2022 CVEs (page 245)
Page 245 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24463 | Medium | 6.5 | 2022-03-09 | Microsoft Exchange Server Spoofing Vulnerability |
CVE-2022-24462 | Medium | 5.5 | 2022-03-09 | Microsoft Word Security Feature Bypass Vulnerability |
CVE-2022-24461 | High | 7.8 | 2022-03-09 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-24460 | High | 7.0 | 2022-03-09 | Tablet Windows User Interface Application Elevation of Privilege Vulnerability |
CVE-2022-24459 | High | 7.8 | 2022-03-09 | Windows Fax and Scan Service Elevation of Privilege Vulnerability |
CVE-2022-24457 | High | 7.8 | 2022-03-09 | HEIF Image Extensions Remote Code Execution Vulnerability |
CVE-2022-24456 | High | 7.8 | 2022-03-09 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-24455 | High | 7.8 | 2022-03-09 | Windows CD-ROM Driver Elevation of Privilege Vulnerability |
CVE-2022-24454 | High | 7.8 | 2022-03-09 | Windows Security Support Provider Interface Elevation of Privilege Vulnerability |
CVE-2022-24453 | High | 7.8 | 2022-03-09 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-24452 | High | 7.8 | 2022-03-09 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-24451 | High | 7.8 | 2022-03-09 | VP9 Video Extensions Remote Code Execution Vulnerability |
CVE-2022-23301 | High | 7.8 | 2022-03-09 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-23300 | High | 7.8 | 2022-03-09 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2022-23299 | High | 7.8 | 2022-03-09 | Windows PDEV Elevation of Privilege Vulnerability |
CVE-2022-23298 | High | 7.0 | 2022-03-09 | Windows NT OS Kernel Elevation of Privilege Vulnerability |
CVE-2022-23297 | Medium | 5.5 | 2022-03-09 | Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability |
CVE-2022-23296 | High | 7.8 | 2022-03-09 | Windows Installer Elevation of Privilege Vulnerability |
CVE-2022-23295 | High | 7.8 | 2022-03-09 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2022-23294 | High | 8.8 | 2022-03-09 | Windows Event Tracing Remote Code Execution Vulnerability |
CVE-2022-23293 | High | 7.8 | 2022-03-09 | Windows Fast FAT File System Driver Elevation of Privilege Vulnerability |
CVE-2022-23291 | High | 7.8 | 2022-03-09 | Windows DWM Core Library Elevation of Privilege Vulnerability |
CVE-2022-23290 | High | 7.8 | 2022-03-09 | Windows Inking COM Elevation of Privilege Vulnerability |
CVE-2022-23288 | High | 7.0 | 2022-03-09 | Windows DWM Core Library Elevation of Privilege Vulnerability |
CVE-2022-23287 | High | 7.0 | 2022-03-09 | Windows ALPC Elevation of Privilege Vulnerability |
CVE-2022-23286 | High | 7.0 | 2022-03-09 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability |
CVE-2022-23285 | High | 8.8 | 2022-03-09 | Remote Desktop Client Remote Code Execution Vulnerability |
CVE-2022-23284 | High | 7.2 | 2022-03-09 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-23283 | High | 7.0 | 2022-03-09 | Windows ALPC Elevation of Privilege Vulnerability |
CVE-2022-23282 | High | 7.8 | 2022-03-09 | Paint 3D Remote Code Execution Vulnerability |
CVE-2022-23281 | Medium | 5.5 | 2022-03-09 | Windows Common Log File System Driver Information Disclosure Vulnerability |
CVE-2022-23278 | Medium | 5.9 | 2022-03-09 | Microsoft Defender for Endpoint Spoofing Vulnerability |
CVE-2022-23277 | High | 8.8 | 2022-03-09 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2022-23266 | High | 7.8 | 2022-03-09 | Microsoft Defender for IoT Elevation of Privilege Vulnerability |
CVE-2022-23265 | High | 7.2 | 2022-03-09 | Microsoft Defender for IoT Remote Code Execution Vulnerability |
CVE-2022-23253 | Medium | 6.5 | 2022-03-09 | Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability |
CVE-2022-22010 | Medium | 4.4 | 2022-03-09 | Media Foundation Information Disclosure Vulnerability |
CVE-2022-22007 | High | 7.8 | 2022-03-09 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-22006 | High | 7.8 | 2022-03-09 | HEVC Video Extensions Remote Code Execution Vulnerability |
CVE-2022-21990 | High | 8.8 | 2022-03-09 | Remote Desktop Client Remote Code Execution Vulnerability |
CVE-2022-21977 | Low | 3.3 | 2022-03-09 | Media Foundation Information Disclosure Vulnerability |
CVE-2022-21975 | Medium | 4.7 | 2022-03-09 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2022-21973 | Medium | 5.5 | 2022-03-09 | Windows Media Center Update Denial of Service Vulnerability |
CVE-2022-21967 | High | 7.0 | 2022-03-09 | Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability |
CVE-2022-0896 | High | 8.8 | 2022-03-09 | Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0482 | Critical | 9.1 | 2022-03-09 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. |
CVE-2022-0881 | Medium | 6.5 | 2022-03-09 | Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1. |
CVE-2022-25943 | High | 7.8 | 2022-03-09 | The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is inst… |
CVE-2022-26337 | High | 7.8 | 2022-03-08 | Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search Path Element vulnerability that could al… |
CVE-2022-26319 | Medium | 6.5 | 2022-03-08 | An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place an arbitrarily gene… |
CVE-2022-24739 | High | 7.3 | 2022-03-08 | alltube is an html front end for youtube-dl. On releases prior to 3.0.3, an attacker could craft a special HTML page to trigger either an open redirect attack… |
CVE-2022-24716 | High | 7.5 | 2022-03-08 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Unauthenticated users can leak the contents of files of the loca… |
CVE-2022-24715 | High | 8.5 | 2022-03-08 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Authenticated users, with access to the configuration, can creat… |
CVE-2022-24714 | Medium | 5.3 | 2022-03-08 | Icinga Web 2 is an open source monitoring web interface, framework and command-line interface. Installations of Icinga 2 with the IDO writer enabled are affect… |
CVE-2022-24713 | High | 7.5 | 2022-03-08 | regex is an implementation of regular expressions for the Rust language. The regex crate features built-in mitigations to prevent denial of service attacks cau… |
CVE-2022-0877 | Medium | 5.4 | 2022-03-08 | Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3. |
CVE-2022-26317 | Medium | 6.5 | 2022-03-08 | A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29). When returning the result of a completed Microflow executi… |
CVE-2022-26314 | Critical | 9.8 | 2022-03-08 | A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1), Mendix Forgot Password Appstore module (Mendix… |
CVE-2022-26313 | Critical | 9.8 | 2022-03-08 | A vulnerability has been identified in Mendix Forgot Password Appstore module (All versions >= V3.3.0 < V3.5.1). In certain configurations of the affected prod… |
CVE-2022-25311 | High | 7.3 | 2022-03-08 | A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affe… |
CVE-2022-24661 | High | 7.8 | 2022-03-08 | A vulnerability has been identified in Simcenter STAR-CCM+ Viewer (All versions < V2022.1). The starview+.exe contains a memory corruption vulnerability while… |
CVE-2022-24408 | High | 7.8 | 2022-03-08 | A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binary on affected device… |
CVE-2022-24309 | Medium | 6.8 | 2022-03-08 | A vulnerability has been identified in Mendix Runtime V7 (All versions < V7.23.29), Mendix Runtime V8 (All versions < V8.18.16), Mendix Runtime V9 (All version… |
CVE-2022-24282 | High | 7.2 | 2022-03-08 | A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affe… |
CVE-2022-24281 | High | 7.2 | 2022-03-08 | A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attacker could execute a… |
CVE-2022-24737 | Medium | 6.5 | 2022-03-07 | HTTPie is a command-line HTTP client. HTTPie has the practical concept of sessions, which help users to persistently store some of the state that belongs to th… |
CVE-2022-24738 | High | 8.1 | 2022-03-07 | Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from use… |
CVE-2022-22351 | High | 8.6 | 2022-03-07 | IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged trusted host user to exploit a vulnerability in the nimsh daemon to cause a denial of service… |
CVE-2022-0756 | Medium | 6.5 | 2022-03-07 | Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5. |
CVE-2022-0755 | Medium | 4.3 | 2022-03-07 | Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5. |
CVE-2022-0754 | Medium | 6.5 | 2022-03-07 | SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5. |
CVE-2022-0535 | Medium | 4.8 | 2022-03-07 | The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scrip… |
CVE-2022-0533 | Medium | 6.1 | 2022-03-07 | The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability. |
CVE-2022-0448 | Medium | 4.8 | 2022-03-07 | The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Si… |
CVE-2022-0445 | Medium | 6.5 | 2022-03-07 | The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its s… |
CVE-2022-0442 | Medium | 4.3 | 2022-03-07 | The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are uniq… |
CVE-2022-0441 | Critical | 9.8 | 2022-03-07 | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to regi… |
CVE-2022-0440 | High | 7.2 | 2022-03-07 | The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload… |
CVE-2022-0439 | High | 8.8 | 2022-03-07 | The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list… |
CVE-2022-0434 | Critical | 9.8 | 2022-03-07 | The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint… |
CVE-2022-0429 | Medium | 6.1 | 2022-03-07 | The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activ… |
CVE-2022-0426 | Medium | 5.4 | 2022-03-07 | The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the wo… |
CVE-2022-0422 | Medium | 6.1 | 2022-03-07 | The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the respons… |
CVE-2022-0420 | High | 7.2 | 2022-03-07 | The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automatio… |
CVE-2022-0410 | High | 8.8 | 2022-03-07 | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via… |
CVE-2022-0389 | Medium | 4.8 | 2022-03-07 | The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site… |
CVE-2022-0384 | Medium | 4.3 | 2022-03-07 | The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated… |
CVE-2022-0349 | Critical | 9.8 | 2022-03-07 | The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthentica… |
CVE-2022-0347 | Medium | 6.1 | 2022-03-07 | The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attrib… |
CVE-2022-0267 | High | 7.2 | 2022-03-07 | The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action… |
CVE-2022-0205 | Medium | 5.4 | 2022-03-07 | The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputtin… |
CVE-2022-0163 | Medium | 6.5 | 2022-03-07 | The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users… |
CVE-2022-0767 | Critical | 9.9 | 2022-03-07 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17. |
CVE-2022-0766 | Critical | 9.8 | 2022-03-07 | Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.17. |
CVE-2022-0697 | Medium | 6.1 | 2022-03-06 | Open Redirect in GitHub repository archivy/archivy prior to 1.7.0. |
CVE-2022-0868 | Medium | 6.1 | 2022-03-06 | Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10. |
CVE-2022-0869 | Medium | 6.1 | 2022-03-06 | Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3. |
CVE-2022-26505 | High | 7.4 | 2022-03-06 | A DNS rebinding issue in ReadyMedia (formerly MiniDLNA) before 1.3.1 allows a remote web server to exfiltrate media files. |
CVE-2022-26496 | Critical | 9.8 | 2022-03-06 | In nbd-server in nbd before 3.24, there is a stack-based buffer overflow. An attacker can cause a buffer overflow in the parsing of the name field by sending a… |
CVE-2022-26495 | Critical | 9.8 | 2022-03-06 | In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length field will… |