2022 CVEs (page 197)
Page 197 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24840 | Critical | 9.1 | 2022-06-09 | django-s3file is a lightweight file upload input for Django and Amazon S3 . In versions prior to 5.5.1 it was possible to traverse the entire AWS S3 bucket and… |
CVE-2022-31496 | High | 8.8 | 2022-06-09 | LibreHealth EHR Base 2.0.0 allows incorrect interface/super/manage_site_files.php access. |
CVE-2022-29014 | High | 7.5 | 2022-06-09 | A local file inclusion vulnerability in Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to read arbitrary files. |
CVE-2022-29013 | Critical | 9.8 | 2022-06-09 | A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST… |
CVE-2022-31313 | Critical | 9.8 | 2022-06-08 | api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package. |
CVE-2022-30882 | Critical | 9.8 | 2022-06-08 | pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is: execute arbitrary code (remote). When installing the pyanxdns pac… |
CVE-2022-30877 | Critical | 9.8 | 2022-06-08 | The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2. |
CVE-2022-30875 | Medium | 6.1 | 2022-06-08 | Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page. |
CVE-2022-28386 | Medium | 4.6 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. The security feature for lockout (e.g., requiring a reformat of the drive after 20 faile… |
CVE-2022-32273 | Medium | 4.3 | 2022-06-08 | As a result of an observable discrepancy in returned messages, OPSWAT MetaDefender Core (MDCore) before 5.1.2 could allow an authenticated user to enumerate fi… |
CVE-2022-31325 | High | 7.2 | 2022-06-08 | There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php. |
CVE-2022-30899 | Medium | 4.8 | 2022-06-08 | A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories. |
CVE-2022-28387 | Medium | 4.6 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they can be unlocked by an attacker who can then gain unautho… |
CVE-2022-28385 | Medium | 4.6 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to missing integrity checks, an attacker can manipulate the content of the emulated… |
CVE-2022-28384 | Medium | 5.5 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to an insecure design, they allow an offline brute-force attack for determining the… |
CVE-2022-28383 | Medium | 6.8 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to insufficient firmware validation, an attacker can store malicious firmware code f… |
CVE-2022-28382 | High | 7.5 | 2022-06-08 | An issue was discovered in certain Verbatim drives through 2022-03-31. Due to the use of an insecure encryption AES mode (Electronic Codebook, aka ECB), an att… |
CVE-2022-24296 | High | 7.5 | 2022-06-08 | Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3… |
CVE-2022-30926 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditMacList parameter at /goform/aspForm. |
CVE-2022-30925 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddMacList parameter at /goform/aspForm. |
CVE-2022-30924 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetAPWifiorLedInfoById parameter at /goform/aspForm. |
CVE-2022-30923 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTimingtimeWifiAndLed parameter at /goform/aspForm. |
CVE-2022-30922 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the EditWlanMacList parameter at /goform/aspForm. |
CVE-2022-30921 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the SetMobileAPInfoById parameter at /goform/aspForm. |
CVE-2022-30920 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID parameter at /goform/aspForm. |
CVE-2022-30919 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Edit_BasicSSID_5G parameter at /goform/aspForm. |
CVE-2022-30918 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnet parameter at /goform/aspForm. |
CVE-2022-30917 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddWlanMacList parameter at /goform/aspForm. |
CVE-2022-30916 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnetDebug parameter at /goform/aspForm. |
CVE-2022-30915 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateSnat parameter at /goform/aspForm. |
CVE-2022-30914 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateMacClone parameter at /goform/aspForm. |
CVE-2022-30913 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the ipqos_set_bandwidth parameter at /goform/aspForm. |
CVE-2022-30912 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateWanParams parameter at /goform/aspForm. |
CVE-2022-30910 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the GO parameter at /goform/aspForm. |
CVE-2022-30909 | Critical | 9.8 | 2022-06-08 | H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the CMD parameter at /goform/aspForm. |
CVE-2022-1997 | Medium | 5.4 | 2022-06-08 | Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0. |
CVE-2022-30790 | High | 7.8 | 2022-06-08 | Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552. |
CVE-2022-30552 | Medium | 5.5 | 2022-06-08 | Das U-Boot 2022.01 has a Buffer Overflow. |
CVE-2022-1996 | Critical | 9.1 | 2022-06-08 | Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0. |
CVE-2022-31497 | Medium | 6.1 | 2022-06-08 | LibreHealth EHR Base 2.0.0 allows interface/main/finder/finder_navigation.php patient XSS. |
CVE-2022-1712 | Medium | 4.3 | 2022-06-08 | The LiveSync for WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in adm… |
CVE-2022-1709 | Medium | 4.3 | 2022-06-08 | The Throws SPAM Away WordPress plugin before 3.3.1 does not have CSRF checks in place when deleting comments (either all, spam, or pending), allowing attackers… |
CVE-2022-1695 | Medium | 4.3 | 2022-06-08 | The WP Simple Adsense Insertion WordPress plugin before 2.1 does not perform CSRF checks on updates to its admin page, allowing an attacker to trick a logged i… |
CVE-2022-1692 | Critical | 9.8 | 2022-06-08 | The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the ordering_by query parameter before using it in a SQL statemen… |
CVE-2022-1691 | Medium | 4.9 | 2022-06-08 | The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent ed… |
CVE-2022-1690 | Low | 2.7 | 2022-06-08 | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page… |
CVE-2022-1689 | Low | 2.7 | 2022-06-08 | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via th… |
CVE-2022-1688 | Low | 2.7 | 2022-06-08 | The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard… |
CVE-2022-1687 | Low | 2.7 | 2022-06-08 | The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slide… |
CVE-2022-1686 | Low | 2.7 | 2022-06-08 | The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product… |
CVE-2022-1685 | Medium | 4.9 | 2022-06-08 | The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the… |
CVE-2022-1684 | Low | 2.7 | 2022-06-08 | The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injecti… |
CVE-2022-1683 | High | 8.8 | 2022-06-08 | The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL i… |
CVE-2022-1673 | Medium | 6.1 | 2022-06-08 | The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading… |
CVE-2022-1647 | Medium | 4.8 | 2022-06-08 | The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perform Cross-Site Script… |
CVE-2022-1598 | Medium | 5.3 | 2022-06-08 | The WPQA Builder WordPress plugin before 5.5 which is a companion to the Discy and Himer , lacks authentication in a REST API endpoint, allowing unauthenticate… |
CVE-2022-1597 | Medium | 6.1 | 2022-06-08 | The WPQA Builder WordPress plugin before 5.4, used as a companion for the Discy and Himer , does not sanitise and escape a parameter on its reset password form… |
CVE-2022-1577 | Medium | 5.4 | 2022-06-08 | The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attack… |
CVE-2022-1570 | Medium | 6.5 | 2022-06-08 | The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authentica… |
CVE-2022-1569 | Medium | 4.8 | 2022-06-08 | The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not s… |
CVE-2022-1541 | Medium | 4.8 | 2022-06-08 | The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross… |
CVE-2022-1506 | Medium | 5.4 | 2022-06-08 | The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to p… |
CVE-2022-1469 | Medium | 4.8 | 2022-06-08 | The FiboSearch WordPress plugin before 1.17.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2022-1424 | Medium | 6.5 | 2022-06-08 | The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform vari… |
CVE-2022-1422 | Medium | 6.5 | 2022-06-08 | The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetti… |
CVE-2022-1421 | Medium | 4.3 | 2022-06-08 | The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings includ… |
CVE-2022-1394 | Medium | 4.8 | 2022-06-08 | The Photo Gallery by 10Web WordPress plugin before 1.6.4 does not properly validate and escape some of its settings, which could allow high privilege users suc… |
CVE-2022-1241 | Medium | 6.1 | 2022-06-08 | The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site S… |
CVE-2022-1005 | Medium | 6.1 | 2022-06-08 | The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-S… |
CVE-2022-0788 | Critical | 9.8 | 2022-06-08 | The WP Fundraising Donation and Crowdfunding Platform WordPress plugin before 1.5.0 does not sanitise and escape a parameter before using it in a SQL statement… |
CVE-2022-0779 | Medium | 6.5 | 2022-06-08 | The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged… |
CVE-2022-21122 | Critical | 9.0 | 2022-06-08 | The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is ex… |
CVE-2022-1703 | High | 8.8 | 2022-06-08 | Improper neutralization of special elements in the SonicWall SSL-VPN SMA100 series management interface allows a remote authenticated attacker to inject OS Com… |
CVE-2022-24065 | High | 8.1 | 2022-06-08 | The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code wi… |
CVE-2022-31470 | Medium | 6.1 | 2022-06-07 | An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows att… |
CVE-2022-30466 | Medium | 6.5 | 2022-06-07 | joyebike Joy ebike Wolf Manufacturing year 2022 is vulnerable to Authentication Bypass by Capture-replay. |
CVE-2022-29620 | Medium | 6.5 | 2022-06-07 | FileZilla v3.59.0 allows attackers to obtain cleartext passwords of connected SSH or FTP servers via a memory dump.- NOTE: the vendor does not consider this a… |
CVE-2022-2022 | Medium | 5.4 | 2022-06-07 | Cross-site Scripting (XSS) - Stored in GitHub repository nocodb/nocodb prior to 0.91.7. |
CVE-2022-30749 | Low | 3.3 | 2022-06-07 | Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity. |
CVE-2022-30748 | Medium | 4.0 | 2022-06-07 | Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity. |
CVE-2022-30747 | Medium | 5.5 | 2022-06-07 | PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent. |
CVE-2022-30746 | High | 7.5 | 2022-06-07 | Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API. |
CVE-2022-30745 | Medium | 4.0 | 2022-06-07 | Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share. |
CVE-2022-30744 | Medium | 6.2 | 2022-06-07 | DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code. |
CVE-2022-30743 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30742 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get… |
CVE-2022-30741 | Low | 3.3 | 2022-06-07 | Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to… |
CVE-2022-30740 | Medium | 4.1 | 2022-06-07 | Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers. |
CVE-2022-30739 | Medium | 4.0 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get an user email or phone number with a normal level per… |
CVE-2022-30738 | Medium | 4.3 | 2022-06-07 | Improper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing script. |
CVE-2022-30737 | Medium | 4.0 | 2022-06-07 | Implicit Intent hijacking vulnerability in Samsung Account prior to version 13.2.00.6 allows attackers to get email ID. |
CVE-2022-30736 | Medium | 5.3 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission. |
CVE-2022-30735 | Medium | 5.9 | 2022-06-07 | Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permission. |
CVE-2022-30734 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without perm… |
CVE-2022-30733 | Medium | 4.0 | 2022-06-07 | Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permi… |
CVE-2022-30732 | Medium | 5.5 | 2022-06-07 | Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityRes… |
CVE-2022-30731 | Medium | 5.1 | 2022-06-07 | Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private files in My Files application. |
CVE-2022-30730 | Medium | 4.6 | 2022-06-07 | Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authentication. |
CVE-2022-30728 | Low | 1.9 | 2022-06-07 | Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information. |
CVE-2022-30727 | Medium | 6.2 | 2022-06-07 | Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows loc… |