2022 CVEs (page 202)
Page 202 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29875 | Critical | 9.8 | 2022-06-01 | A vulnerability has been identified in Biograph Horizon PET/CT Systems (All VJ30 versions < VJ30C-UD01), MAGNETOM Family (NUMARIS X: VA12M, VA12S, VA10B, VA20A… |
CVE-2022-1285 | Medium | 6.5 | 2022-06-01 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8. |
CVE-2022-31015 | Medium | 6.5 | 2022-05-31 | Waitress is a Web Server Gateway Interface server for Python 2 and 3. Waitress versions 2.1.0 and 2.1.1 may terminate early due to a thread closing a socket wh… |
CVE-2022-31013 | Critical | 9.1 | 2022-05-31 | Chat Server is the chat server for Vartalap, an open-source messaging application. Versions 2.3.2 until 2.6.0 suffer from a bug in validating the access token… |
CVE-2022-1947 | Medium | 6.5 | 2022-05-31 | Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3. |
CVE-2022-1893 | Medium | 4.6 | 2022-05-31 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository polonel/trudesk prior to 1.2.3. |
CVE-2022-1808 | High | 8.8 | 2022-05-31 | Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3. |
CVE-2022-31011 | High | 7.8 | 2022-05-31 | TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing (HTAP) workloads. Under certain conditions, an attacker can… |
CVE-2022-31007 | Medium | 4.9 | 2022-05-31 | eLabFTW is an electronic lab notebook manager for research teams. Prior to version 4.3.0, a vulnerability allows an authenticated user with an administrator ro… |
CVE-2022-31005 | High | 7.5 | 2022-05-31 | Vapor is an HTTP web framework for Swift. Users of Vapor prior to version 4.60.3 with FileMiddleware enabled are vulnerable to an integer overflow vulnerabilit… |
CVE-2022-31003 | Critical | 9.1 | 2022-05-31 | Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, when parsing each line of a sdp message, `rest = rec… |
CVE-2022-31001 | High | 7.5 | 2022-05-31 | Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to Free… |
CVE-2022-31002 | High | 7.5 | 2022-05-31 | Sofia-SIP is an open-source Session Initiation Protocol (SIP) User-Agent library. Prior to version 1.13.8, an attacker can send a message with evil sdp to Free… |
CVE-2022-29258 | High | 7.4 | 2022-05-31 | XWiki Platform Filter UI provides a generic user interface to convert from a XWiki Filter input stream to an output stream with settings for each stream. Start… |
CVE-2022-29245 | Medium | 6.5 | 2022-05-31 | SSH.NET is a Secure Shell (SSH) library for .NET. In versions 2020.0.0 and 2020.0.1, during an `X25519` key exchange, the client’s private key is generated wit… |
CVE-2022-29243 | Medium | 4.3 | 2022-05-31 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.7 and 23.0.4, missing input-size valida… |
CVE-2022-29220 | Medium | 6.5 | 2022-05-31 | github-action-merge-dependabot is an action that automatically approves and merges dependabot pull requests (PRs). Prior to version 3.2.0, github-action-merge-… |
CVE-2022-22361 | Medium | 6.5 | 2022-05-31 | IBM Business Automation Workflow traditional 21.0.1 through 21.0.3, 20.0.0.1 through 20.0.0.2, 19.0.0.1 through 19.0.0.3, 18.0.0.0 through 18.0.0.1, IBM Busine… |
CVE-2022-23082 | High | 7.5 | 2022-05-31 | In CureKit versions v1.0.1 through v1.1.3 are vulnerable to path traversal as the function isFileOutsideDir fails to sanitize the user input which may lead to… |
CVE-2022-30973 | Medium | 5.5 | 2022-05-31 | We failed to apply the fix for CVE-2022-30126 to the 1.x branch in the 1.28.2 release. In Apache Tika, a regular expression in the StandardsText class, used by… |
CVE-2022-1942 | High | 7.8 | 2022-05-31 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-1926 | Medium | 4.9 | 2022-05-31 | Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.3. |
CVE-2022-1934 | High | 7.8 | 2022-05-31 | Use After Free in GitHub repository mruby/mruby prior to 3.2. |
CVE-2022-1931 | High | 8.1 | 2022-05-31 | Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3. |
CVE-2022-1646 | Medium | 4.8 | 2022-05-30 | The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2022-1645 | Medium | 4.8 | 2022-05-30 | The Amazon Link WordPress plugin through 3.2.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2022-1644 | Medium | 4.8 | 2022-05-30 | The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-1643 | Medium | 4.8 | 2022-05-30 | The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to p… |
CVE-2022-1611 | High | 8.8 | 2022-05-30 | The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF. |
CVE-2022-1589 | High | 7.5 | 2022-05-30 | The Change wp-admin login WordPress plugin before 1.1.0 does not properly check for authorisation and is also missing CSRF check when updating its settings, wh… |
CVE-2022-1583 | Medium | 6.5 | 2022-05-30 | The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked… |
CVE-2022-1582 | Medium | 6.1 | 2022-05-30 | The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes St… |
CVE-2022-1568 | Medium | 4.8 | 2022-05-30 | The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross… |
CVE-2022-1566 | Medium | 4.8 | 2022-05-30 | The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site… |
CVE-2022-1564 | Medium | 4.8 | 2022-05-30 | The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as ad… |
CVE-2022-1562 | Medium | 5.4 | 2022-05-30 | The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious S… |
CVE-2022-1556 | Critical | 9.8 | 2022-05-30 | The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in th… |
CVE-2022-1542 | Medium | 4.8 | 2022-05-30 | The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-1528 | Medium | 6.1 | 2022-05-30 | The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading… |
CVE-2022-1527 | Medium | 6.1 | 2022-05-30 | The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site… |
CVE-2022-1456 | Medium | 4.8 | 2022-05-30 | The Poll Maker WordPress plugin before 4.0.2 does not sanitise and escape some settings, which could allow high privilege users such as admin to perform Store… |
CVE-2022-1395 | Medium | 4.8 | 2022-05-30 | The Easy FAQ with Expanding Text WordPress plugin through 3.2.8.3.1 does not sanitise and escape its settings, allowing high privilege users to perform Cross-S… |
CVE-2022-1387 | Medium | 4.8 | 2022-05-30 | The No Future Posts WordPress plugin through 1.4 does not escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scrip… |
CVE-2022-1299 | Medium | 4.8 | 2022-05-30 | The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-privileged users such… |
CVE-2022-1294 | Medium | 4.8 | 2022-05-30 | The IMDB info box WordPress plugin through 2.0 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site… |
CVE-2022-1275 | Medium | 4.8 | 2022-05-30 | The BannerMan WordPress plugin through 0.2.4 does not sanitize or escape its settings, which could allow high-privileged users to perform Cross-Site Scripting… |
CVE-2022-1203 | Medium | 4.3 | 2022-05-30 | The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option t… |
CVE-2022-1009 | Medium | 6.1 | 2022-05-30 | The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a mali… |
CVE-2022-0642 | Medium | 5.4 | 2022-05-30 | The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise so… |
CVE-2022-0376 | Medium | 4.8 | 2022-05-30 | The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dash… |
CVE-2022-1928 | Medium | 5.4 | 2022-05-29 | Cross-site Scripting (XSS) - Stored in GitHub repository go-gitea/gitea prior to 1.16.9. |
CVE-2022-1927 | High | 7.8 | 2022-05-29 | Buffer Over-read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-25878 | High | 8.2 | 2022-05-27 | The package protobufjs before 6.11.3 are vulnerable to Prototype Pollution which can allow an attacker to add/modify properties of the Object.prototype. This v… |
CVE-2022-1897 | High | 7.8 | 2022-05-27 | Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. |
CVE-2022-20807 | Medium | 4.3 | 2022-05-27 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-20806 | Medium | 4.3 | 2022-05-27 | Multiple vulnerabilities in the API and web-based management interfaces of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) coul… |
CVE-2022-20802 | Medium | 5.4 | 2022-05-27 | A vulnerability in the web interface of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site scripting (… |
CVE-2022-20797 | Medium | 5.5 | 2022-05-27 | A vulnerability in the web-based management interface of Cisco Secure Network Analytics, formerly Cisco Stealthwatch Enterprise, could allow an authenticated… |
CVE-2022-20765 | Medium | 4.8 | 2022-05-27 | A vulnerability in the web applications of Cisco UCS Director could allow an authenticated, remote attacker to conduct a cross-site scripting attack on an affe… |
CVE-2022-20674 | Medium | 6.1 | 2022-05-27 | Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remo… |
CVE-2022-20673 | Medium | 6.1 | 2022-05-27 | Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remo… |
CVE-2022-20672 | Medium | 6.1 | 2022-05-27 | Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remo… |
CVE-2022-20671 | Medium | 6.1 | 2022-05-27 | Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remo… |
CVE-2022-20670 | Medium | 6.1 | 2022-05-27 | Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remo… |
CVE-2022-20669 | Medium | 6.1 | 2022-05-27 | Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remo… |
CVE-2022-20668 | Medium | 6.1 | 2022-05-27 | Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remo… |
CVE-2022-20667 | Medium | 6.1 | 2022-05-27 | Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remo… |
CVE-2022-20666 | Medium | 6.1 | 2022-05-27 | Multiple vulnerabilities in the web-based management interface of Cisco Common Services Platform Collector (CSPC) Software could allow an unauthenticated, remo… |
CVE-2022-1909 | Medium | 5.4 | 2022-05-27 | Cross-site Scripting (XSS) - Stored in GitHub repository causefx/organizr prior to 2.1.2200. |
CVE-2022-1908 | High | 8.1 | 2022-05-27 | Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. |
CVE-2022-1907 | High | 8.1 | 2022-05-27 | Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. |
CVE-2022-1898 | High | 7.8 | 2022-05-27 | Use After Free in GitHub repository vim/vim prior to 8.2. |
CVE-2022-30701 | High | 7.8 | 2022-05-27 | An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a special configurati… |
CVE-2022-30700 | High | 7.8 | 2022-05-27 | An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated pr… |
CVE-2022-30687 | High | 7.1 | 2022-05-27 | Trend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could allow a low privileged local user to manipulate the product's secu… |
CVE-2022-28394 | High | 7.8 | 2022-05-27 | EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend Micro Incorporated contains an issue wit… |
CVE-2022-31648 | Medium | 6.1 | 2022-05-26 | Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in… |
CVE-2022-30585 | Medium | 6.5 | 2022-05-26 | The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability. A remote authenticated malicious user could potentia… |
CVE-2022-30584 | Critical | 9.6 | 2022-05-26 | Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited… |
CVE-2022-29637 | High | 7.8 | 2022-05-26 | An arbitrary file upload vulnerability in Mindoc v2.1-beta.5 allows attackers to execute arbitrary commands via a crafted Zip file. |
CVE-2022-29633 | Critical | 9.8 | 2022-05-26 | An access control issue in Linglong v1.0 allows attackers to access the background of the application via a crafted cookie. |
CVE-2022-29632 | Critical | 9.8 | 2022-05-26 | An arbitrary file upload vulnerability in the component /course/api/upload/pic of Roncoo Education v9.0.0 allows attackers to execute arbitrary code via a craf… |
CVE-2022-26776 | Critical | 9.8 | 2022-05-26 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. An attacker may be able to cause unexpected ap… |
CVE-2022-26775 | Critical | 9.8 | 2022-05-26 | An integer overflow was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4. An attacker ma… |
CVE-2022-26774 | High | 7.8 | 2022-05-26 | A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their pr… |
CVE-2022-26773 | High | 7.1 | 2022-05-26 | A logic issue was addressed with improved state management. This issue is fixed in iTunes 12.12.4 for Windows. An application may be able to delete files for w… |
CVE-2022-26772 | High | 7.8 | 2022-05-26 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4. An application may be able to execute arbit… |
CVE-2022-26771 | High | 7.8 | 2022-05-26 | A memory corruption issue was addressed with improved state management. This issue is fixed in watchOS 8.6, tvOS 15.5, iOS 15.5 and iPadOS 15.5. A malicious ap… |
CVE-2022-26770 | High | 7.8 | 2022-05-26 | An out-of-bounds read issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS… |
CVE-2022-26769 | High | 7.8 | 2022-05-26 | A memory corruption issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Bi… |
CVE-2022-26768 | High | 7.8 | 2022-05-26 | A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.4, watchOS 8.6, tvOS 15.5, macOS Big Sur 11.6… |
CVE-2022-26767 | Medium | 5.5 | 2022-05-26 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Monterey 12.4, macOS Big Sur 11.6.6. A malicious application may be ab… |
CVE-2022-26766 | Medium | 5.5 | 2022-05-26 | A certificate parsing issue was addressed with improved checks. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Catalina… |
CVE-2022-26765 | Medium | 4.7 | 2022-05-26 | A race condition was addressed with improved state handling. This issue is fixed in watchOS 8.6, tvOS 15.5, macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5. A ma… |
CVE-2022-26764 | Medium | 4.7 | 2022-05-26 | A memory corruption issue was addressed with improved validation. This issue is fixed in watchOS 8.6, tvOS 15.5, macOS Monterey 12.4, iOS 15.5 and iPadOS 15.5… |
CVE-2022-26763 | High | 7.8 | 2022-05-26 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004… |
CVE-2022-26761 | High | 7.8 | 2022-05-26 | A memory corruption issue was addressed with improved memory handling. This issue is fixed in Security Update 2022-004 Catalina, macOS Big Sur 11.6.6. An appli… |
CVE-2022-26757 | High | 7.8 | 2022-05-26 | A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 15.5, iOS 15.5 and iPadOS 15.5, Security Update 2022-004 Cata… |
CVE-2022-26756 | High | 7.8 | 2022-05-26 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS… |
CVE-2022-26755 | Medium | 6.3 | 2022-05-26 | This issue was addressed with improved environment sanitization. This issue is fixed in Security Update 2022-004 Catalina, macOS Monterey 12.4, macOS Big Sur 1… |