2022 CVEs (page 189)
Page 189 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-32159 | | 2022-06-22 | In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Stored XSS. | |
CVE-2022-23081 | | 2022-06-22 | In openlibrary versions deploy-2016-07-0 through deploy-2021-12-22 are vulnerable to Reflected XSS. | |
CVE-2022-23080 | Medium | 5.0 | 2022-06-22 | In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low priv… |
CVE-2022-32549 | Medium | 5.3 | 2022-06-22 | Apache Sling Commons Log <= 5.4.0 and Apache Sling API <= 2.25.0 are vulnerable to log injection. The ability to forge logs may allow an attacker to cover trac… |
CVE-2022-20651 | Medium | 5.5 | 2022-06-22 | A vulnerability in the logging component of Cisco Adaptive Security Device Manager (ASDM) could allow an authenticated, local attacker to view sensitive inform… |
CVE-2022-23079 | | 2022-06-22 | In motor-admin versions 0.0.1 through 0.2.56 are vulnerable to host header injection in the password reset functionality where malicious actor can send fake pa… | |
CVE-2022-2174 | Medium | 6.1 | 2022-06-22 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18. |
CVE-2022-23078 | | 2022-06-22 | In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page. | |
CVE-2022-23077 | Medium | 6.1 | 2022-06-22 | In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page. |
CVE-2022-31248 | Medium | 5.3 | 2022-06-22 | A Observable Response Discrepancy vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to discover valid… |
CVE-2022-21952 | High | 7.5 | 2022-06-22 | A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to e… |
CVE-2022-23055 | | 2022-06-22 | In ERPNext, versions v11.0.0-beta through v13.0.2 are vulnerable to Missing Authorization, in the chat rooms functionality. A low privileged attacker can send… | |
CVE-2022-23058 | | 2022-06-22 | ERPNext in versions v12.0.9-v13.0.3 are affected by a stored XSS vulnerability that allows low privileged users to store malicious scripts in the ‘username’ fi… | |
CVE-2022-23057 | Medium | 5.4 | 2022-06-22 | In ERPNext, versions v12.0.9--v13.0.3 are vulnerable to Stored Cross-Site-Scripting (XSS), due to user input not being validated properly. A low privileged att… |
CVE-2022-23056 | | 2022-06-22 | In ERPNext, versions v13.0.0-beta.13 through v13.30.0 are vulnerable to Stored XSS at the Patient History page which allows a low privilege user to conduct an… | |
CVE-2022-31095 | Medium | 4.3 | 2022-06-21 | discourse-chat is a chat plugin for the Discourse application. Versions prior to 0.4 are vulnerable to an exposure of sensitive information, where an attacker… |
CVE-2022-34008 | High | 7.8 | 2022-06-21 | Comodo Antivirus 12.2.2.8012 has a quarantine flaw that allows privilege escalation. To escalate privilege, a low-privileged attacker can use an NTFS directory… |
CVE-2022-33995 | High | 7.5 | 2022-06-21 | A path traversal issue in entry attachments in Devolutions Remote Desktop Manager before 2022.2 allows attackers to create or overwrite files in an arbitrary l… |
CVE-2022-32974 | Medium | 6.5 | 2022-06-21 | An authenticated attacker could read arbitrary files from the underlying operating system of the scanner using a custom crafted compliance audit file without p… |
CVE-2022-32973 | High | 8.8 | 2022-06-21 | An authenticated attacker could create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges. |
CVE-2022-31786 | Medium | 6.1 | 2022-06-21 | IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO. |
CVE-2022-30874 | Medium | 5.4 | 2022-06-21 | There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02. |
CVE-2022-2068 | High | 7.3 | 2022-06-21 | In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise she… |
CVE-2022-27872 | High | 7.8 | 2022-06-21 | A maliciously crafted PDF file may be used to dereference a pointer for read or write operation while parsing PDF files in Autodesk Navisworks 2022. The vulner… |
CVE-2022-27871 | High | 7.8 | 2022-06-21 | Autodesk AutoCAD product suite, Revit, Design Review and Navisworks releases using PDFTron prior to 9.1.17 version may be used to write beyond the allocated bu… |
CVE-2022-27870 | High | 7.8 | 2022-06-21 | A maliciously crafted TGA file in Autodesk AutoCAD 2023 may be used to write beyond the allocated buffer while parsing TGA file. This vulnerability may be expl… |
CVE-2022-27869 | High | 7.8 | 2022-06-21 | A maliciously crafted TIFF file in Autodesk AutoCAD 2023 can be forced to read and write beyond allocated boundaries when parsing the TIFF file. This vulnerabi… |
CVE-2022-27868 | High | 7.8 | 2022-06-21 | A maliciously crafted CAT file in Autodesk AutoCAD 2023 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to cod… |
CVE-2022-27867 | High | 7.8 | 2022-06-21 | A maliciously crafted JT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerabilit… |
CVE-2022-26147 | Critical | 9.8 | 2022-06-21 | The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection. |
CVE-2022-23171 | Medium | 5.9 | 2022-06-21 | AtlasVPN - Privilege Escalation Lack of proper security controls on named pipe messages can allow an attacker with low privileges to send a malicious payload a… |
CVE-2022-22979 | High | 7.5 | 2022-06-21 | In Spring Cloud Function versions prior to 3.2.6, it is possible for a user who directly interacts with framework provided lookup functionality to cause a deni… |
CVE-2022-1833 | High | 8.8 | 2022-06-21 | A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace where the AMQ Oper… |
CVE-2022-1665 | High | 8.2 | 2022-06-21 | A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it sho… |
CVE-2022-1596 | Medium | 6.5 | 2022-06-21 | Incorrect Permission Assignment for Critical Resource vulnerability in ABB REX640 PCL1, REX640 PCL2, REX640 PCL3 allows an authenticated attacker to launch an… |
CVE-2022-33056 | High | 7.2 | 2022-06-21 | Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/schedules/manage_schedule.ph… |
CVE-2022-33055 | High | 7.2 | 2022-06-21 | Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/trains/manage_train.php. |
CVE-2022-33049 | High | 7.2 | 2022-06-21 | Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/?page=user/manage_user. |
CVE-2022-33048 | High | 7.2 | 2022-06-21 | Online Railway Reservation System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /orrs/admin/reservations/view_details.ph… |
CVE-2022-31478 | Medium | 4.3 | 2022-06-21 | The UserTakeOver plugin before 4.0.1 for ILIAS allows an attacker to list all users via the search function. |
CVE-2022-29775 | Critical | 9.8 | 2022-06-21 | iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL. |
CVE-2022-29774 | Critical | 9.8 | 2022-06-21 | iSpy v7.2.2.0 is vulnerable to remote command execution via path traversal. |
CVE-2022-25585 | Medium | 5.4 | 2022-06-21 | Unioncms v1.0.13 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Default settings. |
CVE-2022-23342 | Medium | 5.3 | 2022-06-21 | The Hyland Onbase Application Server releases prior to 20.3.58.1000 and OnBase releases 21.1.1.1000 through 21.1.15.1000 are vulnerable to a username enumerati… |
CVE-2022-33139 | Critical | 9.8 | 2022-06-21 | A vulnerability has been identified in Cerberus DMS (All versions), Desigo CC (All versions), Desigo CC Compact (All versions), SIMATIC WinCC OA V3.16 (All ver… |
CVE-2022-33119 | Medium | 6.1 | 2022-06-21 | NUUO Network Video Recorder NVRsolo v03.06.02 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via login.php. |
CVE-2022-32414 | Medium | 5.5 | 2022-06-21 | Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_vmcode_interpreter at src/njs_vmcode.c. |
CVE-2022-31374 | Critical | 9.8 | 2022-06-21 | An arbitrary file upload vulnerability /images/background/1.php in of SolarView Compact 6.0 allows attackers to execute arbitrary code via a crafted php file. |
CVE-2022-31373 | Medium | 6.1 | 2022-06-21 | SolarView Compact v6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Solar_AiConf.php. |
CVE-2022-31307 | Medium | 5.5 | 2022-06-21 | Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_string_offset at src/njs_string.c. |
CVE-2022-31306 | Medium | 5.5 | 2022-06-21 | Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_array_convert_to_slow_array at src/njs_array.c. |
CVE-2022-31303 | Medium | 5.4 | 2022-06-21 | maccms10 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field. |
CVE-2022-31302 | Medium | 5.4 | 2022-06-21 | maccms8 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Server Group text field. |
CVE-2022-23074 | | 2022-06-21 | In Recipes, versions 0.17.0 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in the ‘Name’ field of Keyword, Food and Unit components. When a… | |
CVE-2022-23073 | | 2022-06-21 | In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in copy to clipboard functionality. When a victim accesses the fo… | |
CVE-2022-31801 | Critical | 9.8 | 2022-06-21 | An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. |
CVE-2022-31800 | Critical | 9.8 | 2022-06-21 | An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device. |
CVE-2022-23072 | | 2022-06-21 | In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food l… | |
CVE-2022-31062 | Medium | 5.3 | 2022-06-20 | ### Impact A plugin public script can be used to read content of system files. ### Patches Upgrade to version 1.0.2. ### Workarounds `b/deploy/index.php` file… |
CVE-2022-2128 | Critical | 9.8 | 2022-06-20 | Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4. |
CVE-2022-22414 | Medium | 5.5 | 2022-06-20 | IBM Robotic Process Automation 21.0.2 could allow a local user to obtain sensitive web service configuration credentials from system memory. IBM X-Force ID: 22… |
CVE-2022-22318 | Critical | 9.8 | 2022-06-20 | IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another use… |
CVE-2022-22317 | Critical | 9.8 | 2022-06-20 | IBM Curam Social Program Management 8.0.0 and 8.0.1 does not invalidate session after logout which could allow an authenticated user to impersonate another use… |
CVE-2022-33913 | High | 7.5 | 2022-06-20 | In Mahara 21.04 before 21.04.6, 21.10 before 21.10.4, and 22.04.2, files can sometimes be downloaded through thumb.php with no permission check. |
CVE-2022-32983 | Medium | 5.3 | 2022-06-20 | Knot Resolver through 5.5.1 may allow DNS cache poisoning when there is an attempt to limit forwarding actions by filters. |
CVE-2022-31795 | Critical | 9.8 | 2022-06-20 | An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo functi… |
CVE-2022-31794 | Critical | 9.8 | 2022-06-20 | An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile f… |
CVE-2022-2134 | Medium | 6.5 | 2022-06-20 | Allocation of Resources Without Limits or Throttling in GitHub repository inventree/inventree prior to 0.8.0. |
CVE-2022-1720 | High | 7.8 | 2022-06-20 | Buffer Over-read in function grab_file_name in GitHub repository vim/vim prior to 8.2.4956. This vulnerability is capable of crashing the software, memory modi… |
CVE-2022-25772 | Critical | 9.6 | 2022-06-20 | A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript |
CVE-2022-1945 | Medium | 4.8 | 2022-06-20 | The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as… |
CVE-2022-1939 | High | 7.2 | 2022-06-20 | The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP f… |
CVE-2022-1915 | Medium | 4.8 | 2022-06-20 | The WP Zillow Review Slider WordPress plugin before 2.4 does not escape a settings, which could allow high privilege users to perform Cross-Site Scripting atta… |
CVE-2022-1905 | Critical | 9.8 | 2022-06-20 | The Events Made Easy WordPress plugin before 2.2.81 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action ava… |
CVE-2022-1896 | Medium | 4.8 | 2022-06-20 | The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, al… |
CVE-2022-1895 | Medium | 4.3 | 2022-06-20 | The underConstruction WordPress plugin before 1.20 does not have CSRF check in place when deactivating the construction mode, which could allow attackers to ma… |
CVE-2022-1889 | Medium | 4.8 | 2022-06-20 | The Newsletter WordPress plugin before 7.4.6 does not escape and sanitise the preheader_text setting, which could allow high privilege users to perform Stored… |
CVE-2022-1832 | Medium | 6.5 | 2022-06-20 | The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in… |
CVE-2022-1831 | Medium | 6.5 | 2022-06-20 | The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin c… |
CVE-2022-1830 | Medium | 6.5 | 2022-06-20 | The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a… |
CVE-2022-1829 | Medium | 6.5 | 2022-06-20 | The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2022-1828 | Medium | 6.5 | 2022-06-20 | The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2022-1827 | Medium | 6.5 | 2022-06-20 | The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2022-1826 | Medium | 6.5 | 2022-06-20 | The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in… |
CVE-2022-1824 | High | 7.9 | 2022-06-20 | An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloadi… |
CVE-2022-1823 | High | 7.9 | 2022-06-20 | Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuratio… |
CVE-2022-1818 | Medium | 5.4 | 2022-06-20 | The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2022-1801 | High | 7.5 | 2022-06-20 | The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as… |
CVE-2022-1717 | Medium | 4.8 | 2022-06-20 | The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2022-1630 | Medium | 6.5 | 2022-06-20 | The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin dele… |
CVE-2022-1614 | High | 7.5 | 2022-06-20 | The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to byp… |
CVE-2022-1610 | Medium | 6.5 | 2022-06-20 | The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2022-1603 | Medium | 4.3 | 2022-06-20 | The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a l… |
CVE-2022-1472 | High | 7.2 | 2022-06-20 | The Better Find and Replace WordPress plugin before 1.3.6 does not properly sanitise, validate and escape various parameters before using them in an SQL statem… |
CVE-2022-1266 | Medium | 4.8 | 2022-06-20 | The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.5.0 does not sanitise and escape the Header Title, which could allow high privilege users t… |
CVE-2022-0663 | Medium | 4.8 | 2022-06-20 | The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privi… |
CVE-2022-31734 | Medium | 6.1 | 2022-06-20 | Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An… |
CVE-2022-2130 | Medium | 6.1 | 2022-06-20 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.17. |
CVE-2022-26669 | High | 8.8 | 2022-06-20 | ASUS Control Center is vulnerable to SQL injection. An authenticated remote attacker with general user privilege can inject SQL command to specific API paramet… |
CVE-2022-26668 | High | 7.3 | 2022-06-20 | ASUS Control Center API has a broken access control vulnerability. An unauthenticated remote attacker can call privileged API functions to perform partial syst… |