2022 CVEs (page 258)
Page 258 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-0417 | High | 7.8 | 2022-02-01 | Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2. |
CVE-2022-0401 | Critical | 9.8 | 2022-02-01 | Path Traversal in NPM w-zip prior to 1.0.12. |
CVE-2022-0320 | Critical | 9.8 | 2022-02-01 | The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which… |
CVE-2022-0220 | Medium | 6.1 | 2022-02-01 | The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, respond… |
CVE-2022-23597 | High | 8.3 | 2022-02-01 | Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution… |
CVE-2022-23596 | High | 7.5 | 2022-02-01 | Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said arch… |
CVE-2022-21687 | Medium | 6.8 | 2022-02-01 | gh-ost is a triggerless online schema migration solution for MySQL. Versions prior to 1.1.3 are subject to an arbitrary file read vulnerability. The attacker m… |
CVE-2022-23607 | Medium | 6.5 | 2022-02-01 | treq is an HTTP library inspired by requests but written on top of Twisted's Agents. Treq's request methods (`treq.get`, `treq.post`, etc.) and `treq.client.HT… |
CVE-2022-23603 | Critical | 9.9 | 2022-02-01 | iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitiz… |
CVE-2022-23602 | High | 7.7 | 2022-02-01 | Nimforum is a lightweight alternative to Discourse written in Nim. In versions prior to 2.2.0 any forum user can create a new thread/post with an include refer… |
CVE-2022-0419 | Medium | 5.5 | 2022-02-01 | NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0. |
CVE-2022-23774 | Medium | 5.3 | 2022-02-01 | Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files. |
CVE-2022-24266 | High | 7.5 | 2022-01-31 | Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by parameter. |
CVE-2022-24265 | High | 7.5 | 2022-01-31 | Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_filter=3 parameter. |
CVE-2022-24264 | High | 7.5 | 2022-01-31 | Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word parameter. |
CVE-2022-24263 | Critical | 9.8 | 2022-01-31 | Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter. |
CVE-2022-23872 | Medium | 4.8 | 2022-01-31 | Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_inf… |
CVE-2022-21659 | Medium | 5.3 | 2022-01-31 | Flask-AppBuilder is an application development framework, built on top of the Flask web framework. In affected versions there exists a user enumeration vulnera… |
CVE-2022-0286 | Medium | 5.5 | 2022-01-31 | A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service. |
CVE-2022-0414 | Medium | 4.3 | 2022-01-31 | Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0. |
CVE-2022-23409 | Medium | 4.9 | 2022-01-31 | The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php. |
CVE-2022-24130 | Medium | 5.5 | 2022-01-31 | xterm through Patch 370, when Sixel support is enabled, allows attackers to trigger a buffer overflow in set_sixel in graphics_sixel.c via crafted text. |
CVE-2022-0413 | High | 7.8 | 2022-01-30 | Use After Free in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0408 | High | 7.8 | 2022-01-30 | Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0407 | High | 7.8 | 2022-01-30 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0339 | Critical | 9.8 | 2022-01-30 | Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16. |
CVE-2022-0273 | Medium | 6.5 | 2022-01-30 | Improper Access Control in Pypi calibreweb prior to 0.6.16. |
CVE-2022-22919 | Medium | 6.1 | 2022-01-30 | Adenza AxiomSL ControllerView through 10.8.1 allows redirection for SSO login URLs. |
CVE-2022-24032 | Medium | 5.3 | 2022-01-30 | Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform because a failed login… |
CVE-2022-24124 | High | 7.5 | 2022-01-29 | The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations. |
CVE-2022-24123 | Critical | 9.0 | 2022-01-29 | MarkText through 0.16.3 does not sanitize the input of a mermaid block before rendering. This could lead to Remote Code Execution via a .md file containing a m… |
CVE-2022-24122 | High | 7.8 | 2022-01-29 | kernel/ucount.c in the Linux kernel 5.14 through 5.16.4, when unprivileged user namespaces are enabled, allows a use-after-free and privilege escalation becaus… |
CVE-2022-23599 | Medium | 4.3 | 2022-01-28 | Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6… |
CVE-2022-23598 | Medium | 6.1 | 2022-01-28 | laminas-form is a package for validating and displaying simple and complex forms. When rendering validation error messages via the `formElementErrors()` view h… |
CVE-2022-21721 | Medium | 5.9 | 2022-01-28 | Next.js is a React framework. Starting with version 12.0.0 and prior to version 12.0.9, vulnerable code could allow a bad actor to trigger a denial of service… |
CVE-2022-0395 | Medium | 5.4 | 2022-01-28 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-0393 | High | 7.1 | 2022-01-28 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0392 | High | 7.8 | 2022-01-28 | Heap-based Buffer Overflow in GitHub repository vim prior to 8.2. |
CVE-2022-0352 | Medium | 6.1 | 2022-01-28 | Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16. |
CVE-2022-23889 | Medium | 5.3 | 2022-01-28 | The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comment… |
CVE-2022-23888 | High | 8.8 | 2022-01-28 | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html. |
CVE-2022-23887 | Medium | 6.5 | 2022-01-28 | YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/de… |
CVE-2022-23979 | Medium | 4.8 | 2022-01-28 | Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15). |
CVE-2022-23727 | High | 7.8 | 2022-01-28 | There is a privilege escalation vulnerability in some webOS TVs. Due to wrong setting environments, local attacker is able to perform specific operation to exp… |
CVE-2022-23456 | Medium | 5.5 | 2022-01-28 | Potential arbitrary file deletion vulnerability has been identified in HP Support Assistant software. |
CVE-2022-22994 | High | 8.8 | 2022-01-28 | A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an uns… |
CVE-2022-22993 | High | 7.8 | 2022-01-28 | A limited SSRF vulnerability was discovered on Western Digital My Cloud devices that could allow an attacker to impersonate a server and reach any page on the… |
CVE-2022-22992 | High | 7.8 | 2022-01-28 | A command injection remote code execution vulnerability was discovered on Western Digital My Cloud Devices that could allow an attacker to execute arbitrary sy… |
CVE-2022-22938 | Medium | 6.5 | 2022-01-28 | VMware Workstation (16.x prior to 16.2.2) and Horizon Client for Windows (5.x prior to 5.5.3) contains a denial-of-service vulnerability in the Cortado ThinPri… |
CVE-2022-22791 | Medium | 6.6 | 2022-01-28 | SYNEL - eharmony Authenticated Blind & Stored XSS. Inject JS code into the "comments" field could lead to potential stealing of cookies, loading of HTML tags a… |
CVE-2022-22790 | Medium | 5.6 | 2022-01-28 | SYNEL - eharmony Directory Traversal. Directory Traversal - is an attack against a server or a Web application aimed at unauthorized access to the file system… |
CVE-2022-21801 | High | 7.5 | 2022-01-28 | A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network reque… |
CVE-2022-21796 | High | 8.2 | 2022-01-28 | A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP re… |
CVE-2022-21236 | High | 7.5 | 2022-01-28 | An information disclosure vulnerability exists due to a web server misconfiguration in the Reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP reque… |
CVE-2022-21217 | Critical | 9.8 | 2022-01-28 | An out-of-bounds write vulnerability exists in the device TestEmail functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request… |
CVE-2022-21199 | Medium | 5.9 | 2022-01-28 | An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man-in-the-middle atta… |
CVE-2022-21134 | High | 7.5 | 2022-01-28 | A firmware update vulnerability exists in the "update" firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTT… |
CVE-2022-22868 | Medium | 4.8 | 2022-01-28 | Gibbon CMS v22.0.01 was discovered to contain a cross-site scripting (XSS) vulnerability, that allows attackers to inject arbitrary script via name parameters. |
CVE-2022-22294 | Critical | 9.8 | 2022-01-28 | A SQL injection vulnerability exists in ZFAKA<=1.43 which an attacker can use to complete SQL injection in the foreground and add a background administrator ac… |
CVE-2022-23863 | Medium | 6.5 | 2022-01-28 | Zoho ManageEngine Desktop Central before 10.1.2137.10 allows an authenticated user to change any user's login password. |
CVE-2022-23098 | High | 7.5 | 2022-01-28 | An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation has an infinite loop if no data is received. |
CVE-2022-23097 | Critical | 9.1 | 2022-01-28 | An issue was discovered in the DNS proxy in Connman through 1.40. forward_dns_reply mishandles a strnlen call, leading to an out-of-bounds read. |
CVE-2022-23096 | Critical | 9.1 | 2022-01-28 | An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Header Data… |
CVE-2022-24071 | Medium | 4.3 | 2022-01-28 | A Built-in extension in Whale browser before 3.12.129.46 allows attackers to compromise the rendering process which could lead to controlling browser internal… |
CVE-2022-21720 | Medium | 4.9 | 2022-01-28 | GLPI is a free asset and IT management software package. Prior to version 9.5.7, an entity administrator is capable of retrieving normally inaccessible data vi… |
CVE-2022-0394 | Medium | 5.4 | 2022-01-28 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-21719 | Medium | 6.1 | 2022-01-28 | GLPI is a free asset and IT management software package. All GLPI versions prior to 9.5.7 are vulnerable to reflected cross-site scripting. Version 9.5.7 conta… |
CVE-2022-0348 | Medium | 5.4 | 2022-01-27 | Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2. |
CVE-2022-23181 | High | 7.0 | 2022-01-27 | The fix for bug CVE-2020-9484 introduced a time of check, time of use vulnerability into Apache Tomcat 10.1.0-M1 to 10.1.0-M8, 10.0.0-M5 to 10.0.14, 9.0.35 to… |
CVE-2022-0372 | Medium | 5.4 | 2022-01-27 | Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2. |
CVE-2022-22828 | High | 7.5 | 2022-01-27 | An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modifie… |
CVE-2022-0387 | Medium | 5.4 | 2022-01-27 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-0370 | Medium | 5.4 | 2022-01-27 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-21723 | Critical | 9.1 | 2022-01-27 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2022-21722 | Critical | 9.1 | 2022-01-27 | PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN… |
CVE-2022-22852 | Medium | 5.4 | 2022-01-26 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in r… |
CVE-2022-21686 | Critical | 9.0 | 2022-01-26 | PrestaShop is an Open Source e-commerce platform. Starting with version 1.7.0.0 and ending with version 1.7.8.3, an attacker is able to inject twig code inside… |
CVE-2022-23993 | Medium | 6.1 | 2022-01-26 | /usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS. |
CVE-2022-23990 | High | 7.5 | 2022-01-26 | Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function. |
CVE-2022-22850 | Medium | 5.4 | 2022-01-26 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the description parameter in r… |
CVE-2022-0368 | High | 7.8 | 2022-01-26 | Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. |
CVE-2022-22851 | Medium | 5.4 | 2022-01-26 | A Stored Cross Site Scripting (XSS) vulnerability exists in Sourcecodtester Hospital's Patient Records Management System 1.0 via the specialization parameter i… |
CVE-2022-0379 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0378 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. |
CVE-2022-0362 | Critical | 9.8 | 2022-01-26 | SQL Injection in Packagist showdoc/showdoc prior to 2.10.3. |
CVE-2022-0361 | High | 7.8 | 2022-01-26 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-0203 | Medium | 5.3 | 2022-01-26 | Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2. |
CVE-2022-0359 | High | 7.8 | 2022-01-26 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. |
CVE-2022-22932 | Medium | 5.3 | 2022-01-26 | Apache Karaf obr:* commands and run goal on the karaf-maven-plugin have partial path traversal which allows to break out of expected folder. The risk is low as… |
CVE-2022-0251 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10. |
CVE-2022-0375 | Medium | 4.8 | 2022-01-26 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-0374 | Medium | 5.4 | 2022-01-26 | Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. |
CVE-2022-21944 | High | 7.8 | 2022-01-26 | A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attacker… |
CVE-2022-23968 | High | 7.5 | 2022-01-26 | Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthentic… |
CVE-2022-0355 | High | 8.8 | 2022-01-26 | Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1. |
CVE-2022-23959 | Critical | 9.1 | 2022-01-26 | In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0… |
CVE-2022-23258 | Medium | 4.3 | 2022-01-25 | Microsoft Edge for Android Spoofing Vulnerability |
CVE-2022-23032 | Medium | 5.3 | 2022-01-25 | In all versions before 7.2.1.4, when proxy settings are configured in the network access resource of a BIG-IP APM system, connecting BIG-IP Edge Client on Mac… |
CVE-2022-23031 | Medium | 4.9 | 2022-01-25 | On BIG-IP FPS, ASM, and Advanced WAF versions 16.1.x before 16.1.1, 15.1.x before 15.1.4, and 14.1.x before 14.1.4.4, an XML External Entity (XXE) vulnerabilit… |
CVE-2022-23030 | Medium | 5.3 | 2022-01-25 | On version 16.1.x before 16.1.2, 15.1.x before 15.1.4.1, 14.1.x before 14.1.4.5, and all versions of 13.1.x, when the BIG-IP Virtual Edition (VE) uses the ixlv… |