2022 CVEs (page 197)
Page 197 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1998 | High | 7.8 | 2022-06-09 | A use after free in the Linux kernel File System notify functionality was found in the way user triggers copy_info_records_to_user() call to fail in copy_event… |
CVE-2022-31830 | Critical | 9.1 | 2022-06-09 | Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php. |
CVE-2022-31827 | Critical | 9.1 | 2022-06-09 | MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php. |
CVE-2022-31393 | Critical | 9.1 | 2022-06-09 | Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Index function in app/admin/c/PluginsController.php. |
CVE-2022-31390 | Critical | 9.1 | 2022-06-09 | Jizhicms v2.2.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via the Update function in app/admin/c/TemplateController.php. |
CVE-2022-31386 | Critical | 9.1 | 2022-06-09 | A Server-Side Request Forgery (SSRF) in the getFileBinary function of nbnbk cms 3 allows attackers to force the application to make arbitrary requests via inje… |
CVE-2022-31030 | Medium | 5.5 | 2022-06-09 | containerd is an open source container runtime. A bug was found in the containerd's CRI implementation where programs inside a container can cause the containe… |
CVE-2022-31027 | Medium | 4.2 | 2022-06-09 | OAuthenticator is an OAuth token library for the JupyerHub login handler. CILogonOAuthenticator is provided by the OAuthenticator package, and lets users log i… |
CVE-2022-31026 | Medium | 5.9 | 2022-06-09 | Trilogy is a client library for MySQL. When authenticating, a malicious server could return a specially crafted authentication packet, causing the client to re… |
CVE-2022-31019 | High | 7.5 | 2022-06-09 | Vapor is a server-side Swift HTTP web framework. When using automatic content decoding an attacker can craft a request body that can make the server crash with… |
CVE-2022-29255 | High | 8.2 | 2022-06-09 | Vyper is a Pythonic Smart Contract Language for the ethereum virtual machine. In versions prior to 0.3.4 when a calling an external contract with no return val… |
CVE-2022-29254 | Low | 3.7 | 2022-06-09 | silverstripe-omnipay is a SilverStripe integration with Omnipay PHP payments library. For a subset of Omnipay gateways (those that use intermediary states like… |
CVE-2022-24896 | Medium | 4.3 | 2022-06-09 | Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify author… |
CVE-2022-32195 | Medium | 6.1 | 2022-06-09 | Open edX platform before 2022-06-06 allows XSS via the "next" parameter in the logout URL. |
CVE-2022-31649 | High | 7.5 | 2022-06-09 | ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer. |
CVE-2022-30075 | High | 8.8 | 2022-06-09 | In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validat… |
CVE-2022-25807 | Medium | 5.5 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the LDAPDesPWEncrypter class allows an attacker, who has… |
CVE-2022-25806 | High | 8.8 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. A hardcoded DES key in the PrefDBCredentials class allows an attacker, who has d… |
CVE-2022-25805 | Medium | 6.5 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. The transmission of cleartext LDAP bind credentials by the cmd_mgt_load_mgt_tree… |
CVE-2022-25804 | Medium | 5.5 | 2022-06-09 | An issue was discovered in the IGEL Universal Management Suite (UMS) 6.07.100. Insecure permissions for the serverconfig registry key (under JavaSoft\Prefs\de\… |
CVE-2022-24840 | Critical | 9.1 | 2022-06-09 | django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and… |
CVE-2022-31496 | High | 8.8 | 2022-06-09 | LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access. |
CVE-2022-29014 | High | 7.5 | 2022-06-09 | A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files. |
CVE-2022-29013 | Critical | 9.8 | 2022-06-09 | A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST… |
CVE-2022-31313 | Critical | 9.8 | 2022-06-08 | api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package. |
CVE-2022-30882 | Critical | 9.8 | 2022-06-08 | pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is: execute arbitrary code (remote). When installing the pyanxdns pac… |
CVE-2022-30877 | Critical | 9.8 | 2022-06-08 | The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2. |
CVE-2022-30875 | Medium | 6.1 | 2022-06-08 | Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. |
CVE-2022-28386 | Medium | 4.6 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. The security feature for lockout (e.g., requiring a reformat of the drive after 20 faile… |
CVE-2022-32273 | Medium | 4.3 | 2022-06-08 | As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate fi… |
CVE-2022-31325 | High | 7.2 | 2022-06-08 | There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php. |
CVE-2022-30899 | Medium | 4.8 | 2022-06-08 | A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories. |
CVE-2022-28387 | Medium | 4.6 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked by an attacker who can then gain unautho… |
CVE-2022-28385 | Medium | 4.6 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can manipulate the content of the emulated… |
CVE-2022-28384 | Medium | 5.5 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they allow an offline brute-force attack for determining the… |
CVE-2022-28383 | Medium | 6.8 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to insufficient firmware validation, an attacker can store malicious firmware code f… |
CVE-2022-28382 | High | 7.5 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to the use of an insecure encryption AES mode (Electronic Codebook, aka ECB), an att… |
CVE-2022-24296 | High | 7.5 | 2022-06-08 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3… |
CVE-2022-30926 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditMacList parameter at /goform/aspForm. |
CVE-2022-30925 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddMacList parameter at /goform/aspForm. |
CVE-2022-30924 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetAPWifiorLedInfoById parameter at /goform/aspForm. |
CVE-2022-30923 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTimingtimeWifiAndLed parameter at /goform/aspForm. |
CVE-2022-30922 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditWlanMacList parameter at /goform/aspForm. |
CVE-2022-30921 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetMobileAPInfoById parameter at /goform/aspForm. |
CVE-2022-30920 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID parameter at /goform/aspForm. |
CVE-2022-30919 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID_5G parameter at /goform/aspForm. |
CVE-2022-30918 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnet parameter at /goform/aspForm. |
CVE-2022-30917 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddWlanMacList parameter at /goform/aspForm. |
CVE-2022-30916 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnetDebug parameter at /goform/aspForm. |
CVE-2022-30915 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateSnat parameter at /goform/aspForm. |
CVE-2022-30914 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateMacClone parameter at /goform/aspForm. |
CVE-2022-30913 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the ipqos_set_bandwidth parameter at /goform/aspForm. |
CVE-2022-30912 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateWanParams parameter at /goform/aspForm. |
CVE-2022-30910 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the GO parameter at /goform/aspForm. |
CVE-2022-30909 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the CMD parameter at /goform/aspForm. |
CVE-2022-1997 | Medium | 5.4 | 2022-06-08 | Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0. |
CVE-2022-30790 | High | 7.8 | 2022-06-08 | Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. |
CVE-2022-30552 | Medium | 5.5 | 2022-06-08 | Das U-Boot 2022.01 has a Buffer Overflow. |
CVE-2022-1996 | Critical | 9.1 | 2022-06-08 | Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0. |
CVE-2022-31497 | Medium | 6.1 | 2022-06-08 | LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS. |
CVE-2022-1712 | Medium | 4.3 | 2022-06-08 | The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2022-1709 | Medium | 4.3 | 2022-06-08 | The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers… |
CVE-2022-1695 | Medium | 4.3 | 2022-06-08 | The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged i… |
CVE-2022-1692 | Critical | 9.8 | 2022-06-08 | The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statemen… |
CVE-2022-1691 | Medium | 4.9 | 2022-06-08 | The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent ed… |
CVE-2022-1690 | Low | 2.7 | 2022-06-08 | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page… |
CVE-2022-1689 | Low | 2.7 | 2022-06-08 | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via th… |
CVE-2022-1688 | Low | 2.7 | 2022-06-08 | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard… |
CVE-2022-1687 | Low | 2.7 | 2022-06-08 | The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slide… |
CVE-2022-1686 | Low | 2.7 | 2022-06-08 | The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product… |
CVE-2022-1685 | Medium | 4.9 | 2022-06-08 | The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the… |
CVE-2022-1684 | Low | 2.7 | 2022-06-08 | The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injecti… |
CVE-2022-1683 | High | 8.8 | 2022-06-08 | The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL i… |
CVE-2022-1673 | Medium | 6.1 | 2022-06-08 | The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading… |
CVE-2022-1647 | Medium | 4.8 | 2022-06-08 | The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perform Cross-Site Script… |
CVE-2022-1598 | Medium | 5.3 | 2022-06-08 | The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticate… |
CVE-2022-1597 | Medium | 6.1 | 2022-06-08 | The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form… |
CVE-2022-1577 | Medium | 5.4 | 2022-06-08 | The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attack… |
CVE-2022-1570 | Medium | 6.5 | 2022-06-08 | The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authentica… |
CVE-2022-1569 | Medium | 4.8 | 2022-06-08 | The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not s… |
CVE-2022-1541 | Medium | 4.8 | 2022-06-08 | The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross… |
CVE-2022-1506 | Medium | 5.4 | 2022-06-08 | The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to p… |
CVE-2022-1469 | Medium | 4.8 | 2022-06-08 | The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2022-1424 | Medium | 6.5 | 2022-06-08 | The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform vari… |
CVE-2022-1422 | Medium | 6.5 | 2022-06-08 | The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetti… |
CVE-2022-1421 | Medium | 4.3 | 2022-06-08 | The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings includ… |
CVE-2022-1394 | Medium | 4.8 | 2022-06-08 | The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users suc… |
CVE-2022-1241 | Medium | 6.1 | 2022-06-08 | The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site S… |
CVE-2022-1005 | Medium | 6.1 | 2022-06-08 | The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-S… |
CVE-2022-0788 | Critical | 9.8 | 2022-06-08 | The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement… |
CVE-2022-0779 | Medium | 6.5 | 2022-06-08 | The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged… |
CVE-2022-21122 | Critical | 9.0 | 2022-06-08 | The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is ex… |
CVE-2022-1703 | High | 8.8 | 2022-06-08 | Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Com… |
CVE-2022-24065 | High | 8.1 | 2022-06-08 | The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code wi… |
CVE-2022-31470 | Medium | 6.1 | 2022-06-07 | An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows att… |
CVE-2022-30466 | Medium | 6.5 | 2022-06-07 | joyebike Joy ebike Wolf Manufacturing year 2022 is vulnerable to Authentication Bypass by Capture-replay. |
CVE-2022-29620 | Medium | 6.5 | 2022-06-07 | FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a… |
CVE-2022-2022 | Medium | 5.4 | 2022-06-07 | Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7. |
CVE-2022-30749 | Low | 3.3 | 2022-06-07 | Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity. |
CVE-2022-30748 | Medium | 4.0 | 2022-06-07 | Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity. |