2022 CVEs (page 233)
Page 233 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0901 | Medium | 6.1 | 2022-04-04 | The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to… |
CVE-2022-0887 | High | 7.2 | 2022-04-04 | The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, lead… |
CVE-2022-0884 | Medium | 4.8 | 2022-04-04 | The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such a… |
CVE-2022-0864 | Medium | 6.1 | 2022-04-04 | The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in… |
CVE-2022-0837 | Medium | 5.4 | 2022-04-04 | The Amelia WordPress plugin before 1.0.48 does not have proper authorisation when handling Amelia SMS service, allowing any customer to send paid test SMS noti… |
CVE-2022-0830 | Medium | 6.5 | 2022-04-04 | The FormBuilder WordPress plugin through 1.08 does not have CSRF checks in place when creating/updating and deleting forms, and does not sanitise as well as es… |
CVE-2022-0825 | Medium | 5.4 | 2022-04-04 | The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status… |
CVE-2022-0709 | High | 7.5 | 2022-04-04 | The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned… |
CVE-2022-0537 | High | 7.2 | 2022-04-04 | The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload… |
CVE-2022-0431 | Medium | 6.1 | 2022-04-04 | The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in t… |
CVE-2022-0404 | Medium | 6.5 | 2022-04-04 | The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to… |
CVE-2022-0403 | High | 8.1 | 2022-04-04 | The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (C… |
CVE-2022-1026 | High | 8.6 | 2022-04-04 | Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, th… |
CVE-2022-28063 | Medium | 4.9 | 2022-04-04 | Simple Bakery Shop Management System v1.0 contains a file disclosure via /bsms/?page=products. |
CVE-2022-28062 | High | 8.8 | 2022-04-04 | Car Rental System v1.0 contains an arbitrary file upload vulnerability via the Add Car component which allows attackers to upload a webshell and execute arbitr… |
CVE-2022-27436 | Medium | 4.8 | 2022-04-04 | A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_user at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or… |
CVE-2022-27435 | High | 8.8 | 2022-04-04 | An unrestricted file upload at /public/admin/index.php?add_product of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image comp… |
CVE-2022-26616 | Medium | 6.1 | 2022-04-04 | PKP Vendor Open Journal System v2.4.8 to v3.3.8 allows attackers to perform reflected cross-site scripting (XSS) attacks via crafted HTTP headers. |
CVE-2022-24191 | Medium | 5.5 | 2022-04-04 | In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in a buffer overflow. |
CVE-2022-1225 | Medium | 6.5 | 2022-04-04 | Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6. |
CVE-2022-1224 | Medium | 6.5 | 2022-04-04 | Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6. |
CVE-2022-1223 | Medium | 6.5 | 2022-04-04 | Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6. |
CVE-2022-1222 | Medium | 5.5 | 2022-04-04 | Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV. |
CVE-2022-0939 | Critical | 9.9 | 2022-04-04 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. |
CVE-2022-27249 | High | 8.8 | 2022-04-03 | An unrestricted file upload vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to execute arbitrary code by using UploadDwg to… |
CVE-2022-27248 | Medium | 6.5 | 2022-04-03 | A directory traversal vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to download arbitrary .dwg files from a remote server… |
CVE-2022-26530 | Critical | 9.1 | 2022-04-03 | swaylock before 1.6 allows attackers to trigger a crash and achieve unlocked access to a Wayland compositor. |
CVE-2022-26233 | High | 7.5 | 2022-04-03 | Barco Control Room Management through Suite 2.9 Build 0275 was discovered to be vulnerable to directory traversal, allowing attackers to access sensitive infor… |
CVE-2022-28391 | High | 8.8 | 2022-04-03 | BusyBox through 1.35.0 allows remote attackers to execute arbitrary code if netstat is used to print a DNS PTR record's value to a VT compatible terminal. Alte… |
CVE-2022-28390 | High | 7.8 | 2022-04-03 | ems_usb_start_xmit in drivers/net/can/usb/ems_usb.c in the Linux kernel through 5.17.1 has a double free. |
CVE-2022-28389 | Medium | 5.5 | 2022-04-03 | mcba_usb_start_xmit in drivers/net/can/usb/mcba_usb.c in the Linux kernel through 5.17.1 has a double free. |
CVE-2022-28388 | Medium | 5.5 | 2022-04-03 | usb_8dev_start_xmit in drivers/net/can/usb/usb_8dev.c in the Linux kernel through 5.17.1 has a double free. |
CVE-2022-28381 | Critical | 9.8 | 2022-04-03 | Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 88… |
CVE-2022-0406 | Medium | 4.3 | 2022-04-03 | Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16. |
CVE-2022-0405 | Medium | 4.3 | 2022-04-03 | Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16. |
CVE-2022-28380 | High | 7.5 | 2022-04-03 | The rc-httpd component through 2022-03-31 for 9front (Plan 9 fork) allows ..%2f directory traversal if serve-static is used. |
CVE-2022-28379 | Medium | 6.8 | 2022-04-03 | jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion. |
CVE-2022-28378 | Medium | 6.1 | 2022-04-03 | Craft CMS before 3.7.29 allows XSS. |
CVE-2022-1211 | Medium | 6.3 | 2022-04-03 | A vulnerability classified as critical has been found in tildearrow Furnace dev73. This affects the FUR to VGM converter in console mode which causes stack-bas… |
CVE-2022-1210 | Medium | 4.3 | 2022-04-03 | A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious f… |
CVE-2022-0088 | High | 7.4 | 2022-04-03 | Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3. |
CVE-2022-28376 | High | 8.1 | 2022-04-03 | Verizon 5G Home LVSKIHP outside devices through 2022-02-15 allow anyone (knowing the device's serial number) to access a CPE admin website, e.g., at the 10.0.0… |
CVE-2022-28368 | Critical | 9.8 | 2022-04-03 | Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML input fi… |
CVE-2022-28356 | Medium | 5.5 | 2022-04-02 | In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. |
CVE-2022-28355 | High | 7.5 | 2022-04-02 | randomUUID in Scala.js before 1.10.0 generates predictable values. |
CVE-2022-28352 | Medium | 4.3 | 2022-04-02 | WeeChat (aka Wee Enhanced Environment for Chat) 3.2 to 3.4 before 3.4.1 does not properly verify the TLS certificate of the server, after certain GnuTLS option… |
CVE-2022-1201 | Medium | 6.5 | 2022-04-02 | NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter… |
CVE-2022-27534 | Critical | 9.8 | 2022-04-01 | Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing modul… |
CVE-2022-27177 | Critical | 9.8 | 2022-04-01 | A Python format string issue leading to information disclosure and potentially remote code execution in ConsoleMe for all versions prior to 1.2.2 |
CVE-2022-26419 | High | 7.8 | 2022-04-01 | Omron CX-Position (versions 2.5.3 and prior) is vulnerable to multiple stack-based buffer overflow conditions while parsing a specific project file, which may… |
CVE-2022-26417 | High | 7.8 | 2022-04-01 | Omron CX-Position (versions 2.5.3 and prior) is vulnerable to a use after free memory condition while processing a specific project file, which may allow an at… |
CVE-2022-26022 | High | 7.8 | 2022-04-01 | Omron CX-Position (versions 2.5.3 and prior) is vulnerable to an out-of-bounds write while processing a specific project file, which may allow an attacker to e… |
CVE-2022-25959 | High | 7.8 | 2022-04-01 | Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may allow an attacker to execut… |
CVE-2022-25160 | Medium | 5.9 | 2022-04-01 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F se… |
CVE-2022-25159 | High | 8.1 | 2022-04-01 | Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F serie… |
CVE-2022-25158 | Critical | 9.1 | 2022-04-01 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F se… |
CVE-2022-25157 | Critical | 9.1 | 2022-04-01 | Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electr… |
CVE-2022-25156 | High | 8.1 | 2022-04-01 | Use of Weak Hash vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electric MELSEC iQ-F series FX5UJ CPU all version… |
CVE-2022-25155 | High | 8.1 | 2022-04-01 | Use of Password Hash Instead of Password for Authentication vulnerability in Mitsubishi Electric MELSEC iQ-F series FX5U(C) CPU all versions, Mitsubishi Electr… |
CVE-2022-22965 | Critical | 9.8 | 2022-04-01 | A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires t… |
CVE-2022-22963 | Critical | 9.8 | 2022-04-01 | In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a speciall… |
CVE-2022-22950 | Medium | 6.5 | 2022-04-01 | n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may ca… |
CVE-2022-22570 | Critical | 10.0 | 2022-04-01 | A buffer overflow vulnerability found in the UniFi Door Access Reader Lite’s (UA Lite) firmware (Version 3.8.28.24 and earlier) allows a malicious actor who ha… |
CVE-2022-21830 | Medium | 6.1 | 2022-04-01 | A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance. |
CVE-2022-1159 | High | 7.7 | 2022-04-01 | Rockwell Automation Studio 5000 Logix Designer (all versions) are vulnerable when an attacker who achieves administrator access on a workstation running Studio… |
CVE-2022-1098 | High | 7.8 | 2022-04-01 | Delta Electronics DIAEnergie (all versions prior to 1.8.02.004) are vulnerable to a DLL hijacking condition. When combined with the Incorrect Default Permissio… |
CVE-2022-1068 | Medium | 5.5 | 2022-04-01 | Modbus Tools Modbus Slave (versions 7.4.2 and prior) is vulnerable to a stack-based buffer overflow in the registration field. This may cause the program to cr… |
CVE-2022-1018 | Medium | 5.5 | 2022-04-01 | When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within… |
CVE-2022-0922 | Medium | 6.5 | 2022-04-01 | The software does not perform any authentication for critical system functionality. |
CVE-2022-0741 | Medium | 5.8 | 2022-04-01 | Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafte… |
CVE-2022-0489 | Low | 3.5 | 2022-04-01 | An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a spec… |
CVE-2022-0425 | Medium | 5.4 | 2022-04-01 | A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side… |
CVE-2022-0390 | Medium | 4.3 | 2022-04-01 | Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details w… |
CVE-2022-0373 | Medium | 4.3 | 2022-04-01 | Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk ema… |
CVE-2022-26565 | Medium | 4.8 | 2022-04-01 | A cross-site scripting (XSS) vulnerability in Totaljs all versions before commit 95f54a5commit, allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-26562 | Critical | 9.8 | 2022-04-01 | An issue in provider/libserver/ECKrbAuth.cpp of Kopano Core <= v11.0.2.51 contains an issue which allows attackers to authenticate even if the user account or… |
CVE-2022-24426 | High | 7.8 | 2022-04-01 | Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore compo… |
CVE-2022-24066 | High | 8.1 | 2022-04-01 | The package simple-git before 3.5.0 are vulnerable to Command Injection due to an incomplete fix of [CVE-2022-24433](https://security.snyk.io/vuln/SNYK-JS-SIMP… |
CVE-2022-23158 | Medium | 6.0 | 2022-04-01 | Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A local authenticated user with standard privilege could potentia… |
CVE-2022-23157 | Medium | 4.4 | 2022-04-01 | Wyse Device Agent version 14.6.1.4 and below contain a sensitive data exposure vulnerability. A authenticated malicious user could potentially exploit this vul… |
CVE-2022-23156 | Medium | 6.0 | 2022-04-01 | Wyse Device Agent version 14.6.1.4 and below contain an Improper Authentication vulnerability. A malicious user could potentially exploit this vulnerability by… |
CVE-2022-23155 | High | 7.2 | 2022-04-01 | Dell Wyse Management Suite versions 2.0 through 3.5.2 contain an unrestricted file upload vulnerability. A malicious user with admin privileges can exploit thi… |
CVE-2022-1207 | Medium | 6.6 | 2022-04-01 | Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the al… |
CVE-2022-24440 | High | 8.1 | 2022-04-01 | The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod… |
CVE-2022-21223 | High | 8.1 | 2022-04-01 | The package cocoapods-downloader before 1.6.2 are vulnerable to Command Injection via hg argument injection. When calling the download function (when using hg)… |
CVE-2022-22404 | Medium | 6.5 | 2022-04-01 | IBM App Connect Enterprise Certified Container Dashboard UI (IBM App Connect Enterprise Certified Container 1.5, 2.0, 2.1, 3.0, and 3.1) may be vulnerable to d… |
CVE-2022-22332 | High | 7.5 | 2022-04-01 | IBM Sterling Partner Engagement Manager 6.2.0 could allow an attacker to impersonate another user due to missing revocation mechanism for the JWT token. IBM X-… |
CVE-2022-22331 | High | 7.1 | 2022-04-01 | IBM SterlingPartner Engagement Manager 6.2.0 could allow a remote authenticated attacker to obtain sensitive information or modify user details caused by an in… |
CVE-2022-22328 | Medium | 6.2 | 2022-04-01 | IBM SterlingPartner Engagement Manager 6.2.0 could allow a malicious user to elevate their privileges and perform unintended operations to another users data… |
CVE-2022-22327 | High | 7.5 | 2022-04-01 | IBM UrbanCode Deploy (UCD) 7.0.5, 7.1.0, 7.1.1, and 7.1.2 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sen… |
CVE-2022-21235 | High | 8.1 | 2022-04-01 | The package github.com/masterminds/vcs before 1.13.3 are vulnerable to Command Injection via argument injection. When hg is executed, argument strings are pass… |
CVE-2022-24181 | Medium | 6.1 | 2022-04-01 | Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forward… |
CVE-2022-21947 | High | 8.3 | 2022-04-01 | A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) t… |
CVE-2022-25017 | Critical | 9.1 | 2022-04-01 | Hitron CHITA 7.2.2.0.3b6-CD devices contain a command injection vulnerability via the Device/DDNS ddnsUsername field. |
CVE-2022-24803 | Critical | 10.0 | 2022-04-01 | Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied i… |
CVE-2022-24802 | High | 8.1 | 2022-04-01 | deepmerge-ts is a typescript library providing functionality to deep merging of javascript objects. deepmerge-ts is vulnerable to Prototype Pollution via file… |
CVE-2022-27966 | Medium | 6.5 | 2022-03-31 | Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-27965 | Medium | 6.5 | 2022-03-31 | Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-27964 | Medium | 6.5 | 2022-03-31 | Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-27963 | Medium | 6.5 | 2022-03-31 | Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. |