2022 CVEs (page 223)
Page 223 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-21437 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exp… |
CVE-2022-21436 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exp… |
CVE-2022-21435 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exp… |
CVE-2022-21434 | Medium | 5.3 | 2022-04-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affected a… |
CVE-2022-21431 | Critical | 10.0 | 2022-04-19 | Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Suppor… |
CVE-2022-21430 | High | 8.5 | 2022-04-19 | Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Suppor… |
CVE-2022-21427 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and pr… |
CVE-2022-21426 | Medium | 5.3 | 2022-04-19 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JAXP). Supported versions that are affected are Or… |
CVE-2022-21425 | Medium | 5.5 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). Supported versions that are affected are 8.0.28 and prior. Easily exploitab… |
CVE-2022-21424 | High | 8.3 | 2022-04-19 | Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). The su… |
CVE-2022-21423 | Low | 2.7 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.28 and prior. Easily exploitable vu… |
CVE-2022-21422 | High | 7.5 | 2022-04-19 | Vulnerability in the Oracle Communications Billing and Revenue Management product of Oracle Communications Applications (component: Connection Manager). Suppor… |
CVE-2022-21421 | High | 7.5 | 2022-04-19 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions… |
CVE-2022-21420 | Critical | 9.8 | 2022-04-19 | Vulnerability in the Oracle Coherence product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0, 12.2.1.4.0 an… |
CVE-2022-21419 | Medium | 6.1 | 2022-04-19 | Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). Supported versions that… |
CVE-2022-21418 | Medium | 5.0 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 8.0.28 and prior. Difficult to exploit… |
CVE-2022-21417 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). Supported versions that are affected are 5.7.37 and prior and 8.0.28 and prior… |
CVE-2022-21416 | Medium | 5.0 | 2022-04-19 | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). The supported version that is affected is 11. Easily exploitable vulnerabil… |
CVE-2022-21415 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 8.0.28 and prior. Easily e… |
CVE-2022-21414 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exp… |
CVE-2022-21413 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). Supported versions that are affected are 8.0.28 and prior. Easily exploitab… |
CVE-2022-21412 | Medium | 4.9 | 2022-04-19 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.28 and prior. Easily exp… |
CVE-2022-21411 | Medium | 5.4 | 2022-04-19 | Vulnerability in the RDBMS Gateway / Generic ODBC Connectivity component of Oracle Database Server. Supported versions that are affected are 12.1.0.2, 19c and… |
CVE-2022-21410 | High | 7.2 | 2022-04-19 | Vulnerability in the Oracle Database - Enterprise Edition Sharding component of Oracle Database Server. The supported version that is affected is 19c. Easily e… |
CVE-2022-21409 | Medium | 6.1 | 2022-04-19 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime). The supported version that is affected is Prior to 9… |
CVE-2022-21405 | Medium | 5.5 | 2022-04-19 | Vulnerability in the OSS Support Tools product of Oracle Support Tools (component: Oracle Explorer). The supported version that is affected is 18.3. Easily exp… |
CVE-2022-21404 | High | 8.1 | 2022-04-19 | Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Reactive WebServer). Supported versions that are affected are 1.4.10 and 2.0.0-RC1… |
CVE-2022-1385 | Low | 3.7 | 2022-04-19 | Mattermost 6.4.x and earlier fails to properly invalidate pending email invitations when the action is performed from the system console, which allows accident… |
CVE-2022-1384 | Medium | 4.7 | 2022-04-19 | Mattermost version 6.4.x and earlier fails to properly check the plugin version when a plugin is installed from the Marketplace, which allows an authenticated… |
CVE-2022-1329 | High | 8.8 | 2022-04-19 | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/c… |
CVE-2022-1187 | Medium | 6.1 | 2022-04-19 | The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticat… |
CVE-2022-1186 | Medium | 5.3 | 2022-04-19 | The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API rout… |
CVE-2022-1119 | High | 7.5 | 2022-04-19 | The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to m… |
CVE-2022-1019 | Medium | 5.2 | 2022-04-19 | Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously… |
CVE-2022-0993 | High | 8.1 | 2022-04-19 | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to… |
CVE-2022-0992 | Critical | 9.8 | 2022-04-19 | The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to… |
CVE-2022-24825 | Medium | 5.8 | 2022-04-19 | Smokescreen is a simple HTTP proxy that fogs over naughty URLs. The primary use case for Smokescreen is to prevent server-side request forgery (SSRF) attacks i… |
CVE-2022-27104 | Critical | 9.8 | 2022-04-19 | An Unauthenticated time-based blind SQL injection vulnerability exists in Forma LMS prior to v.1.4.3. |
CVE-2022-27055 | High | 7.5 | 2022-04-19 | ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new en… |
CVE-2022-25648 | High | 8.1 | 2022-04-19 | The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, th… |
CVE-2022-29153 | High | 7.5 | 2022-04-19 | HashiCorp Consul and Consul Enterprise up to 1.9.16, 1.10.9, and 1.11.4 may allow server side request forgery when the Consul client agent follows redirects re… |
CVE-2022-29315 | High | 8.8 | 2022-04-19 | Invicti Acunetix before 14 allows CSV injection via the Description field on the Add Targets page, if the Export CSV feature is used. |
CVE-2022-27927 | Critical | 9.8 | 2022-04-19 | A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. An attacker can issue SQL comm… |
CVE-2022-26595 | Medium | 4.3 | 2022-04-19 | Liferay Portal 7.3.7, 7.4.0, and 7.4.1, and Liferay DXP 7.2 fix pack 13, and 7.3 fix pack 2 does not properly check user permission when accessing a list of si… |
CVE-2022-26593 | Medium | 5.4 | 2022-04-19 | Cross-site scripting (XSS) vulnerability in the Asset module's asset categories selector in Liferay Portal 7.3.3 through 7.4.0, and Liferay DXP 7.3 before serv… |
CVE-2022-0645 | Medium | 6.1 | 2022-04-19 | Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1. |
CVE-2022-1065 | High | 8.1 | 2022-04-19 | A vulnerability within the authentication process of Abacus ERP allows a remote attacker to bypass the second authentication factor. This issue affects: Abacus… |
CVE-2022-28108 | High | 8.8 | 2022-04-19 | Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/… |
CVE-2022-29464 | Critical | 9.8 | 2022-04-18 | Certain WSO2 products allow unrestricted file upload with resultant remote code execution. The attacker must use a /fileupload endpoint with a Content-Disposit… |
CVE-2022-24841 | Medium | 6.5 | 2022-04-18 | fleetdm/fleet is an open source device management, built on osquery. All versions of fleet making use of the teams feature are affected by this authorization b… |
CVE-2022-29458 | High | 7.1 | 2022-04-18 | ncurses 6.3 before patch 20220416 has an out-of-bounds read and segmentation violation in convert_strings in tinfo/read_entry.c in the terminfo library. |
CVE-2022-29457 | High | 8.8 | 2022-04-18 | Zoho ManageEngine ADSelfService Plus before 6121, ADAuditPlus 7060, Exchange Reporter Plus 5701, and ADManagerPlus 7131 allow NTLM Hash disclosure during certa… |
CVE-2022-24863 | High | 7.5 | 2022-04-18 | http-swagger is an open source wrapper to automatically generate RESTful API documentation with Swagger 2.0. In versions of http-swagger prior to 1.2.6 an atta… |
CVE-2022-24859 | Medium | 6.2 | 2022-04-18 | PyPDF2 is an open source python PDF library capable of splitting, merging, cropping, and transforming the pages of PDF files. In versions prior to 1.27.5 an at… |
CVE-2022-1112 | Medium | 5.4 | 2022-04-18 | The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as escape them, which… |
CVE-2022-1091 | Medium | 6.1 | 2022-04-18 | The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploit… |
CVE-2022-1090 | Medium | 4.8 | 2022-04-18 | The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perfo… |
CVE-2022-1088 | Medium | 4.8 | 2022-04-18 | The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2022-1063 | Medium | 4.8 | 2022-04-18 | The Thank Me Later WordPress plugin through 3.3.4 does not sanitise and escape the Message Subject field before outputting it in the Messages list, which could… |
CVE-2022-1054 | Medium | 5.3 | 2022-04-18 | The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export functi… |
CVE-2022-1037 | High | 7.2 | 2022-04-18 | The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local U… |
CVE-2022-1020 | Critical | 9.8 | 2022-04-18 | The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_op… |
CVE-2022-1001 | Medium | 4.8 | 2022-04-18 | The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not sanitise and escape… |
CVE-2022-0994 | Medium | 4.8 | 2022-04-18 | The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cr… |
CVE-2022-0879 | Medium | 6.1 | 2022-04-18 | The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Refle… |
CVE-2022-0785 | Critical | 9.8 | 2022-04-18 | The Daily Prayer Time WordPress plugin before 2022.03.01 does not sanitise and escape the month parameter before using it in a SQL statement via the get_monthl… |
CVE-2022-0780 | Medium | 6.1 | 2022-04-18 | The SearchIQ WordPress plugin before 3.9 contains a flag to disable the verification of CSRF nonces, granting unauthenticated attackers access to the siq_ajax… |
CVE-2022-0765 | Medium | 5.4 | 2022-04-18 | The Loco Translate WordPress plugin before 2.6.1 does not properly remove inline events from elements in the source translation strings before outputting them… |
CVE-2022-0737 | Medium | 4.8 | 2022-04-18 | The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripti… |
CVE-2022-0707 | Medium | 4.3 | 2022-04-18 | The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a… |
CVE-2022-0706 | Medium | 4.8 | 2022-04-18 | The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege… |
CVE-2022-0661 | High | 7.2 | 2022-04-18 | The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user… |
CVE-2022-27853 | Medium | 4.8 | 2022-04-18 | Authenticated (author or higher role) Stored Cross-Site Scripting (XSS) in Contest Gallery (WordPress plugin) <= 13.1.0.9 |
CVE-2022-27652 | Medium | 5.3 | 2022-04-18 | A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) wher… |
CVE-2022-27530 | High | 7.8 | 2022-04-18 | A maliciously crafted TIF or PICT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to write beyond the allocated buffer through Buffer overflow vuln… |
CVE-2022-27529 | High | 7.8 | 2022-04-18 | A maliciously crafted PICT, BMP, PSD or TIF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 may be used to write beyond the allocated buffer while parsing PICT… |
CVE-2022-27526 | High | 7.8 | 2022-04-18 | A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunctio… |
CVE-2022-27525 | High | 7.8 | 2022-04-18 | A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violatio… |
CVE-2022-25226 | Critical | 10.0 | 2022-04-18 | ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID w… |
CVE-2022-23976 | High | 8.1 | 2022-04-18 | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media). |
CVE-2022-23975 | Medium | 6.5 | 2022-04-18 | Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin. |
CVE-2022-1341 | High | 7.5 | 2022-04-18 | An issue was discovered in in bwm-ng v0.6.2. An arbitrary null write exists in get_cmdln_options() function in src/options.c. |
CVE-2022-26665 | High | 7.5 | 2022-04-18 | An Insecure Direct Object Reference issue exists in the Tyler Odyssey Portal platform before 17.1.20. This may allow an external party to access sensitive case… |
CVE-2022-26631 | Critical | 9.8 | 2022-04-18 | Automatic Question Paper Generator v1.0 contains a Time-Based Blind SQL injection vulnerability via the id GET parameter. |
CVE-2022-28810 | Medium | 6.8 | 2022-04-18 | Zoho ManageEngine ADSelfService Plus before build 6122 allows a remote authenticated administrator to execute arbitrary operating OS commands as SYSTEM via the… |
CVE-2022-27908 | High | 8.8 | 2022-04-18 | Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module. |
CVE-2022-1383 | Medium | 6.1 | 2022-04-18 | Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.8. The bug causes the program reads data past the end of the intented buffer. Ty… |
CVE-2022-1382 | Medium | 5.5 | 2022-04-18 | NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of making the radare2 crash, thus affecting the a… |
CVE-2022-1381 | High | 7.8 | 2022-04-18 | global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software, Bypass Protection… |
CVE-2022-28966 | Medium | 5.5 | 2022-04-16 | Wasm3 0.5.0 has a heap-based buffer overflow in NewCodePage in m3_code.c (called indirectly from Compile_BranchTable in m3_compile.c). |
CVE-2022-26777 | Medium | 5.3 | 2022-04-16 | Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view license details. |
CVE-2022-26653 | Medium | 5.3 | 2022-04-16 | Zoho ManageEngine Remote Access Plus before 10.1.2137.15 allows guest users to view domain details (such as the username and GUID of an administrator). |
CVE-2022-1380 | Medium | 5.4 | 2022-04-16 | Stored Cross Site Scripting vulnerability in Item name parameter in GitHub repository snipe/snipe-it prior to v5.4.3. The vulnerability is capable of stolen th… |
CVE-2022-29287 | Medium | 4.9 | 2022-04-16 | Kentico CMS before 13.0.66 has an Insecure Direct Object Reference vulnerability. It allows an attacker with user management rights (default is Administrator)… |
CVE-2022-29020 | Medium | 6.1 | 2022-04-16 | ForestBlog through 2022-02-16 allows admin/profile/save userAvatar XSS during addition of a user avatar. |
CVE-2022-1365 | Medium | 6.5 | 2022-04-15 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository lquixada/cross-fetch prior to 3.1.5. |
CVE-2022-29281 | High | 8.8 | 2022-04-15 | Notable before 1.9.0-beta.8 doesn't effectively prevent the opening of executable files when clicking on a link. There is improper validation of the file URI s… |
CVE-2022-29072 | High | 7.8 | 2022-04-15 | 7-Zip through 21.07 on Windows allows privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This… |
CVE-2022-27426 | High | 8.8 | 2022-04-15 | A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a cra… |
CVE-2022-27425 | Medium | 6.1 | 2022-04-15 | Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php. |