2022 CVEs (page 180)
Page 180 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22682 | Medium | 6.5 | 2022-07-12 | Improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability in Event Management in Synology Calendar before 2.4.5-10930… |
CVE-2022-31080 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31079 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31078 | Medium | 4.4 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31075 | Medium | 4.9 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31140 | High | 7.5 | 2022-07-11 | Valinor is a PHP library that helps to map any input into a strongly-typed value object structure. Prior to version 0.12.0, Valinor can use `Throwable#getMessa… |
CVE-2022-31074 | Medium | 4.5 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31073 | Medium | 6.5 | 2022-07-11 | KubeEdge is an open source system for extending native containerized application orchestration capabilities to hosts at Edge. Prior to versions 1.11.1, 1.10.2… |
CVE-2022-31139 | Medium | 5.9 | 2022-07-11 | UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is p… |
CVE-2022-31138 | High | 8.8 | 2022-07-11 | mailcow is a mailserver suite. Prior to mailcow-dockerized version 2022-06a, an extended privilege vulnerability can be exploited by manipulating the custom pa… |
CVE-2022-2123 | Medium | 4.3 | 2022-07-11 | The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF which allows changed plugin settings and can be used for sending spam emails. |
CVE-2022-2093 | Medium | 4.8 | 2022-07-11 | The WP Duplicate Page WordPress plugin before 1.3 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2022-2092 | Medium | 6.1 | 2022-07-11 | The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 2.16.0 doesn't escape a parameter on its setting page, making it possible for attackers to… |
CVE-2022-2091 | Medium | 6.5 | 2022-07-11 | The Cache Images WordPress plugin before 3.2.1 does not implement nonce checks, which could allow attackers to make any logged user upload images via a CSRF at… |
CVE-2022-2089 | Medium | 4.8 | 2022-07-11 | The Bold Page Builder WordPress plugin before 4.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2022-2050 | Medium | 4.8 | 2022-07-11 | The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored Cross-Site Scriptin… |
CVE-2022-1957 | Medium | 4.3 | 2022-07-11 | The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2022-1956 | Medium | 4.3 | 2022-07-11 | The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authent… |
CVE-2022-1952 | Critical | 9.8 | 2022-07-11 | The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrar… |
CVE-2022-1951 | Medium | 6.1 | 2022-07-11 | The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX… |
CVE-2022-1938 | Medium | 5.4 | 2022-07-11 | The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, allowing unauthenticat… |
CVE-2022-1937 | Medium | 6.1 | 2022-07-11 | The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthe… |
CVE-2022-1910 | Medium | 6.1 | 2022-07-11 | The Shortcodes and extra features for Phlox WordPress plugin before 2.9.8 does not sanitise and escape a parameter before outputting it back in the response, l… |
CVE-2022-1894 | Medium | 4.8 | 2022-07-11 | The Popup Builder WordPress plugin before 4.1.11 does not escape and sanitize some settings, which could allow high privilege users to perform Stored Cross-Sit… |
CVE-2022-1757 | Medium | 5.4 | 2022-07-11 | The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin ch… |
CVE-2022-1732 | Medium | 6.5 | 2022-07-11 | The Rename wp-login.php WordPress plugin through 2.6.0 does not have CSRF check in place when updating the secret login URL, which could allow attackers to mak… |
CVE-2022-1626 | Medium | 5.4 | 2022-07-11 | The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2022-1599 | Medium | 6.5 | 2022-07-11 | The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users wit… |
CVE-2022-1576 | Medium | 6.5 | 2022-07-11 | The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to mak… |
CVE-2022-1546 | Medium | 6.1 | 2022-07-11 | The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading… |
CVE-2022-1474 | Medium | 6.1 | 2022-07-11 | The WP Event Manager WordPress plugin before 3.1.28 does not sanitise and escape its search before outputting it back in an attribute on the event dashboard, l… |
CVE-2022-1220 | Medium | 6.1 | 2022-07-11 | The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Si… |
CVE-2022-1057 | Critical | 9.8 | 2022-07-11 | The Pricing Deals for WooCommerce WordPress plugin through 2.0.2.02 does not properly sanitise and escape a parameter before using it in a SQL statement via an… |
CVE-2022-30792 | High | 7.5 | 2022-07-11 | In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel… |
CVE-2022-30791 | High | 7.5 | 2022-07-11 | In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing… |
CVE-2022-2302 | Critical | 9.8 | 2022-07-11 | Multiple Lenze products of the cabinet series skip the password verification upon second login. After a user has been logged on to the device once, a remote at… |
CVE-2022-1794 | Medium | 5.5 | 2022-07-11 | The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windo… |
CVE-2022-2368 | Medium | 6.5 | 2022-07-11 | Authentication Bypass by Spoofing in GitHub repository microweber/microweber prior to 1.2.20. |
CVE-2022-35416 | Medium | 6.1 | 2022-07-11 | H3C SSL VPN through 2022-07-10 allows wnm/login/login.json svpnlang cookie XSS. |
CVE-2022-32294 | Critical | 9.8 | 2022-07-11 | Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartex… |
CVE-2022-35414 | High | 8.8 | 2022-07-11 | softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third… |
CVE-2022-31588 | Critical | 9.3 | 2022-07-11 | The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31587 | Critical | 9.3 | 2022-07-11 | The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31586 | Critical | 9.3 | 2022-07-11 | The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask send_file function is used uns… |
CVE-2022-31585 | Critical | 9.3 | 2022-07-11 | The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31584 | Critical | 9.3 | 2022-07-11 | The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31583 | Critical | 9.3 | 2022-07-11 | The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask send_file function is used uns… |
CVE-2022-31582 | Critical | 9.3 | 2022-07-11 | The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31581 | Critical | 9.3 | 2022-07-11 | The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31580 | Critical | 9.3 | 2022-07-11 | The sanojtharindu/caretakerr-api repository through 2021-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31579 | Critical | 9.3 | 2022-07-11 | The ralphjzhang/iasset repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31578 | High | 7.5 | 2022-07-11 | The piaoyunsoft/bt_lnmp repository through 2019-10-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31577 | Critical | 9.3 | 2022-07-11 | The longmaoteamtf/audio_aligner_app repository through 2020-01-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafel… |
CVE-2022-31576 | Critical | 9.3 | 2022-07-11 | The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31575 | Critical | 9.3 | 2022-07-11 | The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31574 | Critical | 9.3 | 2022-07-11 | The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31573 | Critical | 9.3 | 2022-07-11 | The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31572 | Critical | 9.3 | 2022-07-11 | The ceee-vip/cockybook repository through 2015-04-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31571 | Critical | 9.3 | 2022-07-11 | The akashtalole/python-flask-restful-api repository through 2019-09-16 on GitHub allows absolute path traversal because the Flask send_file function is used un… |
CVE-2022-31570 | Critical | 9.8 | 2022-07-11 | The adriankoczuruek/ceneo-web-scrapper repository through 2021-03-15 on GitHub allows absolute path traversal because the Flask send_file function is used unsa… |
CVE-2022-31568 | Critical | 9.3 | 2022-07-11 | The Rexians/rex-web repository through 2022-06-05 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31567 | Critical | 9.3 | 2022-07-11 | The DSABenchmark/DSAB repository through 2.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31566 | High | 8.6 | 2022-07-11 | The DSAB-local/DSAB repository through 2019-02-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31565 | Critical | 9.3 | 2022-07-11 | The yogson/syrabond repository through 2020-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31564 | Critical | 9.3 | 2022-07-11 | The woduq1414/munhak-moa repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31563 | Critical | 9.3 | 2022-07-11 | The whmacmac/vprj repository through 2022-04-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31562 | Critical | 9.3 | 2022-07-11 | The waveyan/internshipsystem repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31561 | Critical | 9.3 | 2022-07-11 | The varijkapil13/Sphere_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafe… |
CVE-2022-31560 | Critical | 9.3 | 2022-07-11 | The uncleYiba/photo_tag repository through 2020-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31559 | Critical | 9.3 | 2022-07-11 | The tsileo/flask-yeoman repository through 2013-09-13 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31558 | Critical | 9.3 | 2022-07-11 | The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31557 | Critical | 9.3 | 2022-07-11 | The seveas/golem repository through 2016-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31556 | Critical | 9.3 | 2022-07-11 | The rusyasoft/TrainEnergyServer repository through 2017-08-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31555 | Critical | 9.3 | 2022-07-11 | The romain20100/nursequest repository through 2018-02-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31554 | Critical | 9.3 | 2022-07-11 | The rohitnayak/movie-review-sentiment-analysis repository through 2017-05-07 on GitHub allows absolute path traversal because the Flask send_file function is u… |
CVE-2022-31553 | Critical | 9.3 | 2022-07-11 | The rainsoupah/sleep-learner repository through 2021-02-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31552 | Critical | 9.3 | 2022-07-11 | The project-anuvaad/anuvaad-corpus repository through 2020-11-23 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31551 | Critical | 9.3 | 2022-07-11 | The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31550 | Critical | 9.3 | 2022-07-11 | The olmax99/pyathenastack repository through 2019-11-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31549 | Critical | 9.3 | 2022-07-11 | The olmax99/helm-flask-celery repository before 2022-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31548 | Critical | 9.3 | 2022-07-11 | The nrlakin/homepage repository through 2017-03-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31547 | Critical | 9.3 | 2022-07-11 | The noamezekiel/sphere repository through 2020-05-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31546 | Critical | 9.3 | 2022-07-11 | The nlpweb/glance repository through 2014-06-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31545 | Critical | 9.3 | 2022-07-11 | The ml-inory/ModelConverter repository through 2021-04-26 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31544 | Critical | 9.3 | 2022-07-11 | The meerstein/rbtm repository through 1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31543 | Critical | 9.3 | 2022-07-11 | The maxtortime/SetupBox repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31542 | Critical | 9.3 | 2022-07-11 | The mandoku/mdweb repository through 2015-05-07 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31541 | Critical | 9.3 | 2022-07-11 | The lyubolp/Barry-Voice-Assistant repository through 2021-01-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31540 | Critical | 9.3 | 2022-07-11 | The kumardeepak/hin-eng-preprocessing repository through 2019-07-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsaf… |
CVE-2022-31539 | Critical | 9.3 | 2022-07-11 | The kotekan/kotekan repository through 2021.11 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31538 | Critical | 9.3 | 2022-07-11 | The joaopedro-fg/mp-m08-interface repository through 2020-12-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31537 | Critical | 9.3 | 2022-07-11 | The jmcginty15/Solar-system-simulator repository through 2021-07-26 on GitHub allows absolute path traversal because the Flask send_file function is used unsaf… |
CVE-2022-31536 | Critical | 9.3 | 2022-07-11 | The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31535 | Critical | 9.3 | 2022-07-11 | The freefood89/Fishtank repository through 2015-06-24 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31534 | Critical | 9.3 | 2022-07-11 | The echoleegroup/PythonWeb repository through 2018-10-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31533 | Critical | 9.3 | 2022-07-11 | The decentraminds/umbral repository through 2020-01-15 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31532 | Critical | 9.3 | 2022-07-11 | The dankolbman/travel_blahg repository through 2016-01-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31531 | Critical | 9.3 | 2022-07-11 | The dainst/cilantro repository through 0.0.4 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31530 | Critical | 9.3 | 2022-07-11 | The csm-aut/csm repository through 3.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |
CVE-2022-31529 | Critical | 9.3 | 2022-07-11 | The cinemaproject/monorepo repository through 2021-03-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely. |