2022 CVEs (page 195)
Page 195 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29798 | High | 7.5 | 2022-06-13 | There is a denial of service vulnerability in CV81-WDM FW versions 01.70.49.29.46. Successful exploitation could cause denial of service. |
CVE-2022-29797 | Critical | 9.8 | 2022-06-13 | There is a buffer overflow vulnerability in CV81-WDM FW 01.70.49.29.46. Successful exploitation of this vulnerability may lead to privilege escalation. |
CVE-2022-22259 | Medium | 6.8 | 2022-06-13 | There is an improper authentication vulnerability in FLMG-10 10.0.1.0(H100SP22C00). Successful exploitation of this vulnerability may lead to a control of the… |
CVE-2022-33175 | Critical | 9.8 | 2022-06-13 | Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 have an insecure permissions setting on the user.token field that is acc… |
CVE-2022-33174 | Critical | 9.8 | 2022-06-13 | Power Distribution Units running on Powertek firmware (multiple brands) before 3.30.30 allows remote authorization bypass in the web interface. To exploit the… |
CVE-2022-29455 | Medium | 4.7 | 2022-06-13 | DOM-based Reflected Cross-Site Scripting (XSS) vulnerability in Elementor's Elementor Website Builder plugin <= 3.5.5 versions. |
CVE-2022-28217 | Medium | 6.5 | 2022-06-13 | Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which allows an adversary t… |
CVE-2022-23169 | Medium | 5.9 | 2022-06-13 | attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel. |
CVE-2022-23168 | Medium | 5.9 | 2022-06-13 | The attacker could get access to the database. The SQL injection is in the username parameter at the login panel: username: admin'-- |
CVE-2022-23167 | Medium | 5.3 | 2022-06-13 | Attacker crafts a GET request to: /mobile/downloadfile.aspx? Filename =../.. /windows/boot.ini the LFI is UNAUTHENTICATED. |
CVE-2022-31761 | High | 7.5 | 2022-06-13 | Configuration defects in the secure OS module. Successful exploitation of this vulnerability will affect confidentiality. |
CVE-2022-31760 | Critical | 9.1 | 2022-06-13 | Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. Successful exploitation of this vulnerability may affect… |
CVE-2022-31757 | High | 7.5 | 2022-06-13 | The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-31754 | High | 7.5 | 2022-06-13 | Logical defects in code implementation in some products. Successful exploitation of this vulnerability may affect the availability of some features. |
CVE-2022-31753 | High | 7.5 | 2022-06-13 | The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system avai… |
CVE-2022-31752 | Medium | 5.5 | 2022-06-13 | Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect confidentiality. |
CVE-2022-31055 | High | 7.5 | 2022-06-13 | kCTF is a Kubernetes-based infrastructure for capture the flag (CTF) competitions. Prior to version 1.6.0, the kctf cluster set-src-ip-ranges was broken and al… |
CVE-2022-31763 | Medium | 5.5 | 2022-06-13 | The kernel module has the null pointer and out-of-bounds array vulnerabilities. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-31762 | High | 7.8 | 2022-06-13 | The AMS module has a vulnerability in input validation. Successful exploitation of this vulnerability may cause privilege escalation. |
CVE-2022-31759 | Medium | 5.5 | 2022-06-13 | AppLink has a vulnerability of accessing uninitialized pointers. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-31758 | Medium | 4.7 | 2022-06-13 | The kernel module has the race condition vulnerability. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-31756 | Medium | 5.5 | 2022-06-13 | The fingerprint sensor module has design defects. Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-31755 | Medium | 5.5 | 2022-06-13 | The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-31751 | Medium | 5.5 | 2022-06-13 | The kernel emcom module has multi-thread contention. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-30311 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30310 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port syntax. This… |
CVE-2022-30309 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for port syntax… |
CVE-2022-30308 | Critical | 9.8 | 2022-06-13 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for port syntax… |
CVE-2022-29244 | High | 7.5 | 2022-06-13 | npm pack ignores root-level .gitignore and .npmignore file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--worksp… |
CVE-2022-24077 | High | 7.8 | 2022-06-13 | Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection. |
CVE-2022-1969 | High | 8.8 | 2022-06-13 | The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missin… |
CVE-2022-1961 | Medium | 5.5 | 2022-06-13 | The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller… |
CVE-2022-1820 | Medium | 6.1 | 2022-06-13 | The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to… |
CVE-2022-1768 | Critical | 9.8 | 2022-06-13 | The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passe… |
CVE-2022-1750 | Medium | 5.5 | 2022-06-13 | The Sticky Popup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘ popup_title' parameter in versions up to, and including, 1.2 due t… |
CVE-2022-1749 | High | 8.8 | 2022-06-13 | The WPMK Ajax Finder WordPress plugin is vulnerable to Cross-Site Request Forgery via the createplugin_atf_admin_setting_page() function found in the ~/inc/con… |
CVE-2022-1659 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the i… |
CVE-2022-1658 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via t… |
CVE-2022-1657 | High | 8.8 | 2022-06-13 | Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path Traversa… |
CVE-2022-1654 | High | 8.8 | 2022-06-13 | Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administ… |
CVE-2022-0209 | Medium | 4.8 | 2022-06-13 | The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high… |
CVE-2022-31400 | Medium | 4.8 | 2022-06-13 | A cross-site scripting (XSS) vulnerability in /staff/setup/email-addresses of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-31398 | Medium | 4.8 | 2022-06-13 | A cross-site scripting (XSS) vulnerability in /staff/tools/custom-fields of Helpdeskz v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2022-31041 | High | 7.6 | 2022-06-13 | Open Forms is an application for creating and publishing smart forms. Open Forms supports file uploads as one of the form field types. These fields can be conf… |
CVE-2022-2067 | Critical | 9.1 | 2022-06-13 | SQL Injection in GitHub repository francoisjacquet/rosariosis prior to 9.0. |
CVE-2022-2066 | Medium | 6.1 | 2022-06-13 | Cross-site Scripting (XSS) - Reflected in GitHub repository neorazorx/facturascripts prior to 2022.06. |
CVE-2022-2065 | Medium | 5.4 | 2022-06-13 | Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06. |
CVE-2022-1985 | Medium | 6.1 | 2022-06-13 | The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient… |
CVE-2022-1918 | High | 8.8 | 2022-06-13 | The ToolBar to Share plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0. This is due to missing nonce valid… |
CVE-2022-1900 | High | 8.8 | 2022-06-13 | The Copify plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.0. This is due to missing nonce validation on… |
CVE-2022-1822 | Medium | 6.1 | 2022-06-13 | The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3… |
CVE-2022-1814 | Medium | 4.8 | 2022-06-13 | The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2022-1800 | High | 7.2 | 2022-06-13 | The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a d… |
CVE-2022-1793 | Medium | 4.3 | 2022-06-13 | The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perf… |
CVE-2022-1792 | Medium | 5.4 | 2022-06-13 | The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2022-1791 | High | 8.1 | 2022-06-13 | The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make… |
CVE-2022-1790 | Medium | 6.5 | 2022-06-13 | The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a lo… |
CVE-2022-1788 | Medium | 6.5 | 2022-06-13 | Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file an… |
CVE-2022-1787 | Medium | 5.4 | 2022-06-13 | The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin c… |
CVE-2022-1781 | Medium | 5.4 | 2022-06-13 | The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admi… |
CVE-2022-1780 | Medium | 5.4 | 2022-06-13 | The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2022-1779 | High | 8.1 | 2022-06-13 | The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged… |
CVE-2022-1777 | High | 8.8 | 2022-06-13 | The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, s… |
CVE-2022-1773 | Medium | 6.1 | 2022-06-13 | The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-… |
CVE-2022-1772 | Medium | 4.8 | 2022-06-13 | The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration pa… |
CVE-2022-1765 | High | 8.8 | 2022-06-13 | The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server… |
CVE-2022-1764 | Medium | 5.4 | 2022-06-13 | The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2022-1763 | Medium | 5.4 | 2022-06-13 | Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including… |
CVE-2022-1762 | High | 7.5 | 2022-06-13 | The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to… |
CVE-2022-1761 | Medium | 6.5 | 2022-06-13 | The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, whi… |
CVE-2022-1759 | Medium | 5.4 | 2022-06-13 | The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logge… |
CVE-2022-1758 | High | 8.8 | 2022-06-13 | The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make… |
CVE-2022-1756 | Medium | 6.1 | 2022-06-13 | The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses… |
CVE-2022-1724 | Medium | 6.1 | 2022-06-13 | The Simple Membership WordPress plugin before 4.1.1 does not properly sanitise and escape parameters before outputting them back in AJAX actions, leading to Re… |
CVE-2022-1710 | Medium | 4.8 | 2022-06-13 | The Appointment Hour Booking WordPress plugin before 1.3.56 does not sanitise and escape a settings of its Calendar fields, which could allow high privilege us… |
CVE-2022-1707 | Medium | 6.1 | 2022-06-13 | The Google Tag Manager for WordPress plugin for WordPress is vulnerable to reflected Cross-Site Scripting via the s parameter due to the site search populating… |
CVE-2022-1694 | Medium | 6.5 | 2022-06-13 | The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logge… |
CVE-2022-1656 | Medium | 5.4 | 2022-06-13 | Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in li… |
CVE-2022-1624 | Medium | 6.5 | 2022-06-13 | The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2022-1612 | Medium | 6.5 | 2022-06-13 | The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged i… |
CVE-2022-1608 | Medium | 6.5 | 2022-06-13 | The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a l… |
CVE-2022-1605 | Medium | 6.5 | 2022-06-13 | The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in ad… |
CVE-2022-1604 | Medium | 6.1 | 2022-06-13 | The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2022-1595 | Medium | 5.3 | 2022-06-13 | The HC Custom WP-Admin URL WordPress plugin through 1.4 leaks the secret login URL when sending a specific crafted request |
CVE-2022-1594 | Medium | 4.3 | 2022-06-13 | The HC Custom WP-Admin URL WordPress plugin through 1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a log… |
CVE-2022-1549 | Medium | 5.4 | 2022-06-13 | The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting… |
CVE-2022-1532 | Medium | 6.1 | 2022-06-13 | Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a… |
CVE-2022-1412 | High | 7.5 | 2022-06-13 | The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visi… |
CVE-2022-1336 | Medium | 4.8 | 2022-06-13 | The Carousel CK WordPress plugin through 1.1.0 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to perf… |
CVE-2022-1335 | Medium | 4.8 | 2022-06-13 | The Slideshow CK WordPress plugin before 1.4.10 does not sanitize and escape Slide's descriptions, which could allow high-privileged users such as admin to per… |
CVE-2022-1208 | Medium | 6.4 | 2022-06-13 | The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to… |
CVE-2022-1202 | High | 7.8 | 2022-06-13 | The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability. |
CVE-2022-0885 | Critical | 9.8 | 2022-06-13 | The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenti… |
CVE-2022-0863 | High | 7.2 | 2022-06-13 | The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload… |
CVE-2022-0827 | Critical | 9.8 | 2022-06-13 | The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to a… |
CVE-2022-0786 | Critical | 9.8 | 2022-06-13 | The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL statements via the ajax_post AJAX action with… |
CVE-2022-0745 | Medium | 6.5 | 2022-06-13 | The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subje… |
CVE-2022-0626 | Medium | 6.1 | 2022-06-13 | The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a… |
CVE-2022-31040 | High | 7.1 | 2022-06-13 | Open Forms is an application for creating and publishing smart forms. Prior to versions 1.0.9 and 1.1.1, the cookie consent page in Open Forms contains an open… |
CVE-2022-2064 | High | 8.8 | 2022-06-13 | Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. |