2022 CVEs (page 232)
Page 232 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-26615 | Medium | 5.4 | 2022-04-05 | A cross-site scripting (XSS) vulnerability in College Website Content Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a cr… |
CVE-2022-26281 | High | 7.5 | 2022-04-05 | BigAnt Server v5.6.06 was discovered to contain an incorrect access control issue. |
CVE-2022-25356 | Medium | 5.3 | 2022-04-05 | Alt-N MDaemon Security Gateway through 8.5.0 allows SecurityGateway.dll?view=login XML Injection. |
CVE-2022-24231 | Critical | 9.8 | 2022-04-05 | Simple Student Information System v1.0 was discovered to contain a SQL injection vulnerability via add/Student. |
CVE-2022-26619 | High | 7.5 | 2022-04-05 | Halo Blog CMS v1.4.17 was discovered to allow attackers to upload arbitrary files via the Attachment Upload function. |
CVE-2022-26585 | Critical | 9.8 | 2022-04-05 | Mingsoft MCMS v5.2.7 was discovered to contain a SQL injection vulnerability via /cms/content/list. |
CVE-2022-25584 | High | 7.5 | 2022-04-05 | Seyeon Tech Co., Ltd FlexWATCH FW3170-PS-E Network Video System 4.23-3000_GY allows attackers to access sensitive information. |
CVE-2022-0809 | High | 8.8 | 2022-04-05 | Out of bounds memory access in WebXR in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… |
CVE-2022-0808 | High | 8.8 | 2022-04-05 | Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in a series of u… |
CVE-2022-0807 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Autofill in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass navigation restrictions via a crafted HTML… |
CVE-2022-0806 | Medium | 6.5 | 2022-04-05 | Data leak in Canvas in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in screen sharing to potentially leak cross… |
CVE-2022-0805 | High | 8.8 | 2022-04-05 | Use after free in Browser Switcher in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction… |
CVE-2022-0804 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibo… |
CVE-2022-0803 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Permissions in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to tamper with the contents of the Omnibox (URL ba… |
CVE-2022-0802 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Full screen mode in Google Chrome on Android prior to 99.0.4844.51 allowed a remote attacker to hide the contents of the Omnibo… |
CVE-2022-0800 | High | 8.8 | 2022-04-05 | Heap buffer overflow in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to… |
CVE-2022-0799 | High | 8.8 | 2022-04-05 | Insufficient policy enforcement in Installer in Google Chrome on Windows prior to 99.0.4844.51 allowed a remote attacker to perform local privilege escalation… |
CVE-2022-0798 | High | 8.8 | 2022-04-05 | Use after free in MediaStream in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension to potentially e… |
CVE-2022-0797 | High | 8.8 | 2022-04-05 | Out of bounds memory access in Mojo in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform an out of bounds memory write via a crafted HTM… |
CVE-2022-0796 | High | 8.8 | 2022-04-05 | Use after free in Media in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0795 | High | 8.8 | 2022-04-05 | Type confusion in Blink Layout in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0794 | High | 8.8 | 2022-04-05 | Use after free in WebShare in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to pote… |
CVE-2022-0793 | High | 8.8 | 2022-04-05 | Use after free in Cast in Google Chrome prior to 99.0.4844.51 allowed an attacker who convinced a user to install a malicious extension and engage in specific… |
CVE-2022-0792 | Medium | 6.5 | 2022-04-05 | Out of bounds read in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0791 | High | 8.8 | 2022-04-05 | Use after free in Omnibox in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interactions to pote… |
CVE-2022-0790 | Critical | 9.6 | 2022-04-05 | Use after free in Cast UI in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific user interaction to poten… |
CVE-2022-0789 | High | 8.8 | 2022-04-05 | Heap buffer overflow in ANGLE in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0470 | High | 8.8 | 2022-04-05 | Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2022-0469 | High | 8.8 | 2022-04-05 | Use after free in Cast in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific interactions to potentially… |
CVE-2022-0468 | High | 8.8 | 2022-04-05 | Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0467 | High | 8.8 | 2022-04-05 | Inappropriate implementation in Pointer Lock in Google Chrome on Windows prior to 98.0.4758.80 allowed a remote attacker to bypass navigation restrictions via… |
CVE-2022-0466 | Critical | 9.6 | 2022-04-05 | Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to install a malicious exte… |
CVE-2022-0465 | High | 8.8 | 2022-04-05 | Use after free in Extensions in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via user interaction. |
CVE-2022-0464 | High | 8.8 | 2022-04-05 | Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to… |
CVE-2022-0463 | High | 8.8 | 2022-04-05 | Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to… |
CVE-2022-0462 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page. |
CVE-2022-0461 | Medium | 6.5 | 2022-04-05 | Policy bypass in COOP in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to bypass iframe sandbox via a crafted HTML page. |
CVE-2022-0460 | High | 8.8 | 2022-04-05 | Use after free in Window Dialogue in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2022-0459 | High | 8.8 | 2022-04-05 | Use after free in Screen Capture in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process and convinced a user… |
CVE-2022-0458 | High | 8.8 | 2022-04-05 | Use after free in Thumbnail Tab Strip in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTM… |
CVE-2022-0457 | High | 8.8 | 2022-04-05 | Type confusion in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0456 | High | 8.8 | 2022-04-05 | Use after free in Web Search in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via profile destruction. |
CVE-2022-0455 | Medium | 6.5 | 2022-04-05 | Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the contents of the Omnib… |
CVE-2022-0454 | High | 8.8 | 2022-04-05 | Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0453 | High | 8.8 | 2022-04-05 | Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2022-0452 | Critical | 9.6 | 2022-04-05 | Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML pag… |
CVE-2022-23732 | High | 8.8 | 2022-04-05 | A path traversal vulnerability was identified in GitHub Enterprise Server management console that allowed the bypass of CSRF protections. This could potentiall… |
CVE-2022-0610 | High | 8.8 | 2022-04-05 | Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2022-0609 | High | 8.8 | 2022-04-05 | Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0608 | High | 8.8 | 2022-04-05 | Integer overflow in Mojo in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0607 | High | 8.8 | 2022-04-05 | Use after free in GPU in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0606 | High | 8.8 | 2022-04-05 | Use after free in ANGLE in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. |
CVE-2022-0605 | High | 8.8 | 2022-04-05 | Use after free in Webstore API in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and convinced… |
CVE-2022-0604 | High | 8.8 | 2022-04-05 | Heap buffer overflow in Tab Groups in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and engage… |
CVE-2022-0603 | High | 8.8 | 2022-04-05 | Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a craf… |
CVE-2022-27442 | High | 7.5 | 2022-04-04 | TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password. |
CVE-2022-27441 | Medium | 4.8 | 2022-04-04 | A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into t… |
CVE-2022-27651 | Medium | 6.8 | 2022-04-04 | A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where contain… |
CVE-2022-27650 | High | 7.5 | 2022-04-04 | A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where… |
CVE-2022-27649 | High | 7.5 | 2022-04-04 | A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), wh… |
CVE-2022-27609 | Medium | 6.0 | 2022-04-04 | Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows does not provide sufficient anti-tampering protection of services by users with A… |
CVE-2022-27608 | Medium | 6.0 | 2022-04-04 | Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. T… |
CVE-2022-25618 | Low | 3.4 | 2022-04-04 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27 |
CVE-2022-25613 | Medium | 4.1 | 2022-04-04 | Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer… |
CVE-2022-23700 | Medium | 5.5 | 2022-04-04 | A local unauthorized read access to files vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve t… |
CVE-2022-23699 | High | 7.8 | 2022-04-04 | A local authentication restriction bypass vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve t… |
CVE-2022-23698 | High | 7.5 | 2022-04-04 | A remote unauthenticated disclosure of information vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to… |
CVE-2022-23697 | Medium | 6.1 | 2022-04-04 | A remote cross-site scripting (xss) vulnerability was discovered in HPE OneView version(s): Prior to 6.6. HPE has provided a software update to resolve this vu… |
CVE-2022-1233 | Medium | 6.1 | 2022-04-04 | URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11. |
CVE-2022-1190 | High | 8.7 | 2022-04-04 | Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a s… |
CVE-2022-1189 | Low | 3.1 | 2022-04-04 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio… |
CVE-2022-1188 | Low | 3.7 | 2022-04-04 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versio… |
CVE-2022-1185 | Medium | 6.5 | 2022-04-04 | A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to… |
CVE-2022-1175 | High | 8.7 | 2022-04-04 | Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14… |
CVE-2022-1174 | Medium | 4.3 | 2022-04-04 | A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting… |
CVE-2022-1162 | Critical | 9.1 | 2022-04-04 | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. OAuth, LDAP, SAML) in GitLab CE/EE versions 14.7 prior to 14.7.7, 14.8 pr… |
CVE-2022-1148 | Medium | 5.3 | 2022-04-04 | Improper authorization in GitLab Pages included with GitLab CE/EE affecting all versions from 11.5 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14… |
CVE-2022-1121 | Medium | 5.3 | 2022-04-04 | A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an… |
CVE-2022-1120 | Medium | 4.8 | 2022-04-04 | Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive… |
CVE-2022-1111 | Low | 2.4 | 2022-04-04 | A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions… |
CVE-2022-1105 | Medium | 4.3 | 2022-04-04 | An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allo… |
CVE-2022-1100 | Medium | 4.3 | 2022-04-04 | A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9… |
CVE-2022-1099 | Medium | 4.3 | 2022-04-04 | Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an… |
CVE-2022-0740 | Low | 3.1 | 2022-04-04 | Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all ve… |
CVE-2022-26572 | High | 7.5 | 2022-04-04 | Xerox ColorQube 8580 was discovered to contain an access control issue which allows attackers to print, view the status, and obtain sensitive information. |
CVE-2022-25569 | Critical | 9.8 | 2022-04-04 | Bettini Srl GAMS Product Line v4.3.0 was discovered to re-use static SSH keys across installations, allowing unauthenticated attackers to login as root users v… |
CVE-2022-24814 | High | 8.8 | 2022-04-04 | Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.7.0, unauthorized JavaScript (JS) can be executed by insert… |
CVE-2022-24813 | Medium | 5.3 | 2022-04-04 | CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:Re… |
CVE-2022-24801 | High | 8.1 | 2022-04-04 | Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in… |
CVE-2022-24787 | High | 7.5 | 2022-04-04 | Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine. In version 0.3.1 and prior, bytestrings can have dirty bytes in them, resulting i… |
CVE-2022-0990 | Critical | 9.1 | 2022-04-04 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. |
CVE-2022-24785 | High | 7.5 | 2022-04-04 | Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users o… |
CVE-2022-1170 | Medium | 6.1 | 2022-04-04 | In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized G… |
CVE-2022-1169 | Medium | 6.1 | 2022-04-04 | There is a XSS vulnerability in Careerfy. |
CVE-2022-1168 | Medium | 6.1 | 2022-04-04 | There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1. |
CVE-2022-1167 | Medium | 6.1 | 2022-04-04 | There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters. |
CVE-2022-1166 | Medium | 5.3 | 2022-04-04 | The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess… |
CVE-2022-1165 | Critical | 9.1 | 2022-04-04 | The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting t… |
CVE-2022-1164 | Medium | 6.1 | 2022-04-04 | The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature |
CVE-2022-0958 | Medium | 4.8 | 2022-04-04 | The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks e… |