 | 2022-07-17 | The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting att… |
CVE-2022-2114 | Medium | 4.8 | 2022-07-17 | The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could allow high privileg… |
CVE-2022-2100 | Medium | 4.8 | 2022-07-17 | The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site S… |
CVE-2022-2099 | Medium | 4.8 | 2022-07-17 | The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles |
CVE-2022-2090 | Medium | 6.1 | 2022-07-17 | The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of the plugin's discount… |