2022 CVEs (page 186)
Page 186 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28172 | Medium | 6.5 | 2022-06-27 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attac… |
CVE-2022-28171 | High | 7.5 | 2022-06-27 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attac… |
CVE-2022-28168 | High | 7.5 | 2022-06-27 | In Brocade SANnav before Brocade SANnav v2.2.0.2 and Brocade SANnav2.1.1.8, encoded scp-server passwords are stored using Base64 encoding, which could allow an… |
CVE-2022-28167 | Medium | 6.5 | 2022-06-27 | Brocade SANnav before Brocade SANvav v. 2.2.0.2 and Brocade SANanv v.2.1.1.8 logs the Brocade Fabric OS switch password in plain text in asyncjobscheduler-mana… |
CVE-2022-28166 | High | 7.5 | 2022-06-27 | In Brocade SANnav version before SANN2.2.0.2 and Brocade SANNav before 2.1.1.8, the implementation of TLS/SSL Server Supports the Use of Static Key Ciphers (ss… |
CVE-2022-26477 | High | 7.5 | 2022-06-27 | The Security Team noticed that the termination condition of the for loop in the readExternal method is a controllable variable, which, if tampered with, may le… |
CVE-2022-2140 | High | 8.8 | 2022-06-27 | Elcomplus SmartICS v2.3.4.0 does not neutralize user-controllable input, which allows an authenticated user to inject arbitrary code into specific parameters. |
CVE-2022-2106 | Low | 3.8 | 2022-06-27 | Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attac… |
CVE-2022-2088 | Medium | 6.8 | 2022-06-27 | An authenticated user with admin privileges may be able to terminate any process on the system running Elcomplus SmartICS v2.3.4.0. |
CVE-2022-2210 | High | 7.8 | 2022-06-27 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2218 | Medium | 6.1 | 2022-06-27 | Cross-site Scripting (XSS) - Stored in GitHub repository ionicabizau/parse-url prior to 7.0.0. |
CVE-2022-2208 | Medium | 5.5 | 2022-06-27 | NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163. |
CVE-2022-2216 | Critical | 9.8 | 2022-06-27 | Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 7.0.0. |
CVE-2022-2207 | High | 7.8 | 2022-06-27 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-2217 | Medium | 6.1 | 2022-06-27 | Cross-site Scripting (XSS) - Generic in GitHub repository ionicabizau/parse-url prior to 7.0.0. |
CVE-2022-0722 | High | 7.5 | 2022-06-27 | Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0. |
CVE-2022-2041 | Medium | 5.4 | 2022-06-27 | The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform… |
CVE-2022-2040 | Medium | 5.4 | 2022-06-27 | The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a role as low as Contributor to perform Sto… |
CVE-2022-1995 | Medium | 4.8 | 2022-06-27 | The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges t… |
CVE-2022-1994 | Medium | 4.8 | 2022-06-27 | The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users… |
CVE-2022-1990 | Medium | 4.8 | 2022-06-27 | The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege users to perform Stored… |
CVE-2022-1977 | High | 7.2 | 2022-06-27 | The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before maki… |
CVE-2022-1971 | Medium | 4.8 | 2022-06-27 | The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high privilege users such as… |
CVE-2022-1964 | Medium | 5.4 | 2022-06-27 | The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malic… |
CVE-2022-1960 | Medium | 4.3 | 2022-06-27 | The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin chan… |
CVE-2022-1953 | Critical | 9.1 | 2022-06-27 | The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to… |
CVE-2022-1916 | Medium | 6.1 | 2022-06-27 | The Active Products Tables for WooCommerce. Professional products tables for WooCommerce store WordPress plugin before 1.0.5 does not sanitise and escape a par… |
CVE-2022-1914 | Medium | 4.3 | 2022-06-27 | The Clean-Contact WordPress plugin through 1.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2022-1913 | Medium | 4.3 | 2022-06-27 | The Add Post URL WordPress plugin through 2.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2022-1904 | Medium | 6.1 | 2022-06-27 | The Pricing Tables WordPress Plugin WordPress plugin before 3.2.1 does not sanitise and escape parameter before outputting it back in a page available to any u… |
CVE-2022-1903 | High | 8.1 | 2022-06-27 | The ARMember WordPress plugin before 3.4.8 is vulnerable to account takeover (even the administrator) due to missing nonce and authorization checks in an AJAX… |
CVE-2022-1885 | Medium | 4.3 | 2022-06-27 | The Cimy Header Image Rotator WordPress plugin through 6.1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make… |
CVE-2022-1847 | Medium | 4.3 | 2022-06-27 | The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2022-1846 | Medium | 4.3 | 2022-06-27 | The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2022-1845 | Medium | 4.3 | 2022-06-27 | The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete pl… |
CVE-2022-1844 | Medium | 4.3 | 2022-06-27 | The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2022-1843 | Medium | 6.5 | 2022-06-27 | The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the sett… |
CVE-2022-1842 | Medium | 4.3 | 2022-06-27 | The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logge… |
CVE-2022-1776 | Medium | 5.4 | 2022-06-27 | The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign parameters, which could all… |
CVE-2022-1653 | Medium | 4.3 | 2022-06-27 | The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker t… |
CVE-2022-1627 | Medium | 4.3 | 2022-06-27 | The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2022-1625 | Medium | 4.3 | 2022-06-27 | The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow at… |
CVE-2022-1593 | Medium | 6.1 | 2022-06-27 | The Site Offline or Coming Soon WordPress plugin through 1.6.6 does not have CSRF check in place when updating its settings, and it also lacking sanitisation a… |
CVE-2022-1574 | Critical | 9.8 | 2022-06-27 | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthent… |
CVE-2022-1573 | Medium | 4.3 | 2022-06-27 | The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin… |
CVE-2022-1572 | High | 8.1 | 2022-06-27 | The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscrib… |
CVE-2022-1470 | Medium | 6.1 | 2022-06-27 | The Ultimate WooCommerce CSV Importer WordPress plugin through 2.0 does not sanitise and escape the imported data before outputting it back in the page, leadin… |
CVE-2022-1327 | Medium | 4.8 | 2022-06-27 | The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to… |
CVE-2022-1326 | Medium | 4.8 | 2022-06-27 | The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin t… |
CVE-2022-1321 | Medium | 4.8 | 2022-06-27 | The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administ… |
CVE-2022-1113 | Medium | 4.8 | 2022-06-27 | The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2022-1095 | Medium | 4.8 | 2022-06-27 | The Mihdan: No External Links WordPress plugin before 5.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as a… |
CVE-2022-1029 | Medium | 4.8 | 2022-06-27 | The Limit Login Attempts WordPress plugin before 4.0.72 does not sanitise and escape some of its settings, leading to malicious users with administrator privil… |
CVE-2022-1028 | Medium | 4.8 | 2022-06-27 | The WordPress Security Firewall, Malware Scanner, Secure Login and Backup plugin before 4.2.1 does not sanitise and escape some of its settings, leading to mal… |
CVE-2022-1010 | Medium | 4.8 | 2022-06-27 | The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high pri… |
CVE-2022-0875 | Medium | 4.3 | 2022-06-27 | The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowin… |
CVE-2022-0444 | Medium | 4.3 | 2022-06-27 | The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resettin… |
CVE-2022-2214 | Medium | 6.3 | 2022-06-27 | A vulnerability was found in SourceCodester Library Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality… |
CVE-2022-2213 | Low | 3.5 | 2022-06-27 | A vulnerability was found in SourceCodester Library Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown fu… |
CVE-2022-2212 | Medium | 6.3 | 2022-06-27 | A vulnerability was found in SourceCodester Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the component… |
CVE-2022-33202 | High | 8.1 | 2022-06-27 | Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlier allows an adjac… |
CVE-2022-33146 | Medium | 6.1 | 2022-06-27 | Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and conduct a phishing atta… |
CVE-2022-2206 | High | 7.8 | 2022-06-26 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-34495 | Medium | 5.5 | 2022-06-26 | rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free. |
CVE-2022-34494 | Medium | 5.5 | 2022-06-26 | rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free. |
CVE-2022-29931 | Medium | 6.1 | 2022-06-25 | The administration interface of the Raytion Custom Security Manager (Raytion CSM) in Version 7.2.0 allows reflected Cross-site Scripting (XSS). |
CVE-2022-31017 | Low | 2.0 | 2022-06-25 | Zulip is an open-source team collaboration tool. Versions 2.1.0 through and including 5.2 are vulnerable to a logic error. A stream configured as private with… |
CVE-2022-31016 | Medium | 6.5 | 2022-06-25 | Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allo… |
CVE-2022-29168 | Critical | 9.6 | 2022-06-25 | Wire is a secure messaging application. Wire is vulnerable to arbitrary HTML and Javascript execution via insufficient escaping when rendering `@mentions` in t… |
CVE-2022-24893 | High | 7.5 | 2022-06-25 | ESP-IDF is the official development framework for Espressif SoCs. In Espressif’s Bluetooth Mesh SDK (`ESP-BLE-MESH`), a memory corruption vulnerability can be… |
CVE-2022-33128 | Critical | 9.1 | 2022-06-25 | RG-EG series gateway EG350 EG_RGOS 11.1(6) was discovered to contain a SQL injection vulnerability via the function get_alarmAction at /alarm_pi/alarmService.p… |
CVE-2022-34066 | Critical | 9.8 | 2022-06-24 | The Texercise package in PyPI v0.0.1 to v0.0.12 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive us… |
CVE-2022-34065 | Critical | 9.8 | 2022-06-24 | The Rondolu-YT-Concate package in PyPI v0.1.0 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user… |
CVE-2022-34064 | Critical | 9.8 | 2022-06-24 | The Zibal package in PyPI v1.0.0 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user information… |
CVE-2022-34061 | Critical | 9.8 | 2022-06-24 | The Catly-Translate package in PyPI v0.0.3 to v0.0.5 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensiti… |
CVE-2022-34060 | Critical | 9.8 | 2022-06-24 | The Togglee package in PyPI version v0.0.8 was discovered to contain a code execution backdoor. This vulnerability allows attackers to access sensitive user in… |
CVE-2022-34059 | Critical | 9.8 | 2022-06-24 | The Sixfab-Tool in PyPI v0.0.2 to v0.0.3 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to ac… |
CVE-2022-34057 | Critical | 9.8 | 2022-06-24 | The Scoptrial package in PyPI version v0.0.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers t… |
CVE-2022-34056 | Critical | 9.8 | 2022-06-24 | The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to acces… |
CVE-2022-34055 | Critical | 9.8 | 2022-06-24 | The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access… |
CVE-2022-34054 | Critical | 9.8 | 2022-06-24 | The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers t… |
CVE-2022-34053 | Critical | 9.8 | 2022-06-24 | The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to… |
CVE-2022-33122 | Medium | 4.8 | 2022-06-24 | A stored cross-site scripting (XSS) vulnerability in eyoucms v1.5.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected in… |
CVE-2022-33121 | High | 8.1 | 2022-06-24 | A Cross-Site Request Forgery (CSRF) in MiniCMS v1.11 allows attackers to arbitrarily delete local .dat files via clicking on a malicious link. |
CVE-2022-33004 | Critical | 9.8 | 2022-06-24 | The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers… |
CVE-2022-33003 | Critical | 9.8 | 2022-06-24 | The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers t… |
CVE-2022-33002 | Critical | 9.8 | 2022-06-24 | The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers… |
CVE-2022-33001 | Critical | 9.8 | 2022-06-24 | The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access s… |
CVE-2022-33000 | Critical | 9.8 | 2022-06-24 | The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attacker… |
CVE-2022-32999 | Critical | 9.8 | 2022-06-24 | The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to ac… |
CVE-2022-32998 | Critical | 9.8 | 2022-06-24 | The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerabilit… |
CVE-2022-32997 | Critical | 9.8 | 2022-06-24 | The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package. This vulnerability allows… |
CVE-2022-32996 | Critical | 9.8 | 2022-06-24 | The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package. This vulnerability allows at… |
CVE-2022-30885 | Critical | 9.8 | 2022-06-24 | The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1… |
CVE-2022-21231 | High | 7.5 | 2022-06-24 | All versions of package deep-get-set are vulnerable to Prototype Pollution via the 'deep' function. **Note:** This vulnerability derives from an incomplete fix… |
CVE-2022-33910 | Medium | 5.4 | 2022-06-24 | An XSS vulnerability in MantisBT before 2.25.5 allows remote attackers to attach crafted SVG documents to issue reports or bugnotes. When a user or an admin cl… |
CVE-2022-30028 | Medium | 5.9 | 2022-06-24 | Dradis Professional Edition before 4.3.0 allows attackers to change an account password via reusing a password reset token. |
CVE-2022-29578 | Medium | 5.3 | 2022-06-24 | Meridian Cooperative Utility Software versions 22.02 and 22.03 allows remote attackers to obtain sensitive information such as name, address, and daily energy… |
CVE-2022-29097 | Medium | 4.9 | 2022-06-24 | Dell WMS 3.6.1 and below contains a Path Traversal vulnerability in Device API. A remote attacker could potentially exploit this vulnerability, to gain unautho… |
CVE-2022-29096 | Medium | 6.1 | 2022-06-24 | Dell Wyse Management Suite 3.6.1 and below contains a Reflected Cross-Site Scripting Vulnerability in saveGroupConfigurations page. An authenticated attacker c… |