2022 CVEs (page 238)
Page 238 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-1034 | High | 7.2 | 2022-03-22 | There is a Unrestricted Upload of File vulnerability in ShowDoc v2.10.3 in GitHub repository star7th/showdoc prior to 2.10.4. |
CVE-2022-0652 | Low | 3.3 | 2022-03-22 | Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt o… |
CVE-2022-0386 | High | 8.8 | 2022-03-22 | A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710. |
CVE-2022-27607 | High | 8.1 | 2022-03-21 | Bento4 1.6.0-639 has a heap-based buffer over-read in the AP4_HvccAtom class, a different issue than CVE-2018-14531. |
CVE-2022-26285 | Critical | 9.8 | 2022-03-21 | Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint. This vulnerability allows… |
CVE-2022-26284 | Critical | 9.8 | 2022-03-21 | Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the manage_client endpoint. This vulnerabi… |
CVE-2022-26283 | Critical | 9.8 | 2022-03-21 | Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the view_plan endpoint. This vulnerability all… |
CVE-2022-27333 | High | 7.5 | 2022-03-21 | idcCMS v1.10 was discovered to contain an issue which allows attackers to arbitrarily delete the install.lock file, resulting in a reset of the CMS settings an… |
CVE-2022-27090 | Medium | 5.4 | 2022-03-21 | Cscms Music Portal System v4.2 was discovered to contain a redirection vulnerability via the backurl parameter. |
CVE-2022-26184 | Critical | 9.8 | 2022-03-21 | Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry… |
CVE-2022-26183 | High | 8.8 | 2022-03-21 | PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM com… |
CVE-2022-26174 | Critical | 9.8 | 2022-03-21 | A remote code execution (RCE) vulnerability in Beekeeper Studio v3.2.0 allows attackers to execute arbitrary code via a crafted payload injected into the displ… |
CVE-2022-26148 | Critical | 9.8 | 2022-03-21 | An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. The Zabbix password can be found in the api_jsonrpc.php HTML source code. When t… |
CVE-2022-23352 | High | 7.5 | 2022-03-21 | An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS). |
CVE-2022-23350 | Medium | 5.4 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2022-23349 | High | 8.8 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain a Cross-Site Request Forgery (CSRF). |
CVE-2022-23348 | Medium | 5.3 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to utilize weak password hashes. |
CVE-2022-23347 | High | 7.5 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to be vulnerable to directory traversal attacks. |
CVE-2022-23346 | High | 8.8 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control issues. |
CVE-2022-23345 | High | 7.5 | 2022-03-21 | BigAnt Software BigAnt Server v5.6.06 was discovered to contain incorrect access control. |
CVE-2022-24775 | High | 7.5 | 2022-03-21 | guzzlehttp/psr7 is a PSR-7 HTTP message library. Versions prior to 1.8.4 and 2.1.1 are vulnerable to improper header parsing. An attacker could sneak in a new… |
CVE-2022-24766 | Critical | 9.8 | 2022-03-21 | mitmproxy is an interactive, SSL/TLS-capable intercepting proxy. In mitmproxy 7.0.4 and below, a malicious client or server is able to perform HTTP request smu… |
CVE-2022-0760 | Critical | 9.8 | 2022-03-21 | The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upv… |
CVE-2022-0747 | Critical | 9.8 | 2022-03-21 | The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_a… |
CVE-2022-0739 | Critical | 9.8 | 2022-03-21 | The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via… |
CVE-2022-0694 | Critical | 9.8 | 2022-03-21 | The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_… |
CVE-2022-0687 | High | 8.8 | 2022-03-21 | The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being… |
CVE-2022-0681 | Medium | 6.5 | 2022-03-21 | The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged… |
CVE-2022-0640 | Medium | 6.1 | 2022-03-21 | The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading t… |
CVE-2022-0628 | Medium | 6.1 | 2022-03-21 | The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, leading to a Reflec… |
CVE-2022-0627 | Medium | 6.1 | 2022-03-21 | The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cr… |
CVE-2022-0616 | Medium | 4.3 | 2022-03-21 | The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin dele… |
CVE-2022-0591 | Critical | 9.1 | 2022-03-21 | The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unaut… |
CVE-2022-0590 | Medium | 4.8 | 2022-03-21 | The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross… |
CVE-2022-0515 | Medium | 4.3 | 2022-03-21 | Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4. |
CVE-2022-0514 | Medium | 6.5 | 2022-03-21 | Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5. |
CVE-2022-0423 | Medium | 5.4 | 2022-03-21 | The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escap… |
CVE-2022-0364 | Medium | 5.4 | 2022-03-21 | The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with… |
CVE-2022-0229 | High | 8.1 | 2022-03-21 | The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and d… |
CVE-2022-25766 | High | 8.8 | 2022-03-21 | The package ungit before 1.5.20 are vulnerable to Remote Code Execution (RCE) via argument injection. The issue occurs when calling the /api/fetch endpoint. Us… |
CVE-2022-24237 | High | 8.8 | 2022-03-21 | The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers… |
CVE-2022-24236 | Low | 3.5 | 2022-03-21 | An insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to send e-mails from spoofed users' accounts. |
CVE-2022-24235 | High | 8.8 | 2022-03-21 | A Cross-Site Request Forgery (CSRF) in the management portal of Snapt Aria v12.8 allows attackers to escalate privileges and execute arbitrary code via unspeci… |
CVE-2022-26960 | Critical | 9.1 | 2022-03-21 | connector.minimal.php in std42 elFinder through 2.1.60 is affected by path traversal. This allows unauthenticated remote attackers to read, write, and browse f… |
CVE-2022-22394 | High | 8.8 | 2022-03-21 | The IBM Spectrum Protect 8.1.14.000 server could allow a remote attacker to bypass security restrictions, caused by improper enforcement of access controls. By… |
CVE-2022-26494 | Medium | 4.8 | 2022-03-21 | An XSS was identified in the Admin Web interface of PrimeKey SignServer before 5.8.1. JavaScript code must be used in a worker name before a Generate CSR reque… |
CVE-2022-25570 | Medium | 6.5 | 2022-03-21 | In Click Studios (SA) Pty Ltd Passwordstate 9435, users with access to a passwordlist can gain access to additional password lists without permissions. Specifi… |
CVE-2022-1035 | Medium | 5.5 | 2022-03-21 | Segmentation Fault caused by MP4Box -lsr in GitHub repository gpac/gpac prior to 2.1.0-DEV. |
CVE-2022-24656 | Medium | 6.1 | 2022-03-21 | HexoEditor 1.1.8 is affected by Cross Site Scripting (XSS). By putting a common XSS payload in a markdown file, if opened with the app, will execute several ti… |
CVE-2022-0415 | High | 8.8 | 2022-03-21 | Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6. |
CVE-2022-1004 | Medium | 4.3 | 2022-03-21 | Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled. |
CVE-2022-0475 | Low | 3.5 | 2022-03-21 | Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager… |
CVE-2022-25505 | Critical | 9.8 | 2022-03-21 | Taocms v3.0.2 was discovered to contain a SQL injection vulnerability via the id parameter in \include\Model\Category.php. |
CVE-2022-25481 | High | 7.5 | 2022-03-21 | ThinkPHP Framework v5.0.24 was discovered to be configured without the PATHINFO parameter. This allows attackers to access all system environment parameters fr… |
CVE-2022-25462 | High | 7.5 | 2022-03-20 | Yafu v2.0 contains a segmentation fault via the component /factor/avx-ecm/vecarith52.c. This vulnerability allows attackers to cause a Denial of Service (DoS)… |
CVE-2022-26555 | Medium | 5.4 | 2022-03-20 | A stored cross-site scripting (XSS) vulnerability in the Add a Button function of Eova v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a c… |
CVE-2022-26247 | Medium | 5.9 | 2022-03-20 | TMS v2.28.0 contains an insecure permissions vulnerability via the component /TMS/admin/user/Update2. This vulnerability allows attackers to modify the adminis… |
CVE-2022-26246 | Medium | 6.1 | 2022-03-20 | TMS v2.28.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /TMS/admin/setting/mail/createorupdate. |
CVE-2022-25464 | Medium | 4.8 | 2022-03-20 | A stored cross-site scripting (XSS) vulnerability in the component /admin/contenttemp of DoraCMS v2.1.8 allows attackers to execute arbitrary web scripts or HT… |
CVE-2022-24125 | High | 8.8 | 2022-03-20 | The matchmaking servers of Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allow remote attackers to send arbitrary push requests to clients via a… |
CVE-2022-24126 | Critical | 9.8 | 2022-03-20 | A buffer overflow in the NRSessionSearchResult parser in Bandai Namco FromSoftware Dark Souls III through 2022-03-19 allows remote attackers to execute arbitra… |
CVE-2022-0991 | High | 7.1 | 2022-03-19 | Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. |
CVE-2022-27226 | High | 8.8 | 2022-03-19 | A CSRF issue in /api/crontab on iRZ Mobile Routers through 2022-03-16 allows a threat actor to create a crontab entry in the router administration panel. The c… |
CVE-2022-26267 | High | 7.5 | 2022-03-18 | Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenance_actions.php. |
CVE-2022-26266 | High | 8.8 | 2022-03-18 | Piwigo v12.2.0 was discovered to contain a SQL injection vulnerability via pwg.users.php. |
CVE-2022-26265 | Critical | 9.8 | 2022-03-18 | Contao Managed Edition v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the component php_cli parameter. |
CVE-2022-25581 | High | 7.8 | 2022-03-18 | Classcms v2.5 and below contains an arbitrary file upload via the component \class\classupload. This vulnerability allows attackers to execute code injection v… |
CVE-2022-25578 | Critical | 9.8 | 2022-03-18 | taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file. |
CVE-2022-25390 | Critical | 9.8 | 2022-03-18 | DCN Firewall DCME-520 was discovered to contain a remote command execution (RCE) vulnerability via the host parameter in the file /system/tool/ping.php. |
CVE-2022-25389 | High | 7.5 | 2022-03-18 | DCN Firewall DCME-520 was discovered to contain an arbitrary file download vulnerability via the path parameter in the file /audit/log/log_management.php. |
CVE-2022-27250 | Critical | 9.8 | 2022-03-18 | The UNISOC chipset through 2022-03-15 allows attackers to obtain remote control of a mobile phone, e.g., to obtain sensitive information from text messages or… |
CVE-2022-25461 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the startip parameter in the SetPptpServerCfg function. |
CVE-2022-25460 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the endip parameter in the SetPptpServerCfg function. |
CVE-2022-25459 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the S1 parameter in the SetSysTimeCfg function. |
CVE-2022-25458 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the cmdinput parameter in the exeCommand function. |
CVE-2022-25457 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function. |
CVE-2022-25456 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the security_5g parameter in the WifiBasicSet function. |
CVE-2022-25455 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function. |
CVE-2022-25454 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the loginpwd parameter in the SetFirewallCfg function. |
CVE-2022-25453 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the time parameter in the saveParentControlInfo function. |
CVE-2022-25452 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the URLs parameter in the saveParentControlInfo function. |
CVE-2022-25451 | Critical | 9.8 | 2022-03-18 | Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the setstaticroutecfg function. |
CVE-2022-25450 | Critical | 9.8 | 2022-03-18 | Tenda AC6 V15.03.05.09_multi was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function. |
CVE-2022-25449 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the deviceId parameter in the saveParentControlInfo function. |
CVE-2022-25448 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the day parameter in the openSchedWifi function. |
CVE-2022-25447 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedendtime parameter in the openSchedWifi function. |
CVE-2022-25446 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the schedstarttime parameter in the openSchedWifi function. |
CVE-2022-25445 | Critical | 9.8 | 2022-03-18 | Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the time parameter in the PowerSaveSet function. |
CVE-2022-25441 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the vlanid parameter in the SetIPTVCfg function. |
CVE-2022-25440 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the ntpserver parameter in the SetSysTimeCfg function. |
CVE-2022-25439 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetIpMacBind function. |
CVE-2022-25438 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a remote command execution (RCE) vulnerability via the SetIPTVCfg function. |
CVE-2022-25437 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetVirtualServerCfg function. |
CVE-2022-25435 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the list parameter in the SetStaticRoutecfg function. |
CVE-2022-25434 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the firewallen parameter in the SetFirewallCfg function. |
CVE-2022-25433 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the urls parameter in the saveparentcontrolinfo function. |
CVE-2022-25431 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain multiple stack overflows via the NPTR, V12, V10 and V11 parameter in the Formsetqosband function. |
CVE-2022-25429 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a buffer overflow via the time parameter in the saveparentcontrolinfo function. |
CVE-2022-25428 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the deviceId parameter in the saveparentcontrolinfo function. |
CVE-2022-25427 | Critical | 9.8 | 2022-03-18 | Tenda AC9 v15.03.2.21 was discovered to contain a stack overflow via the schedendtime parameter in the openSchedWifi function. |