2022 CVEs (page 206)
Page 206 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-29430 | Medium | 4.7 | 2022-05-20 | Cross-Site Scripting (XSS) vulnerability in KubiQ's PNG to JPG plugin <= 4.0 at WordPress via Cross-Site Request Forgery (CSRF). Vulnerable parameter &jpg_qual… |
CVE-2022-29428 | Medium | 4.1 | 2022-05-20 | Cross-Site Scripting (XSS) vulnerability in Muneeb's WP Slider Plugin <= 1.4.5 at WordPress. |
CVE-2022-29427 | Medium | 4.3 | 2022-05-20 | Cross-Site Request Forgery (CSRF) vulnerability in Aftab Muni's Disable Right Click For WP plugin <= 1.1.6 at WordPress. |
CVE-2022-29426 | Medium | 5.4 | 2022-05-20 | Authenticated (contributor or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in 2J Slideshow Team's Slideshow, Image Slider by 2J plugin… |
CVE-2022-29194 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.DeleteSessionTe… |
CVE-2022-29192 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizeAndDequ… |
CVE-2022-29191 | Medium | 5.5 | 2022-05-20 | TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.GetSessionTenso… |
CVE-2022-29186 | Critical | 9.1 | 2022-05-20 | Rundeck is an open source automation service with a web console, command line tools and a WebAPI. Rundeck community and rundeck-enterprise docker images contai… |
CVE-2022-28618 | Critical | 9.8 | 2022-05-20 | A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble St… |
CVE-2022-22973 | High | 7.8 | 2022-05-20 | VMware Workspace ONE Access and Identity Manager contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to '… |
CVE-2022-22972 | Critical | 9.8 | 2022-05-20 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious… |
CVE-2022-29448 | Medium | 6.8 | 2022-05-20 | Authenticated (admin or higher user role) Local File Inclusion (LFI) vulnerability in Wow-Company's Herd Effects plugin <= 5.2 at WordPress. |
CVE-2022-29425 | Medium | 6.1 | 2022-05-20 | Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress. |
CVE-2022-29424 | Medium | 4.8 | 2022-05-20 | Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in Biplob Adhikari's Image Hover Effects Ultimate plugin <= 9.7.1… |
CVE-2022-29185 | Medium | 4.2 | 2022-05-20 | totp-rs is a Rust library that permits the creation of 2FA authentification tokens per time-based one-time password (TOTP). Prior to version 1.1.0, token compa… |
CVE-2022-29184 | High | 8.8 | 2022-05-20 | GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create… |
CVE-2022-24434 | High | 7.5 | 2022-05-20 | This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the p… |
CVE-2022-21195 | Medium | 5.3 | 2022-05-20 | All versions of package url-regex are vulnerable to Regular Expression Denial of Service (ReDoS) which can cause the CPU usage to crash. |
CVE-2022-29183 | Medium | 4.3 | 2022-05-20 | GoCD is a continuous delivery server. GoCD versions 20.2.0 until 21.4.0 are vulnerable to reflected cross-site scripting via abuse of the pipeline comparison f… |
CVE-2022-29182 | Medium | 4.3 | 2022-05-20 | GoCD is a continuous delivery server. GoCD versions 19.11.0 through 21.4.0 (inclusive) are vulnerable to a Document Object Model (DOM)-based cross-site scripti… |
CVE-2022-29181 | High | 8.2 | 2022-05-20 | Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, a… |
CVE-2022-29179 | High | 7.5 | 2022-05-20 | Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Prior to versions 1.9.16, 1.10… |
CVE-2022-29178 | High | 8.8 | 2022-05-20 | Cilium is open source software for providing and securing network connectivity and loadbalancing between application workloads. Cilium prior to versions 1.9.16… |
CVE-2022-28995 | Critical | 9.8 | 2022-05-20 | Rengine v1.0.2 was discovered to contain a remote code execution (RCE) vulnerability via the yaml configuration function. |
CVE-2022-28990 | High | 7.8 | 2022-05-20 | WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm. |
CVE-2022-28531 | Critical | 9.8 | 2022-05-20 | Sourcecodester Covid-19 Directory on Vaccination System1.0 is vulnerable to SQL Injection via the admin/login.php txtusername (aka Username) field. |
CVE-2022-1770 | High | 8.8 | 2022-05-20 | Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2022-29177 | Medium | 5.9 | 2022-05-20 | Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity lo… |
CVE-2022-22365 | Medium | 5.9 | 2022-05-20 | IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0, with the Ajax Proxy Web Application (AjaxProxy.war) deployed, is vulnerable to spoofing by allowing a… |
CVE-2022-29170 | Medium | 6.6 | 2022-05-20 | Grafana is an open-source platform for monitoring and observability. In Grafana Enterprise, the Request security feature allows list allows to configure Grafan… |
CVE-2022-29163 | Low | 3.5 | 2022-05-20 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 22.2.6 and 23.0.3, a user can create a link… |
CVE-2022-29160 | Low | 2.8 | 2022-05-20 | Nextcloud Android is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.0, sensitive tokens, images, and user related… |
CVE-2022-29159 | Medium | 5.0 | 2022-05-20 | Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud. In versions prior to 1.4.8, 1.5.6, and 1.6.1, an authenticated user can move… |
CVE-2022-24906 | Low | 3.5 | 2022-05-20 | Nextcloud Deck is a Kanban-style project & personal management tool for Nextcloud, similar to Trello. The full path of the application is exposed to unauthoriz… |
CVE-2022-31245 | High | 8.8 | 2022-05-20 | mailcow before 2022-05d allows a remote authenticated user to inject OS commands and escalate privileges to domain admin via the --debug option in conjunction… |
CVE-2022-29165 | Critical | 10.0 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A critical vulnerability has been discovered in Argo CD starting with version 1.4.0 a… |
CVE-2022-28660 | Critical | 9.8 | 2022-05-20 | The querier component in Grafana Enterprise Logs 1.1.x through 1.3.x before 1.4.0 does not require authentication when X-Scope-OrgID is used. Versions 1.2.1, 1… |
CVE-2022-24905 | Medium | 4.3 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was found in Argo CD prior to versions 2.3.4, 2.2.9, and 2.1.15 that… |
CVE-2022-24904 | Medium | 4.3 | 2022-05-20 | Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.7.0 and prior to versions 2.1.15m 2.2.9, and 2.3.4 is… |
CVE-2022-30887 | Critical | 9.8 | 2022-05-20 | Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. This… |
CVE-2022-30886 | Critical | 9.8 | 2022-05-20 | School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/daily_collection_… |
CVE-2022-30518 | Critical | 9.8 | 2022-05-20 | ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /simple_chat_bot/admin/respon… |
CVE-2022-29883 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not restrict unauthenticated access to certain pages of the web inter… |
CVE-2022-29882 | High | 7.1 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not handle uploaded files correctly. An unauthenticated attacker coul… |
CVE-2022-29881 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access pro… |
CVE-2022-29880 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate input in the configuration interface. This coul… |
CVE-2022-29879 | Medium | 4.3 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). The web based management interface of affected devices does not employ special access pro… |
CVE-2022-29878 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices use a limited range for challenges that are sent during the unencrypted… |
CVE-2022-29877 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All… |
CVE-2022-29876 | High | 7.1 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly handle the input of a GET request parameter. The provide… |
CVE-2022-29874 | High | 8.8 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not encrypt web traffic with clients but communicate in cleartext via… |
CVE-2022-29873 | Critical | 9.8 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of certain GET and POST requests. Th… |
CVE-2022-29872 | High | 8.8 | 2022-05-20 | A vulnerability has been identified in SICAM T (All versions < V3.0). Affected devices do not properly validate parameters of POST requests. This could allow a… |
CVE-2022-29801 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9). The application contains a XM… |
CVE-2022-29320 | High | 7.8 | 2022-05-20 | MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-29033 | High | 7.8 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29032 | High | 7.8 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29031 | Medium | 5.5 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29030 | Medium | 5.5 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29029 | Medium | 5.5 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29028 | Medium | 5.5 | 2022-05-20 | A vulnerability has been identified in JT2Go (All versions < V13.3.0.3), Teamcenter Visualization V13.3 (All versions < V13.3.0.3), Teamcenter Visualization V1… |
CVE-2022-29023 | Critical | 9.8 | 2022-05-20 | A buffer overflow vulnerability exists in the razermouse driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possi… |
CVE-2022-29022 | Critical | 9.8 | 2022-05-20 | A buffer overflow vulnerability exists in the razeraccessory driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and p… |
CVE-2022-29021 | Critical | 9.8 | 2022-05-20 | A buffer overflow vulnerability exists in the razerkbd driver of OpenRazer up to version v3.3.0 allows attackers to cause a Denial of Service (DoS) and possibl… |
CVE-2022-28993 | Critical | 9.8 | 2022-05-20 | Multi Store Inventory Management System v1.0 allows attackers to perform an account takeover via a crafted POST request. |
CVE-2022-28992 | High | 8.8 | 2022-05-20 | A Cross-Site Request Forgery (CSRF) in Online Banquet Booking System v1.0 allows attackers to change admin credentials via a crafted POST request. |
CVE-2022-28991 | High | 7.5 | 2022-05-20 | Multi Store Inventory Management System v1.0 was discovered to contain an information disclosure vulnerability which allows attackers to access sensitive files. |
CVE-2022-28106 | Critical | 9.8 | 2022-05-20 | Online Sports Complex Booking System v1.0 was discovered to allow attackers to take over user accounts via a crafted POST request. |
CVE-2022-28105 | Critical | 9.8 | 2022-05-20 | Online Sports Complex Booking System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /scbs/view_facility.php. |
CVE-2022-28104 | Critical | 9.8 | 2022-05-20 | Foxit PDF Editor v11.3.1 was discovered to contain an arbitrary file upload vulnerability. |
CVE-2022-27653 | High | 7.8 | 2022-05-20 | A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write past the end of an al… |
CVE-2022-27640 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in SIMATIC CP 442-1 RNA (All versions < V1.5.18), SIMATIC CP 443-1 RNA (All versions < V1.5.18). The affected devices impro… |
CVE-2022-27242 | Medium | 5.5 | 2022-05-20 | A vulnerability has been identified in OpenV2G (V0.9.4). The OpenV2G EXI parsing feature is missing a length check when parsing X509 serial numbers. Thus, an a… |
CVE-2022-27095 | High | 7.8 | 2022-05-20 | BattlEye v0.9 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-27094 | Medium | 6.7 | 2022-05-20 | Sony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-26634 | High | 7.8 | 2022-05-20 | HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-26633 | Critical | 9.8 | 2022-05-20 | Simple Student Quarterly Result/Grade System v1.0 was discovered to contain a SQL injection vulnerability via /sqgs/Actions.php. |
CVE-2022-26632 | Critical | 9.8 | 2022-05-20 | Multi-Vendor Online Groceries Management System v1.0 was discovered to contain a blind SQL injection vulnerability via the id parameter in /products/view_produ… |
CVE-2022-24290 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All version… |
CVE-2022-24287 | High | 7.8 | 2022-05-20 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions <… |
CVE-2022-24045 | Medium | 6.5 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-24044 | High | 7.5 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-24043 | Medium | 5.3 | 2022-05-20 | A vulnerability has been identified in Desigo DXR2 (All versions < V01.21.142.5-22), Desigo PXC3 (All versions < V01.21.142.4-18), Desigo PXC4 (All versions <… |
CVE-2022-1784 | High | 7.5 | 2022-05-20 | Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8. |
CVE-2022-31215 | Medium | 6.5 | 2022-05-20 | In certain Goverlan products, the Windows Firewall is temporarily turned off upon a Goverlan agent update operation. This allows remote attackers to bypass fir… |
CVE-2022-30551 | High | 7.5 | 2022-05-20 | OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available r… |
CVE-2022-25227 | High | 8.8 | 2022-05-20 | Thinfinity VNC v4.0.0.1 contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can trick a user… |
CVE-2022-25224 | Medium | 5.4 | 2022-05-20 | Proton v0.2.0 allows an attacker to create a malicious link inside a markdown file. When the victim clicks the link, the application opens the site in the curr… |
CVE-2022-25229 | Medium | 5.4 | 2022-05-20 | Popcorn Time 0.4.7 has a Stored XSS in the 'Movies API Server(s)' field via the 'settings' page. The 'nodeIntegration' configuration is set to on which allows… |
CVE-2022-1806 | Medium | 6.1 | 2022-05-20 | Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18. |
CVE-2022-1754 | Medium | 6.5 | 2022-05-20 | Integer Overflow or Wraparound in GitHub repository polonel/trudesk prior to 1.2.2. |
CVE-2022-28987 | Medium | 5.3 | 2022-05-20 | Zoho ManageEngine ADSelfService Plus before 6202 allows attackers to perform username enumeration via a crafted POST request to /ServletAPI/accounts/login. |
CVE-2022-28985 | Medium | 6.3 | 2022-05-20 | A stored cross-site scripting (XSS) vulnerability in the addNewPost component of OrangeHRM v4.10.1 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2022-28965 | Medium | 6.5 | 2022-05-20 | Multiple DLL hijacking vulnerabilities via the components instup.exe and wsc_proxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute… |
CVE-2022-28964 | High | 7.1 | 2022-05-20 | An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) allows attackers to cause a Denial of Service (DoS) v… |
CVE-2022-21500 | High | 7.5 | 2022-05-20 | Vulnerability in Oracle E-Business Suite (component: Manage Proxies). The supported version that is affected is 12.2. Easily exploitable vulnerability allows u… |
CVE-2022-29652 | Medium | 6.1 | 2022-05-19 | Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=save_client. |
CVE-2022-29304 | High | 8.8 | 2022-05-19 | Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /classes/master.php?f=delete_ Facility. |
CVE-2022-28962 | Critical | 9.8 | 2022-05-19 | Online Sports Complex Booking System 1.0 is vulnerable to SQL Injection via /scbs/classes/Users.php?f=delete_client. |
CVE-2022-28961 | High | 8.8 | 2022-05-19 | Spip Web Framework v3.1.13 and below was discovered to contain multiple SQL injection vulnerabilities at /ecrire via the lier_trad and where parameters. |