2022 CVEs (page 219)
Page 219 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28060 | High | 7.5 | 2022-04-28 | SQL Injection vulnerability in Victor CMS v1.0, via the user_name parameter to /includes/login.php. |
CVE-2022-24898 | Medium | 4.9 | 2022-04-28 | org.xwiki.commons:xwiki-commons-xml is a common module used by other XWiki top level projects. Starting in version 2.7 and prior to versions 12.10.10, 13.4.4… |
CVE-2022-29413 | Medium | 4.7 | 2022-04-28 | Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress via &title parameter. |
CVE-2022-29412 | Medium | 5.4 | 2022-04-28 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allow attackers to delete cache, delete a source, creat… |
CVE-2022-29411 | High | 8.3 | 2022-04-28 | SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers to execute SQLi attack via (&id). |
CVE-2022-29410 | High | 7.4 | 2022-04-28 | Authenticated SQL Injection (SQLi) vulnerability in Mufeng's Hermit 音乐播放器 plugin <= 3.1.6 on WordPress allows attackers with Subscriber or higher user roles to… |
CVE-2022-29585 | High | 7.5 | 2022-04-28 | In Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0, a site using Isolated Institutions is vulnerable if more than ten groups are used. They are all shown… |
CVE-2022-29584 | Medium | 5.4 | 2022-04-28 | Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 allows stored XSS when a particular Cascading Style Sheets (CSS) class for embedly is used, and JavaScript… |
CVE-2022-29415 | Medium | 6.1 | 2022-04-28 | Unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability in Mati Skiba @ Rav Messer's Ravpage plugin <= 2.16 at WordPress. |
CVE-2022-28892 | High | 8.8 | 2022-04-28 | Mahara before 20.10.5, 21.04.4, 21.10.2, and 22.04.0 is vulnerable to Cross Site Request Forgery (CSRF) because randomly generated tokens are too easily guessa… |
CVE-2022-27860 | Medium | 6.1 | 2022-04-28 | Cross-Site Request Forgery (CSRF) leading to Cross-Site Scripting (XSS) in Shea Bunge's Footer Text plugin <= 2.0.3 on WordPress. |
CVE-2022-22443 | Medium | 5.4 | 2022-04-28 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-22441 | Medium | 6.5 | 2022-04-28 | IBM InfoSphere Information Server 11.7 could allow an authenticated user to view information of higher privileged users and groups due to a privilege escalatio… |
CVE-2022-22427 | Medium | 6.1 | 2022-04-28 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-22322 | Medium | 5.4 | 2022-04-28 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-1514 | Medium | 5.4 | 2022-04-28 | Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have… |
CVE-2022-28117 | Medium | 4.9 | 2022-04-28 | A Server-Side Request Forgery (SSRF) in feed_parser class of Navigate CMS v2.9.4 allows remote attackers to force the application to make arbitrary requests vi… |
CVE-2022-28114 | Critical | 9.1 | 2022-04-28 | DSCMS v3.0 was discovered to contain an arbitrary file deletion vulnerability via /controller/Adv.php. |
CVE-2022-24892 | Medium | 6.4 | 2022-04-28 | Shopware is an open source e-commerce software platform. Starting with version 5.0.4 and before version 5.7.9, multiple tokens for password reset can be reques… |
CVE-2022-24879 | High | 7.5 | 2022-04-28 | Shopware is an open source e-commerce software platform. Versions prior to 5.7.9 are vulnerable to malfunction of cross-site request forgery (CSRF) token valid… |
CVE-2022-22783 | Medium | 6.5 | 2022-04-28 | A vulnerability in Zoom On-Premise Meeting Connector Controller version 4.8.102.20220310 and On-Premise Meeting Connector MMR version 4.8.102.20220310 exposes… |
CVE-2022-22782 | High | 7.9 | 2022-04-28 | The Zoom Client for Meetings for Windows prior to version 5.9.7, Zoom Rooms for Conference Room for Windows prior to version 5.10.0, Zoom Plugins for Microsoft… |
CVE-2022-22781 | High | 7.5 | 2022-04-28 | The Zoom Client for Meetings for MacOS (Standard and for IT Admin) prior to version 5.9.6 failed to properly check the package version during the update proces… |
CVE-2022-1511 | Medium | 6.5 | 2022-04-28 | Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4. |
CVE-2022-28102 | Medium | 5.4 | 2022-04-28 | A cross-site scripting (XSS) vulnerability in PHP MySQL Admin Panel Generator v1 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2022-28101 | Critical | 9.0 | 2022-04-28 | Turtlapp Turtle Note v0.7.2.6 does not filter the <meta> tag during markdown parsing, allowing attackers to execute HTML injection. |
CVE-2022-24873 | Medium | 5.4 | 2022-04-28 | Shopware is an open source e-commerce software platform. Prior to version 5.7.9, Shopware is vulnerable to non-stored cross-site scripting in the storefront. T… |
CVE-2022-29152 | Medium | 6.1 | 2022-04-28 | The Ericom PowerTerm WebConnect 6.0 login portal can unsafely write an XSS payload from the AppPortal cookie into the page. |
CVE-2022-24935 | High | 7.5 | 2022-04-28 | Lexmark products through 2022-02-10 have Incorrect Access Control. |
CVE-2022-29821 | Medium | 6.9 | 2022-04-28 | In JetBrains Rider before 2022.1 local code execution via links in ReSharper Quick Documentation was possible |
CVE-2022-29820 | Low | 3.0 | 2022-04-28 | In JetBrains PyCharm before 2022.1 exposure of the debugger port to the internal network was possible |
CVE-2022-29819 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via links in Quick Documentation was possible |
CVE-2022-29818 | Low | 3.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 origin checks in the internal web server were flawed |
CVE-2022-29817 | Low | 3.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 reflected XSS via error messages in internal web server was possible |
CVE-2022-29816 | Low | 2.8 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 HTML injection into IDE messages was possible |
CVE-2022-29815 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via workspace settings was possible |
CVE-2022-29814 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via HTML descriptions in custom JSON schemas was possible |
CVE-2022-29813 | Medium | 6.9 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 local code execution via custom Pandoc path was possible |
CVE-2022-29812 | Low | 2.3 | 2022-04-28 | In JetBrains IntelliJ IDEA before 2022.1 notification mechanisms about using Unicode directionality formatting characters were insufficient |
CVE-2022-29811 | Medium | 6.1 | 2022-04-28 | In JetBrains Hub before 2022.1.14638 stored XSS via project icon was possible. |
CVE-2022-1509 | Critical | 9.9 | 2022-04-28 | Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitr… |
CVE-2022-28719 | Critical | 9.8 | 2022-04-28 | Missing authentication for critical function in AssetView prior to Ver.13.2.0 allows a remote unauthenticated attacker with some knowledge on the system config… |
CVE-2022-29869 | Medium | 5.3 | 2022-04-28 | cifs-utils through 6.14, with verbose logging, can cause an information leak when a file contains = (equal sign) characters but is not a valid credentials file. |
CVE-2022-29859 | Critical | 9.8 | 2022-04-27 | component/common/network/dhcp/dhcps.c in ambiot amb1_sdk (aka SDK for Ameba1) before 2022-03-11 mishandles data structures for DHCP packet data. |
CVE-2022-24891 | Medium | 5.4 | 2022-04-27 | ESAPI (The OWASP Enterprise Security API) is a free, open source, web application security control library. Prior to version 2.3.0.0, there is a potential for… |
CVE-2022-24736 | Low | 3.3 | 2022-04-27 | Redis is an in-memory database that persists on disk. Prior to versions 6.2.7 and 7.0.0, an attacker attempting to load a specially crafted Lua script can caus… |
CVE-2022-24735 | Low | 3.9 | 2022-04-27 | Redis is an in-memory database that persists on disk. By exploiting weaknesses in the Lua script execution environment, an attacker with access to Redis prior… |
CVE-2022-28197 | Medium | 5.0 | 2022-04-27 | NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_mount function, where Insufficient validation of untrusted data may allow a highl… |
CVE-2022-28196 | Medium | 4.6 | 2022-04-27 | NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot blob_decompress function, where insufficient validation of untrusted data may allow a… |
CVE-2022-28195 | Medium | 5.7 | 2022-04-27 | NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot ext4_read_file function, where insufficient validation of untrusted data may allow a h… |
CVE-2022-28194 | High | 7.3 | 2022-04-27 | NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c, where, if TFTP is enabled, a local attacker with elevated privil… |
CVE-2022-28193 | Medium | 5.6 | 2022-04-27 | NVIDIA Jetson Linux Driver Package contains a vulnerability in the Cboot module tegrabl_cbo.c, where insufficient validation of untrusted data may allow a loca… |
CVE-2022-24372 | Medium | 4.6 | 2022-04-27 | Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share. |
CVE-2022-22315 | High | 8.8 | 2022-04-27 | IBM UrbanCode Deploy (UCD) 7.2.2.1 could allow an authenticated user with special permissions to obtain elevated privileges due to improper handling of permiss… |
CVE-2022-23822 | Medium | 6.8 | 2022-04-27 | In this physical attack, an attacker may potentially exploit the Zynq-7000 SoC First Stage Boot Loader (FSBL) by bypassing authentication and loading a malicio… |
CVE-2022-22278 | High | 7.5 | 2022-04-27 | A vulnerability in SonicOS CFS (Content filtering service) returns a large 403 forbidden HTTP response message to the source address when users try to access p… |
CVE-2022-22277 | Medium | 5.3 | 2022-04-27 | A vulnerability in SonicOS SNMP service resulting exposure of Wireless Access Point sensitive information in cleartext. |
CVE-2022-22276 | Medium | 5.3 | 2022-04-27 | A vulnerability in SonicOS SNMP service resulting exposure of sensitive information to an unauthorized user. |
CVE-2022-22275 | High | 7.5 | 2022-04-27 | Improper Restriction of TCP Communication Channel in HTTP/S inbound traffic from WAN to DMZ bypassing security policy until TCP handshake potentially resulting… |
CVE-2022-1507 | Medium | 5.5 | 2022-04-27 | chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted inp… |
CVE-2022-27336 | Critical | 9.8 | 2022-04-27 | Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php. |
CVE-2022-22521 | High | 7.3 | 2022-04-27 | In Miele Benchmark Programming Tool with versions Prior to 1.2.71, executable files manipulated by attackers are unknowingly executed with users privileges. An… |
CVE-2022-22345 | Medium | 4.8 | 2022-04-27 | IBM QRadar 7.3, 7.4, and 7.5 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alter… |
CVE-2022-22323 | Medium | 6.5 | 2022-04-27 | IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of service, caused by a heap… |
CVE-2022-22312 | Medium | 6.5 | 2022-04-27 | IBM Security Identity Manager (IBM Security Verify Password Synchronization Plug-in for Windows AD 10.x) is vulnerable to a denial of service, caused by a heap… |
CVE-2022-29505 | High | 7.8 | 2022-04-27 | Due to build misconfiguration in openssl dependency, LINE for Windows before 7.8 is vulnerable to DLL injection that could lead to privilege escalation. |
CVE-2022-24889 | Low | 2.4 | 2022-04-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 21.0.8, 22.2.4, and 23.0.1, it is possible t… |
CVE-2022-24888 | Medium | 4.3 | 2022-04-27 | Nextcloud Server is the file server software for Nextcloud, a self-hosted productivity platform. Prior to versions 20.0.14.4, 21.0.8, 22.2.4, and 23.0.1, it is… |
CVE-2022-28464 | Critical | 9.0 | 2022-04-27 | Apifox through 2.1.6 is vulnerable to Cross Site Scripting (XSS) which can lead to remote code execution. |
CVE-2022-27905 | High | 7.2 | 2022-04-27 | In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of… |
CVE-2022-27239 | High | 7.8 | 2022-04-27 | In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root priv… |
CVE-2022-24887 | Medium | 4.3 | 2022-04-27 | Nextcloud Talk is a video and audio conferencing app for Nextcloud, a self-hosted productivity platform. Prior to versions 11.3.4, 12.2.2, and 13.0.0, when sha… |
CVE-2022-24886 | Low | 2.2 | 2022-04-27 | Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. In versions prior to 3.19.0, any application with notification… |
CVE-2022-24885 | Low | 2.0 | 2022-04-27 | Nextcloud Android app is the Android client for Nextcloud, a self-hosted productivity platform. Prior to version 3.19.1, users can bypass a lock on the Nextclo… |
CVE-2022-1504 | Medium | 6.1 | 2022-04-27 | XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks. |
CVE-2022-1503 | Low | 3.5 | 2022-04-27 | A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module… |
CVE-2022-29810 | Medium | 5.5 | 2022-04-27 | The Hashicorp go-getter library before 1.5.11 does not redact an SSH key from a URL query parameter. |
CVE-2022-29701 | High | 7.5 | 2022-04-27 | A lack of rate limiting in the 'forgot password' feature of Zammad v5.1.0 allows attackers to send an excessive amount of reset requests for a legitimate user… |
CVE-2022-29700 | High | 7.5 | 2022-04-27 | A lack of password length restriction in Zammad v5.1.0 allows for the creation of extremely long passwords which can cause a Denial of Service (DoS) during pas… |
CVE-2022-28085 | High | 7.8 | 2022-04-27 | A flaw was found in htmldoc commit 31f7804. A heap buffer overflow in the function pdf_write_names in ps-pdf.cxx may lead to arbitrary code execution and Denia… |
CVE-2022-27332 | Critical | 9.1 | 2022-04-27 | An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers… |
CVE-2022-27331 | Medium | 4.3 | 2022-04-27 | An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settin… |
CVE-2022-27888 | Medium | 5.5 | 2022-04-26 | Foundry Issues service versions 2.244.0 to 2.249.0 was found to be logging in a manner that captured sensitive information (session tokens). This issue was fix… |
CVE-2022-26564 | Medium | 6.1 | 2022-04-26 | HotelDruid Hotel Management Software v3.0.3 contains a cross-site scripting (XSS) vulnerability via the prezzoperiodo4 parameter in creaprezzi.php. |
CVE-2022-28918 | High | 8.1 | 2022-04-26 | GreenCMS v2.3.0603 was discovered to contain an arbitrary file deletion vulnerability via /index.php?m=admin&c=custom&a=plugindelhandle&plugin_name=. |
CVE-2022-28528 | High | 8.8 | 2022-04-26 | bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?mode=content&page=media&action=edit. |
CVE-2022-28527 | High | 8.1 | 2022-04-26 | dhcms v20170919 was discovered to contain an arbitrary folder deletion vulnerability via /admin.php?r=admin/AdminBackup/del. |
CVE-2022-28525 | High | 8.8 | 2022-04-26 | ED01-CMS v20180505 was discovered to contain an arbitrary file upload vulnerability via /admin/users.php?source=edit_user&id=1. |
CVE-2022-28524 | Critical | 9.8 | 2022-04-26 | ED01-CMS v20180505 was discovered to contain a SQL injection vulnerability via the component post.php. |
CVE-2022-28523 | High | 8.1 | 2022-04-26 | HongCMS 3.0.0 allows arbitrary file deletion via the component /admin/index.php/template/ajax?action=delete. |
CVE-2022-28522 | Medium | 5.4 | 2022-04-26 | ZCMS v20170206 was discovered to contain a stored cross-site scripting (XSS) vulnerability via index.php?m=home&c=message&a=add. |
CVE-2022-28521 | Critical | 9.8 | 2022-04-26 | ZCMS v20170206 was discovered to contain a file inclusion vulnerability via index.php?m=home&c=home&a=sp_set_config. |
CVE-2022-28450 | Medium | 5.4 | 2022-04-26 | nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS) via the "Text" parameter (forums) when creating a new post, which allows a remote attacker to ex… |
CVE-2022-28449 | Medium | 6.1 | 2022-04-26 | nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). At Apply for vendor account feature, an attacker can upload an arbitrary file to the system. |
CVE-2022-28059 | High | 8.1 | 2022-04-26 | Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\database_controller.php. |
CVE-2022-28058 | High | 8.1 | 2022-04-26 | Verydows v2.0 was discovered to contain an arbitrary file deletion vulnerability via \backend\file_controller.php. |
CVE-2022-28448 | Medium | 5.4 | 2022-04-26 | nopCommerce 4.50.1 is vulnerable to Cross Site Scripting (XSS). An attacker (role customer) can inject javascript code to First name or Last name at Customer I… |
CVE-2022-27854 | Medium | 5.4 | 2022-04-26 | Stored Cross-Site Scripting (XSS) vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin <= 0.21.19 on WordPress possible for users with c… |
CVE-2022-24866 | Medium | 4.3 | 2022-04-26 | Discourse Assign is a plugin for assigning users to a topic in Discourse, an open-source messaging platform. Prior to version 1.0.1, the UserBookmarkSerializer… |
CVE-2022-1466 | Medium | 6.5 | 2022-04-26 | Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to… |