2022 CVEs (page 247)
Page 247 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24717 | Medium | 6.1 | 2022-03-01 | ssr-pages is an HTML page builder for the purpose of server-side rendering (SSR). In versions prior to 0.1.5, a cross site scripting (XSS) issue can occur when… |
CVE-2022-22300 | Medium | 4.3 | 2022-03-01 | A improper handling of insufficient permissions or privileges in Fortinet FortiAnalyzer version 5.6.0 through 5.6.11, FortiAnalyzer version 6.0.0 through 6.0.1… |
CVE-2022-23387 | High | 7.5 | 2022-03-01 | An issue was discovered in taocms 3.0.2. This is a SQL blind injection that can obtain database data through the Comment Update field. |
CVE-2022-22321 | Medium | 5.5 | 2022-03-01 | IBM MQ Appliance 9.2 CD and 9.2 LTS local messaging users stored with a password hash that provides insufficient protection. IBM X-Force ID: 218368. |
CVE-2022-23380 | High | 8.8 | 2022-03-01 | There is a SQL injection vulnerability in the background of taocms 3.0.2 in parameter id:action=admin&id=2&ctrl=edit. |
CVE-2022-23377 | High | 7.5 | 2022-03-01 | Archeevo below 5.0 is affected by local file inclusion through file=~/web.config to allow an attacker to retrieve local files. |
CVE-2022-0777 | High | 7.5 | 2022-03-01 | Weak Password Recovery Mechanism for Forgotten Password in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0776 | Medium | 6.1 | 2022-03-01 | Cross-site Scripting (XSS) - DOM in GitHub repository hakimel/reveal.js prior to 4.3.0. |
CVE-2022-25022 | Medium | 5.4 | 2022-03-01 | A cross-site scripting (XSS) vulnerability in Htmly v2.8.1 allows attackers to excute arbitrary web scripts HTML via a crafted payload in the content field of… |
CVE-2022-25020 | Medium | 5.4 | 2022-03-01 | A cross-site scripting (XSS) vulnerability in Pluxml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the thumbnail pa… |
CVE-2022-25018 | High | 8.8 | 2022-03-01 | Pluxml v5.8.7 was discovered to allow attackers to execute arbitrary code via crafted PHP code inserted into static pages. |
CVE-2022-24446 | Medium | 4.3 | 2022-03-01 | An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no… |
CVE-2022-22262 | High | 7.7 | 2022-03-01 | ROG Live Service’s function for deleting temp files created by installation has an improper link resolution before file access vulnerability. Since this functi… |
CVE-2022-26332 | Medium | 5.4 | 2022-03-01 | Cipi 3.1.15 allows Add Server stored XSS via the /api/servers name field. |
CVE-2022-25413 | Medium | 5.4 | 2022-02-28 | Maxsite CMS v108 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_tags at /admin/page_edit/3. |
CVE-2022-25412 | High | 8.1 | 2022-02-28 | Maxsite CMS v180 was discovered to contain multiple arbitrary file deletion vulnerabilities in /admin_page/all-files-update-ajax.php via the dir and deletefile… |
CVE-2022-25411 | Critical | 9.8 | 2022-02-28 | A Remote Code Execution (RCE) vulnerability at /admin/options in Maxsite CMS v180 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-25410 | Medium | 5.4 | 2022-02-28 | Maxsite CMS v180 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the parameter f_file_description at /admin/files. |
CVE-2022-25409 | Medium | 5.4 | 2022-02-28 | Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the demail parameter at /admin-panel1.php. |
CVE-2022-25408 | Medium | 5.4 | 2022-02-28 | Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the dpassword parameter at /admin-panel1.php. |
CVE-2022-25407 | Medium | 5.4 | 2022-02-28 | Hospital Management System v1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Doctor parameter at /admin-panel1.php. |
CVE-2022-25028 | Medium | 6.1 | 2022-02-28 | Home Owners Collection Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the collected_by parameter under the Lis… |
CVE-2022-23907 | Medium | 6.1 | 2022-02-28 | CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage. |
CVE-2022-23906 | High | 7.2 | 2022-02-28 | CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploite… |
CVE-2022-0743 | Medium | 4.6 | 2022-02-28 | Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. |
CVE-2022-26315 | Medium | 5.3 | 2022-02-28 | qrcp through 0.8.4, in receive mode, allows ../ Directory Traversal via the file name specified by the uploader. |
CVE-2022-26181 | High | 7.8 | 2022-02-28 | Dropbox Lepton v1.2.1-185-g2a08b77 was discovered to contain a heap-buffer-overflow in the function aligned_dealloc():src/lepton/bitops.cc:108. |
CVE-2022-25023 | High | 8.8 | 2022-02-28 | Audio File commit 004065d was discovered to contain a heap-buffer overflow in the function fouBytesToInt():AudioFile.h. |
CVE-2022-25015 | Medium | 5.4 | 2022-02-28 | A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted payload inserted into the First Name fie… |
CVE-2022-25014 | Medium | 6.1 | 2022-02-28 | Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter in the Dashboard of the current user. Th… |
CVE-2022-25013 | Medium | 6.1 | 2022-02-28 | Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" and "fm" parameters in the component lo… |
CVE-2022-26158 | Medium | 6.1 | 2022-02-28 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbitrary domains supplied via a client-con… |
CVE-2022-26157 | Medium | 5.3 | 2022-02-28 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie is not protected by the Secure flag. T… |
CVE-2022-26156 | Medium | 6.1 | 2022-02-28 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious payload within the RelayState= parameter o… |
CVE-2022-26155 | Medium | 6.1 | 2022-02-28 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload in the SAMLResponse parameter of the HT… |
CVE-2022-24712 | Medium | 6.3 | 2022-02-28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. A vulnerability in versions prior to 4.1.9 might allow remote attackers to bypas… |
CVE-2022-24711 | Critical | 9.4 | 2022-02-28 | CodeIgniter4 is the 4.x branch of CodeIgniter, a PHP full-stack web framework. Prior to version 4.1.9, an improper input validation vulnerability allows attack… |
CVE-2022-25642 | Medium | 6.1 | 2022-02-28 | Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution. |
CVE-2022-24685 | High | 7.5 | 2022-02-28 | HashiCorp Nomad and Nomad Enterprise 1.0.17, 1.1.11, and 1.2.5 allow invalid HCL for the jobs parse endpoint, which may cause excessive CPU usage. Fixed in 1.0… |
CVE-2022-24572 | Medium | 6.1 | 2022-02-28 | Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit this Vulnerability… |
CVE-2022-24571 | Critical | 9.8 | 2022-02-28 | Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin a… |
CVE-2022-0768 | Critical | 9.1 | 2022-02-28 | Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2. |
CVE-2022-23988 | Medium | 6.1 | 2022-02-28 | The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS paylo… |
CVE-2022-23987 | Medium | 4.8 | 2022-02-28 | The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-S… |
CVE-2022-23912 | Medium | 6.1 | 2022-02-28 | The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading… |
CVE-2022-23911 | High | 7.2 | 2022-02-28 | The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving… |
CVE-2022-0412 | Critical | 9.8 | 2022-02-28 | The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id p… |
CVE-2022-0411 | High | 8.8 | 2022-02-28 | The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the p… |
CVE-2022-0385 | Medium | 6.1 | 2022-02-28 | The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them back in the log dashb… |
CVE-2022-0383 | High | 7.2 | 2022-02-28 | The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could allow a high privil… |
CVE-2022-0377 | Medium | 4.3 | 2022-02-28 | Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and sa… |
CVE-2022-0360 | Medium | 4.8 | 2022-02-28 | The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow h… |
CVE-2022-0345 | Medium | 4.3 | 2022-02-28 | The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowi… |
CVE-2022-0328 | Medium | 4.7 | 2022-02-28 | The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in adm… |
CVE-2022-0189 | Medium | 6.1 | 2022-02-28 | The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputt… |
CVE-2022-0150 | Medium | 6.1 | 2022-02-28 | The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode valu… |
CVE-2022-26159 | Medium | 5.3 | 2022-02-28 | The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-comple… |
CVE-2022-0772 | Medium | 4.8 | 2022-02-27 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2. |
CVE-2022-22908 | Medium | 5.5 | 2022-02-26 | SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to discover the contents of the Username and… |
CVE-2022-26149 | High | 7.2 | 2022-02-26 | MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable F… |
CVE-2022-26146 | Medium | 5.4 | 2022-02-26 | Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker. |
CVE-2022-0764 | Medium | 6.7 | 2022-02-26 | Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0. |
CVE-2022-0723 | Medium | 5.4 | 2022-02-26 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11. |
CVE-2022-0763 | Medium | 4.8 | 2022-02-26 | Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-0762 | Medium | 5.5 | 2022-02-26 | Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3. |
CVE-2022-25359 | Critical | 9.1 | 2022-02-26 | On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, delete, or create files. |
CVE-2022-24986 | High | 7.8 | 2022-02-26 | KDE KCron through 21.12.2 uses a temporary file in /tmp when saving, but reuses the filename during an editing session. Thus, someone watching it be created th… |
CVE-2022-23308 | High | 7.5 | 2022-02-26 | valid.c in libxml2 before 2.9.13 has a use-after-free of ID and IDREF attributes. |
CVE-2022-25096 | Critical | 9.8 | 2022-02-26 | Home Owners Collection Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in /members/view_member.php. |
CVE-2022-25095 | Critical | 9.8 | 2022-02-26 | Home Owners Collection Management System v1.0 allows unauthenticated attackers to compromise user accounts via a crafted POST request. |
CVE-2022-25094 | High | 8.8 | 2022-02-26 | Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover" in SystemSettings… |
CVE-2022-21706 | High | 7.2 | 2022-02-26 | Zulip is an open-source team collaboration tool with topic-based threading. Zulip Server version 2.0.0 and above are vulnerable to insufficient access control… |
CVE-2022-24710 | Medium | 5.4 | 2022-02-25 | Weblate is a copyleft software web-based continuous localization system. Versions prior to 4.11 do not properly neutralize user input used in user name and lan… |
CVE-2022-25264 | High | 7.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2.3, environment variables of the "password" type could be logged in some cases. |
CVE-2022-25263 | Critical | 9.8 | 2022-02-25 | JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. |
CVE-2022-25262 | Critical | 9.8 | 2022-02-25 | In JetBrains Hub before 2022.1.14434, SAML request takeover was possible. |
CVE-2022-25261 | Medium | 6.1 | 2022-02-25 | JetBrains TeamCity before 2021.2.2 was vulnerable to reflected XSS. |
CVE-2022-25260 | Critical | 9.1 | 2022-02-25 | JetBrains Hub before 2021.1.14276 was vulnerable to blind Server-Side Request Forgery (SSRF). |
CVE-2022-25259 | Medium | 6.1 | 2022-02-25 | JetBrains Hub before 2021.1.14276 was vulnerable to reflected XSS. |
CVE-2022-25064 | Critical | 9.8 | 2022-02-25 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal_wan6_setIpAddr. |
CVE-2022-25062 | High | 7.5 | 2022-02-25 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain an integer overflow via the function dm_checkString. This vulnerability allows attackers to cause… |
CVE-2022-25061 | Critical | 9.8 | 2022-02-25 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute. |
CVE-2022-25060 | Critical | 9.8 | 2022-02-25 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing. |
CVE-2022-24442 | Critical | 9.8 | 2022-02-25 | JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates. |
CVE-2022-25170 | High | 7.8 | 2022-02-25 | The affected product is vulnerable to a stack-based buffer overflow while processing project files, which may allow an attacker to execute arbitrary code |
CVE-2022-23985 | High | 7.8 | 2022-02-25 | The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project file that would allow… |
CVE-2022-23921 | High | 7.5 | 2022-02-25 | Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possibl… |
CVE-2022-21798 | High | 7.5 | 2022-02-25 | The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in… |
CVE-2022-21209 | High | 7.8 | 2022-02-25 | The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file that would allow a… |
CVE-2022-0615 | Medium | 5.9 | 2022-02-25 | Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-service condition on the system. |
CVE-2022-24347 | Medium | 5.4 | 2022-02-25 | JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon. |
CVE-2022-24346 | High | 7.8 | 2022-02-25 | In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible. |
CVE-2022-24345 | High | 7.8 | 2022-02-25 | In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible. |
CVE-2022-24344 | Medium | 5.4 | 2022-02-25 | JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page. |
CVE-2022-24343 | Medium | 4.3 | 2022-02-25 | In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions. |
CVE-2022-24342 | High | 8.8 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible. |
CVE-2022-24341 | High | 7.5 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user. |
CVE-2022-24340 | Critical | 9.8 | 2022-02-25 | In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. |
CVE-2022-24339 | Medium | 5.4 | 2022-02-25 | JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS. |
CVE-2022-24338 | Medium | 6.1 | 2022-02-25 | JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS. |