2022 CVEs (page 265)
Page 265 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-22266 | Medium | 4.0 | 2022-01-10 | (Applicable to China models only) Unprotected WifiEvaluationService in TencentWifiSecurity application prior to SMR Jan-2022 Release 1 allows untrusted applica… |
CVE-2022-22265 | Medium | 5.0 | 2022-01-10 | An improper check or handling of exceptional conditions in NPU driver prior to SMR Jan-2022 Release 1 allows arbitrary memory write and code execution. |
CVE-2022-22264 | High | 7.7 | 2022-01-10 | Improper sanitization of incoming intent in Dressroom prior to SMR Jan-2022 Release 1 allows local attackers to read and write arbitrary files without permissi… |
CVE-2022-22263 | Medium | 4.0 | 2022-01-10 | Unprotected dynamic receiver in SecSettings prior to SMR Jan-2022 Release 1 allows untrusted applications to launch arbitrary activity. |
CVE-2022-21823 | Medium | 5.5 | 2022-01-10 | A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally auth… |
CVE-2022-21667 | High | 7.5 | 2022-01-10 | soketi is an open-source WebSockets server. There is an unhandled case when reading POST requests which results in the server crashing if it could not read the… |
CVE-2022-0133 | High | 7.5 | 2022-01-10 | peertube is vulnerable to Improper Access Control |
CVE-2022-0132 | High | 7.5 | 2022-01-10 | peertube is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2022-21664 | High | 7.4 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to lack of proper sanitization in one of t… |
CVE-2022-21663 | Medium | 6.6 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role ca… |
CVE-2022-21662 | High | 8.0 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Low-privileged authenticated users (like autho… |
CVE-2022-21661 | High | 8.0 | 2022-01-06 | WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. Due to improper sanitization in WP_Query, ther… |
CVE-2022-0128 | High | 7.8 | 2022-01-06 | vim is vulnerable to Out-of-bounds Read |
CVE-2022-22707 | Medium | 5.9 | 2022-01-06 | In lighttpd 1.4.46 through 1.4.63, the mod_extforward_Forwarded function of the mod_extforward plugin has a stack-based buffer overflow (4 bytes representing -… |
CVE-2022-22704 | Critical | 9.8 | 2022-01-06 | The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd w… |
CVE-2022-0122 | Medium | 6.1 | 2022-01-06 | forge is vulnerable to URL Redirection to Untrusted Site |
CVE-2022-0121 | High | 8.0 | 2022-01-06 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue affects hopps… |
CVE-2022-21653 | Medium | 5.9 | 2022-01-05 | Jawn is an open source JSON parser. Extenders of the `org.typelevel.jawn.SimpleFacade` and `org.typelevel.jawn.MutableFacade` who don't override `objectContext… |
CVE-2022-21652 | Low | 3.5 | 2022-01-05 | Shopware is an open source e-commerce software platform. In affected versions shopware would not invalidate a user session in the event of a password change. W… |
CVE-2022-21651 | Medium | 6.8 | 2022-01-05 | Shopware is an open source e-commerce software platform. An open redirect vulnerability has been discovered. Users may be arbitrary redirected due to incomplet… |
CVE-2022-21642 | Medium | 4.3 | 2022-01-05 | Discourse is an open source platform for community discussion. In affected versions when composing a message from topic the composer user suggestions reveals w… |
CVE-2022-22111 | High | 8.8 | 2022-01-05 | In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able t… |
CVE-2022-22110 | High | 7.5 | 2022-01-05 | In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password… |
CVE-2022-22109 | Medium | 5.4 | 2022-01-05 | In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious… |
CVE-2022-22108 | Medium | 4.3 | 2022-01-05 | In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user)… |
CVE-2022-22107 | Medium | 4.3 | 2022-01-05 | In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user)… |
CVE-2022-21650 | High | 7.6 | 2022-01-04 | Convos is an open source multi-user chat that runs in a web browser. You can't use SVG extension in Convos' chat window, but you can upload a file with an .htm… |
CVE-2022-21649 | High | 7.6 | 2022-01-04 | Convos is an open source multi-user chat that runs in a web browser. Characters starting with "https://" in the chat window create an <a> tag. Stored XSS vulne… |
CVE-2022-21648 | High | 8.2 | 2022-01-04 | Latte is an open source template engine for PHP. Versions since 2.8.0 Latte has included a template sandbox and in affected versions it has been found that a s… |
CVE-2022-21647 | High | 7.7 | 2022-01-04 | CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attacke… |
CVE-2022-21644 | Critical | 9.1 | 2022-01-04 | USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via usersearch.php. In search terms provided by the u… |
CVE-2022-21643 | Critical | 10.0 | 2022-01-04 | USOC is an open source CMS with a focus on simplicity. In affected versions USOC allows for SQL injection via register.php. In particular usernames, email addr… |
CVE-2022-0086 | Critical | 9.8 | 2022-01-04 | uppy is vulnerable to Server-Side Request Forgery (SSRF) |
CVE-2022-20023 | Medium | 6.5 | 2022-01-04 | In Bluetooth, there is a possible application crash due to bluetooth flooding a device with LMP_AU_rand packet. This could lead to remote denial of service of… |
CVE-2022-20022 | Medium | 6.5 | 2022-01-04 | In Bluetooth, there is a possible link disconnection due to bluetooth does not properly handle a connection attempt from a host with the same BD address as the… |
CVE-2022-20021 | Medium | 6.5 | 2022-01-04 | In Bluetooth, there is a possible application crash due to bluetooth does not properly handle the reception of multiple LMP_host_connection_req. This could lea… |
CVE-2022-20020 | Medium | 5.5 | 2022-01-04 | In libvcodecdrv, there is a possible information disclosure due to a missing bounds check. This could lead to local information disclosure with no additional e… |
CVE-2022-20019 | Medium | 5.5 | 2022-01-04 | In libMtkOmxGsmDec, there is a possible information disclosure due to an incorrect bounds check. This could lead to local information disclosure with no additi… |
CVE-2022-20018 | Medium | 4.4 | 2022-01-04 | In seninf driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execution p… |
CVE-2022-20016 | Medium | 6.7 | 2022-01-04 | In vow driver, there is a possible memory corruption due to improper locking. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-20015 | Medium | 4.4 | 2022-01-04 | In kd_camera_hw driver, there is a possible information disclosure due to uninitialized data. This could lead to local information disclosure with System execu… |
CVE-2022-20014 | Medium | 6.7 | 2022-01-04 | In vow driver, there is a possible memory corruption due to improper input validation. This could lead to local escalation of privilege with System execution p… |
CVE-2022-20013 | Medium | 6.4 | 2022-01-04 | In vow driver, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-20012 | High | 7.8 | 2022-01-04 | In mdp driver, there is a possible memory corruption due to an integer overflow. This could lead to local escalation of privilege with no additional execution… |
CVE-2022-0083 | Medium | 5.3 | 2022-01-04 | livehelperchat is vulnerable to Generation of Error Message Containing Sensitive Information |
CVE-2022-0079 | Medium | 5.3 | 2022-01-03 | showdoc is vulnerable to Generation of Error Message Containing Sensitive Information |
CVE-2022-0080 | Critical | 9.8 | 2022-01-02 | mruby is vulnerable to Heap-based Buffer Overflow |
CVE-2022-22293 | Medium | 5.4 | 2022-01-02 | admin/limits.php in Dolibarr 7.0.2 allows HTML injection, as demonstrated by the MAIN_MAX_DECIMALS_TOT parameter. |