2022 CVEs (page 205)
Page 205 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-30015 | Medium | 5.4 | 2022-05-23 | In Simple Food Website 1.0, a moderation can put the Cross Site Scripting Payload in any of the fields on http://127.0.0.1:1234/food/admin/all_users.php like F… |
CVE-2022-29376 | High | 8.8 | 2022-05-23 | Xampp for Windows v8.1.4 and below was discovered to contain insecure permissions for its install directory, allowing attackers to execute arbitrary code via o… |
CVE-2022-29002 | High | 8.8 | 2022-05-23 | A Cross-Site Request Forgery (CSRF) in XXL-Job v2.3.0 allows attackers to arbitrarily create administrator accounts via the component /gaia-job-admin/user/add. |
CVE-2022-28999 | High | 8.8 | 2022-05-23 | Insecure permissions in the install directories and binaries of Dev-CPP v4.9.9.2 allows attackers to execute arbitrary code via overwriting the binary devcpp.e… |
CVE-2022-31489 | High | 7.5 | 2022-05-23 | Inout Blockchain AltExchanger 1.2.1 allows index.php/home/about inoutio_language cookie SQL injection. |
CVE-2022-31488 | High | 7.5 | 2022-05-23 | Inout Blockchain AltExchanger 1.2.1 allows index.php/coins/update_marketboxslider marketcurrency SQL injection. |
CVE-2022-31487 | High | 7.5 | 2022-05-23 | Inout Blockchain AltExchanger 1.2.1 and Inout Blockchain FiatExchanger 2.2.1 allow Chart/TradingView/chart_content/master.php symbol SQL injection. |
CVE-2022-1467 | High | 7.4 | 2022-05-23 | Windows OS can be configured to overlay a “language bar” on top of any application. When this OS functionality is enabled, the OS language bar UI will be viewa… |
CVE-2022-31467 | High | 7.9 | 2022-05-23 | A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leadin… |
CVE-2022-31466 | High | 7.9 | 2022-05-23 | Time of Check - Time of Use (TOCTOU) vulnerability in Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, pot… |
CVE-2022-28944 | High | 8.8 | 2022-05-23 | Certain EMCO Software products are affected by: CWE-494: Download of Code Without Integrity Check. This affects MSI Package Builder for Windows 9.1.4 and Remot… |
CVE-2022-30017 | Medium | 5.4 | 2022-05-23 | Rescue Dispatch Management System 1.0 suffers from Stored XSS, leading to admin account takeover via cookie stealing. |
CVE-2022-30016 | High | 8.8 | 2022-05-23 | Rescue Dispatch Management System 1.0 is vulnerable to Incorrect Access Control via http://localhost/rdms/admin/?page=system_info. |
CVE-2022-30014 | High | 8.8 | 2022-05-23 | Lumidek Associates Simple Food Website 1.0 is vulnerable to Cross Site Request Forgery (CSRF) which allows anyone to takeover admin/moderater account. |
CVE-2022-29005 | Medium | 6.1 | 2022-05-23 | Multiple cross-site scripting (XSS) vulnerabilities in the component /obcs/user/profile.php of Online Birth Certificate System v1.2 allows attackers to execute… |
CVE-2022-29004 | Medium | 6.1 | 2022-05-23 | Diary Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name parameter in search-result.php. |
CVE-2022-28932 | Critical | 9.8 | 2022-05-23 | D-Link DSL-G2452DG HW:T1\\tFW:ME_2.00 was discovered to contain insecure permissions. |
CVE-2022-1811 | Medium | 5.4 | 2022-05-23 | Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9. |
CVE-2022-28998 | High | 8.1 | 2022-05-23 | Xlight FTP v3.9.3.2 was discovered to contain a stack-based buffer overflow which allows attackers to leak sensitive information via crafted code. |
CVE-2022-28997 | High | 7.5 | 2022-05-23 | CSZCMS v1.3.0 allows attackers to execute a Server-Side Request Forgery (SSRF) which can be leveraged to leak sensitive data via a local file inclusion at /adm… |
CVE-2022-0900 | Medium | 5.4 | 2022-05-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NetDataSoft DivvyDrive allows Stored XSS. This issue aff… |
CVE-2022-1817 | Low | 3.5 | 2022-05-23 | A vulnerability, which was classified as problematic, was found in Badminton Center Management System. This affects the userlist module at /bcms/admin/?page=us… |
CVE-2022-1816 | Low | 3.5 | 2022-05-23 | A vulnerability, which was classified as problematic, has been found in Zoo Management System 1.0. Affected by this issue is /zoo/admin/public_html/view_accoun… |
CVE-2022-1810 | Medium | 4.3 | 2022-05-23 | Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9. |
CVE-2022-29599 | Critical | 9.8 | 2022-05-23 | In Apache Maven maven-shared-utils prior to version 3.3.3, the Commandline class can emit double-quoted strings without proper escaping, allowing shell injecti… |
CVE-2022-28874 | Medium | 4.3 | 2022-05-23 | Multiple Denial-of-Service vulnerabilities was discovered in the F-Secure Atlant and in certain WithSecure products while scanning fuzzed PE32-bit files cause… |
CVE-2022-1825 | Medium | 5.4 | 2022-05-23 | Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8. |
CVE-2022-1558 | Medium | 4.8 | 2022-05-23 | The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2022-1547 | Medium | 6.1 | 2022-05-23 | The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leadin… |
CVE-2022-1320 | Medium | 4.8 | 2022-05-23 | The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as ad… |
CVE-2022-1298 | Medium | 4.8 | 2022-05-23 | The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to p… |
CVE-2022-1268 | Medium | 6.1 | 2022-05-23 | The Donate Extra WordPress plugin through 2.02 does not sanitise and escape a parameter before outputting it back in the response, leading to a Reflected cross… |
CVE-2022-1221 | Medium | 6.1 | 2022-05-23 | The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to… |
CVE-2022-1218 | Medium | 6.1 | 2022-05-23 | The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading… |
CVE-2022-1192 | Medium | 6.1 | 2022-05-23 | The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a… |
CVE-2022-1093 | Medium | 4.8 | 2022-05-23 | The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege… |
CVE-2022-1014 | Critical | 9.8 | 2022-05-23 | The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement a… |
CVE-2022-0781 | Critical | 9.8 | 2022-05-23 | The Nirweb support WordPress plugin before 2.8.2 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action (available to u… |
CVE-2022-0346 | Medium | 6.1 | 2022-05-23 | The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via e… |
CVE-2022-1813 | Critical | 9.8 | 2022-05-22 | OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0. |
CVE-2022-1809 | High | 7.8 | 2022-05-21 | Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0. |
CVE-2022-31268 | High | 7.5 | 2022-05-21 | A Path Traversal vulnerability in Gitblit 1.9.3 can lead to reading website files via /resources//../ (e.g., followed by a WEB-INF or META-INF pathname). |
CVE-2022-31267 | Critical | 9.8 | 2022-05-21 | Gitblit 1.9.2 allows privilege escalation via the Config User Service: a control character can be placed in a profile data field, such as an emailAddress%3Atex… |
CVE-2022-31264 | High | 7.5 | 2022-05-21 | Solana solana_rbpf before 0.2.29 has an addition integer overflow via invalid ELF program headers. elf.rs has a panic via a malformed eBPF program. |
CVE-2022-31259 | Critical | 9.8 | 2022-05-21 | The route lookup process in beego before 1.12.9 and 2.x before 2.0.3 allows attackers to bypass access control. When a /p1/p2/:name route is configured, attack… |
CVE-2022-1752 | High | 8.0 | 2022-05-21 | Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2022-29222 | Medium | 5.9 | 2022-05-21 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.5, a DTLS Client could provide a Certificate that it doesn't posses… |
CVE-2022-29216 | High | 7.8 | 2022-05-21 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, TensorFlow's `saved_model_cli` tool is vulnerable… |
CVE-2022-29215 | High | 7.5 | 2022-05-21 | RegionProtect is a plugin that allows users to manage certain events in certain regions of the world. Versions prior to 1.1.0 contain a YAML injection vulnerab… |
CVE-2022-29214 | Medium | 6.1 | 2022-05-21 | NextAuth.js (next-auth) is am open source authentication solution for Next.js applications. Prior to versions 3.29.3 and 4.3.3, an open redirect vulnerability… |
CVE-2022-29213 | Medium | 5.5 | 2022-05-21 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the `tf.compat.v1.signal.rfft2d` and `tf.compat.v… |
CVE-2022-29212 | Medium | 5.5 | 2022-05-21 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, certain TFLite models that were created using TFL… |
CVE-2022-29211 | Medium | 5.5 | 2022-05-21 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.histogram_fixed_width`… |
CVE-2022-29210 | Medium | 5.5 | 2022-05-21 | TensorFlow is an open source platform for machine learning. In version 2.8.0, the `TensorKey` hash function used total estimated `AllocatedBytes()`, which (a)… |
CVE-2022-29209 | Medium | 5.5 | 2022-05-21 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the macros that TensorFlow uses for writing asser… |
CVE-2022-29190 | High | 7.5 | 2022-05-21 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, an attacker can send packets that sends Pion DTLS into an infini… |
CVE-2022-29189 | Medium | 5.3 | 2022-05-21 | Pion DTLS is a Go implementation of Datagram Transport Layer Security. Prior to version 2.1.4, a buffer that was used for inbound network traffic had no upper… |
CVE-2022-29188 | Medium | 5.3 | 2022-05-21 | Smokescreen is an HTTP proxy. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks in which external attackers leverag… |
CVE-2022-31258 | High | 8.2 | 2022-05-20 | In Checkmk before 1.6.0p29, 2.x before 2.0.0p25, and 2.1.x before 2.1.0b10, a site user can escalate to root by editing an OMD hook symlink. |
CVE-2022-29208 | High | 7.1 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.EditDistance` h… |
CVE-2022-29206 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorDen… |
CVE-2022-29205 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, there is a potential for segfault / denial of ser… |
CVE-2022-29204 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegment… |
CVE-2022-29203 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SpaceToBatchND`… |
CVE-2022-29202 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.ragged.constant` does n… |
CVE-2022-29201 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizedConv2D… |
CVE-2022-1775 | Critical | 9.8 | 2022-05-20 | Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2022-29207 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, multiple TensorFlow operations misbehave in eager… |
CVE-2022-29200 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell`… |
CVE-2022-29199 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LoadAndRemapMat… |
CVE-2022-29198 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.SparseTensorToC… |
CVE-2022-29197 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.UnsortedSegment… |
CVE-2022-29196 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.Conv3DBackpropF… |
CVE-2022-29195 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.StagePeek` does… |
CVE-2022-29193 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.TensorSummaryV2… |
CVE-2022-1803 | Medium | 6.9 | 2022-05-20 | Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2022-29447 | Medium | 6.8 | 2022-05-20 | Authenticated (administrator or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Hover Effects plugin <= 2.1 at WordPress. |
CVE-2022-29434 | Medium | 6.3 | 2022-05-20 | Insecure Direct Object References (IDOR) vulnerability in Spiffy Plugins Spiffy Calendar <= 4.9.0 at WordPress allows an attacker to edit or delete events. |
CVE-2022-29432 | Low | 3.4 | 2022-05-20 | Multiple Authenticated (administrator or higher user role) Persistent Cross-Site Scripting (XSS) vulnerabilities in TMS-Plugins wpDataTables plugin <= 2.1.27 o… |
CVE-2022-29431 | Medium | 5.4 | 2022-05-20 | Cross-Site Request Forgery (CSRF) vulnerability in KubiQ CPT base plugin <= 5.8 at WordPress allows an attacker to delete the CPT base. |
CVE-2022-29430 | Medium | 4.7 | 2022-05-20 | Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable parameter &jpg_qual… |
CVE-2022-29428 | Medium | 4.1 | 2022-05-20 | Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slider Plugin <= 1.4.5 at WordPress. |
CVE-2022-29427 | Medium | 4.3 | 2022-05-20 | Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress. |
CVE-2022-29426 | Medium | 5.4 | 2022-05-20 | Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin… |
CVE-2022-29194 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.DeleteSessionTe… |
CVE-2022-29192 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizeAndDequ… |
CVE-2022-29191 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.GetSessionTenso… |
CVE-2022-29186 | Critical | 9.1 | 2022-05-20 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contai… |
CVE-2022-28618 | Critical | 9.8 | 2022-05-20 | A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble St… |
CVE-2022-22973 | High | 7.8 | 2022-05-20 | VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to '… |
CVE-2022-22972 | Critical | 9.8 | 2022-05-20 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious… |
CVE-2022-29448 | Medium | 6.8 | 2022-05-20 | Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress. |
CVE-2022-29425 | Medium | 6.1 | 2022-05-20 | Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress. |
CVE-2022-29424 | Medium | 4.8 | 2022-05-20 | Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1… |
CVE-2022-29185 | Medium | 4.2 | 2022-05-20 | totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version 1.1.0, token compa… |
CVE-2022-29184 | High | 8.8 | 2022-05-20 | GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create… |
CVE-2022-24434 | High | 7.5 | 2022-05-20 | This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the p… |
CVE-2022-21195 | Medium | 5.3 | 2022-05-20 | All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash. |
CVE-2022-29183 | Medium | 4.3 | 2022-05-20 | GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pipeline comparison f… |
CVE-2022-29182 | Medium | 4.3 | 2022-05-20 | GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 (inclusive) are vulnerable to a Document Object Model (DOM)-based cross-site scripti… |