2022 CVEs (page 195)
Page 195 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-31758 | Medium | 4.7 | 2022-06-13 | The kernel module has the race condition vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-31756 | Medium | 5.5 | 2022-06-13 | The fingerprint sensor module has design defects. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-31755 | Medium | 5.5 | 2022-06-13 | The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-31751 | Medium | 5.5 | 2022-06-13 | The kernel emcom module has multi-thread contention. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-30311 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30310 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30309 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax… |
CVE-2022-30308 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax… |
CVE-2022-29244 | High | 7.5 | 2022-06-13 | npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--worksp… |
CVE-2022-24077 | High | 7.8 | 2022-06-13 | Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection. |
CVE-2022-1969 | High | 8.8 | 2022-06-13 | The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missin… |
CVE-2022-1961 | Medium | 5.5 | 2022-06-13 | The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller… |
CVE-2022-1820 | Medium | 6.1 | 2022-06-13 | The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to… |
CVE-2022-1768 | Critical | 9.8 | 2022-06-13 | The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passe… |
CVE-2022-1750 | Medium | 5.5 | 2022-06-13 | The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and including, 1.2 due t… |
CVE-2022-1749 | High | 8.8 | 2022-06-13 | The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/con… |
CVE-2022-1659 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the i… |
CVE-2022-1658 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via t… |
CVE-2022-1657 | High | 8.8 | 2022-06-13 | Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path Traversa… |
CVE-2022-1654 | High | 8.8 | 2022-06-13 | Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administ… |
CVE-2022-0209 | Medium | 4.8 | 2022-06-13 | The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high… |
CVE-2022-31400 | Medium | 4.8 | 2022-06-13 | A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-31398 | Medium | 4.8 | 2022-06-13 | A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2022-31041 | High | 7.6 | 2022-06-13 | Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be conf… |
CVE-2022-2067 | Critical | 9.1 | 2022-06-13 | SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0. |
CVE-2022-2066 | Medium | 6.1 | 2022-06-13 | Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06. |
CVE-2022-2065 | Medium | 5.4 | 2022-06-13 | Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06. |
CVE-2022-1985 | Medium | 6.1 | 2022-06-13 | The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient… |
CVE-2022-1918 | High | 8.8 | 2022-06-13 | The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce valid… |
CVE-2022-1900 | High | 8.8 | 2022-06-13 | The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on… |
CVE-2022-1822 | Medium | 6.1 | 2022-06-13 | The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3… |
CVE-2022-1814 | Medium | 4.8 | 2022-06-13 | The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2022-1800 | High | 7.2 | 2022-06-13 | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a d… |
CVE-2022-1793 | Medium | 4.3 | 2022-06-13 | The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perf… |
CVE-2022-1792 | Medium | 5.4 | 2022-06-13 | The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2022-1791 | High | 8.1 | 2022-06-13 | The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make… |
CVE-2022-1790 | Medium | 6.5 | 2022-06-13 | The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2022-1788 | Medium | 6.5 | 2022-06-13 | Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file an… |
CVE-2022-1787 | Medium | 5.4 | 2022-06-13 | The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin c… |
CVE-2022-1781 | Medium | 5.4 | 2022-06-13 | The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admi… |
CVE-2022-1780 | Medium | 5.4 | 2022-06-13 | The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2022-1779 | High | 8.1 | 2022-06-13 | The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2022-1777 | High | 8.8 | 2022-06-13 | The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, s… |
CVE-2022-1773 | Medium | 6.1 | 2022-06-13 | The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-… |
CVE-2022-1772 | Medium | 4.8 | 2022-06-13 | The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration pa… |
CVE-2022-1765 | High | 8.8 | 2022-06-13 | The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server… |
CVE-2022-1764 | Medium | 5.4 | 2022-06-13 | The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2022-1763 | Medium | 5.4 | 2022-06-13 | Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including… |
CVE-2022-1762 | High | 7.5 | 2022-06-13 | The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to… |
CVE-2022-1761 | Medium | 6.5 | 2022-06-13 | The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, whi… |
CVE-2022-1759 | Medium | 5.4 | 2022-06-13 | The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logge… |
CVE-2022-1758 | High | 8.8 | 2022-06-13 | The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make… |
CVE-2022-1756 | Medium | 6.1 | 2022-06-13 | The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses… |
CVE-2022-1724 | Medium | 6.1 | 2022-06-13 | The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Re… |
CVE-2022-1710 | Medium | 4.8 | 2022-06-13 | The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege us… |
CVE-2022-1707 | Medium | 6.1 | 2022-06-13 | The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating… |
CVE-2022-1694 | Medium | 6.5 | 2022-06-13 | The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logge… |
CVE-2022-1656 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in li… |
CVE-2022-1624 | Medium | 6.5 | 2022-06-13 | The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2022-1612 | Medium | 6.5 | 2022-06-13 | The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2022-1608 | Medium | 6.5 | 2022-06-13 | The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a l… |
CVE-2022-1605 | Medium | 6.5 | 2022-06-13 | The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2022-1604 | Medium | 6.1 | 2022-06-13 | The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2022-1595 | Medium | 5.3 | 2022-06-13 | The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request |
CVE-2022-1594 | Medium | 4.3 | 2022-06-13 | The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2022-1549 | Medium | 5.4 | 2022-06-13 | The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting… |
CVE-2022-1532 | Medium | 6.1 | 2022-06-13 | Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a… |
CVE-2022-1412 | High | 7.5 | 2022-06-13 | The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visi… |
CVE-2022-1336 | Medium | 4.8 | 2022-06-13 | The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perf… |
CVE-2022-1335 | Medium | 4.8 | 2022-06-13 | The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to per… |
CVE-2022-1208 | Medium | 6.4 | 2022-06-13 | The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to… |
CVE-2022-1202 | High | 7.8 | 2022-06-13 | The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability. |
CVE-2022-0885 | Critical | 9.8 | 2022-06-13 | The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenti… |
CVE-2022-0863 | High | 7.2 | 2022-06-13 | The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload… |
CVE-2022-0827 | Critical | 9.8 | 2022-06-13 | The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to a… |
CVE-2022-0786 | Critical | 9.8 | 2022-06-13 | The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with… |
CVE-2022-0745 | Medium | 6.5 | 2022-06-13 | The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subje… |
CVE-2022-0626 | Medium | 6.1 | 2022-06-13 | The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a… |
CVE-2022-31040 | High | 7.1 | 2022-06-13 | Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open Forms contains an open… |
CVE-2022-2064 | High | 8.8 | 2022-06-13 | Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-2063 | High | 8.8 | 2022-06-13 | Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-2062 | High | 7.5 | 2022-06-13 | Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. |
CVE-2022-2061 | Low | 3.3 | 2022-06-13 | Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0. |
CVE-2022-2060 | Medium | 5.4 | 2022-06-13 | Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0. |
CVE-2022-32741 | Medium | 5.3 | 2022-06-13 | Attacker is able to determine if the provided username exists (and it's valid) using Request New Password feature, based on the response time. |
CVE-2022-32740 | Low | 3.5 | 2022-06-13 | A reply to a forwarded email article by a 3rd party could unintensionally expose the email content to the ticket customer under certain circumstances. |
CVE-2022-32739 | Low | 3.5 | 2022-06-13 | When Secure::DisableBanner system configuration has been disabled and agent shares his calendar via public URL, received ICS file contains OTRS release number. |
CVE-2022-29894 | Medium | 4.8 | 2022-06-13 | Strapi v3.x.x versions and earlier contain a stored cross-site scripting vulnerability in file upload function. By exploiting this vulnerability, an arbitrary… |
CVE-2022-29525 | Critical | 9.8 | 2022-06-13 | Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 uses a hard-coded credential which may allow a remote unauthenticated attacker to log in with the root privileg… |
CVE-2022-28704 | High | 7.2 | 2022-06-13 | Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to log in with the root privilege and perform… |
CVE-2022-27231 | Medium | 6.1 | 2022-06-13 | Cross-site scripting vulnerability exists in WP Statistics versions prior to 13.2.0 because it improperly processes a platform parameter. By exploiting this vu… |
CVE-2022-27174 | Medium | 4.3 | 2022-06-13 | Cross-site request forgery (CSRF) vulnerability in Easy Blog for EC-CUBE4 Ver.1.0.1 and earlier allows a remote unauthenticated attacker to hijack the authenti… |
CVE-2022-26834 | High | 7.5 | 2022-06-13 | Improper access control vulnerability in Rakuten Casa version AP_F_V1_4_1 or AP_F_V2_0_0 allows a remote attacker to obtain the information stored in the produ… |
CVE-2022-26041 | Medium | 6.5 | 2022-06-13 | Directory traversal vulnerability in RCCMD 4.26 and earlier allows a remote authenticated attacker with an administrative privilege to read or alter an arbitra… |
CVE-2022-2013 | High | 7.5 | 2022-06-13 | In Octopus Server after version 2022.1.1495 and before 2022.1.2647 if private spaces were enabled via the experimental feature flag all new users would have ac… |
CVE-2022-2054 | High | 8.4 | 2022-06-12 | Code Injection in GitHub repository nuitka/nuitka prior to 0.9. |
CVE-2022-30780 | High | 7.5 | 2022-06-11 | Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_mo… |
CVE-2022-32981 | High | 7.8 | 2022-06-10 | An issue was discovered in the Linux kernel through 5.18.3 on powerpc 32-bit platforms. There is a buffer overflow in ptrace PEEKUSER and POKEUSER (aka PEEKUSR… |
CVE-2022-29095 | High | 8.3 | 2022-06-10 | Dell SupportAssist Client Consumer versions (3.10.4 and prior) and Dell SupportAssist Client Commercial versions (3.1.1 and prior) contain a cross-site scripti… |
CVE-2022-29094 | High | 7.1 | 2022-06-10 | Dell SupportAssist Client Consumer versions (3.10.4 and versions prior) and Dell SupportAssist Client Commercial versions (3.1.1 and versions prior) contain an… |