2022 CVEs (page 27)
Page 27 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36029 | Critical | 9.1 | 2024-04-25 | Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked… |
CVE-2022-36028 | Critical | 9.1 | 2024-04-25 | Greenlight is an end-user interface for BigBlueButton servers. Versions prior to 2.13.0 have an open redirect vulnerability in the Login page due to unchecked… |
CVE-2022-45852 | Medium | 6.5 | 2024-04-24 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in FormAssembly / Drew Buschhorn WP-FormAssembly allows Path Trave… |
CVE-2022-46897 | Medium | 5.3 | 2024-04-22 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. The CapsuleIFWUSmm driver does not check the return value from a method or function. T… |
CVE-2022-35503 | High | 7.5 | 2024-04-22 | Improper verification of a user input in Open Source MANO v7-v12 allows an authenticated attacker to execute arbitrary code within the LCM module container via… |
CVE-2022-34562 | Medium | 6.1 | 2024-04-22 | A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the s… |
CVE-2022-34561 | Medium | 4.3 | 2024-04-22 | A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the v… |
CVE-2022-34560 | High | 7.1 | 2024-04-22 | A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the H… |
CVE-2022-40745 | Medium | 5.5 | 2024-04-19 | IBM Aspera Faspex 5.0.0 through 5.0.7 could allow a local user to obtain sensitive information due to weaker than expected security. IBM X-Force ID: 236452. |
CVE-2022-47151 | High | 8.6 | 2024-04-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plug… |
CVE-2022-41698 | Medium | 6.5 | 2024-04-17 | Missing Authorization vulnerability in Layered If Menu.This issue affects If Menu: from n/a through 0.16.3. |
CVE-2022-24810 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malfor… |
CVE-2022-24809 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malform… |
CVE-2022-24808 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malfor… |
CVE-2022-24807 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASE… |
CVE-2022-24806 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an I… |
CVE-2022-24805 | Medium | 6.5 | 2024-04-16 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of… |
CVE-2022-40211 | Medium | 5.9 | 2024-04-12 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GiveWP allows Stored XSS.This issue affects GiveWP: from… |
CVE-2022-47604 | Medium | 4.3 | 2024-04-11 | Missing Authorization vulnerability in junkcoder, ristoniinemets AJAX Thumbnail Rebuild.This issue affects AJAX Thumbnail Rebuild: from n/a through 1.13. |
CVE-2022-44633 | Medium | 6.5 | 2024-04-11 | Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1. |
CVE-2022-4965 | Medium | 6.1 | 2024-04-09 | The Invitation Code Content Restriction Plugin from CreativeMinds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘target_id’ para… |
CVE-2022-47894 | Medium | 5.3 | 2024-04-09 | Improper Input Validation vulnerability in Apache Zeppelin SAP.This issue affects Apache Zeppelin SAP: from 0.8.0 before 0.11.0. As this project is retired, w… |
CVE-2022-43216 | Critical | 9.1 | 2024-04-08 | AbrhilSoft Employee's Portal before v5.6.2 was discovered to contain a SQL injection vulnerability in the login page. |
CVE-2022-4966 | Low | 3.5 | 2024-04-01 | A vulnerability was found in sequentech admin-console up to 6.1.7 and classified as problematic. Affected by this issue is some unknown functionality of the co… |
CVE-2022-47153 | High | 7.1 | 2024-03-29 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPJobBoard Jobeleon Theme allows Reflected XSS.This issue… |
CVE-2022-45850 | Medium | 6.1 | 2024-03-28 | Cross-Site Request Forgery (CSRF) vulnerability in Nickys Image Map Pro allows Stored XSS.This issue affects Image Map Pro: from n/a before 5.6.9. |
CVE-2022-45847 | Medium | 6.1 | 2024-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in WPAssist.Me WordPress Countdown Widget allows Cross-Site Scripting (XSS).This issue affects WordPress Countd… |
CVE-2022-45851 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in ShareThis ShareThis Dashboard for Google Analytics.This issue affects ShareThis Dashboard for Google Analytics: from n/a… |
CVE-2022-45356 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1. |
CVE-2022-45352 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1. |
CVE-2022-45351 | Medium | 5.4 | 2024-03-25 | Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1. |
CVE-2022-45349 | Medium | 4.3 | 2024-03-25 | Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 26.6.1. |
CVE-2022-44626 | Medium | 6.3 | 2024-03-25 | Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.1.20. |
CVE-2022-38057 | Medium | 6.5 | 2024-03-25 | Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1. |
CVE-2022-36407 | Critical | 9.9 | 2024-03-25 | Insertion of Sensitive Information into Log File vulnerability in Hitachi Virtual Storage Platform, Hitachi Virtual Storage Platform VP9500, Hitachi Virtual St… |
CVE-2022-32756 | Low | 2.7 | 2024-03-22 | IBM Security Verify Directory 10.0.0 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the b… |
CVE-2022-32754 | Medium | 4.8 | 2024-03-22 | IBM Security Verify Directory 10.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI th… |
CVE-2022-32753 | Medium | 4.5 | 2024-03-22 | IBM Security Verify Directory 10.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2022-32751 | Medium | 5.3 | 2024-03-22 | IBM Security Verify Directory 10.0.0 could disclose sensitive server information that could be used in further attacks against the system. IBM X-Force ID: 22… |
CVE-2022-44595 | Medium | 5.3 | 2024-03-21 | Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0. |
CVE-2022-4963 | Medium | 5.5 | 2024-03-21 | A vulnerability was found in Folio Spring Module Core up to 1.1.5. It has been rated as critical. Affected by this issue is the function dropSchema of the file… |
CVE-2022-47037 | High | 7.5 | 2024-03-18 | Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials. |
CVE-2022-47036 | Critical | 9.8 | 2024-03-18 | Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an MD5 hash. It can be… |
CVE-2022-34321 | High | 8.2 | 2024-03-12 | Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats endpoint without authentication. The vulnerable… |
CVE-2022-32257 | Critical | 9.8 | 2024-03-12 | A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.2). The affected application consists of a web service that lacks proper… |
CVE-2022-46070 | High | 7.5 | 2024-03-11 | GV-ASManager V6.0.1.0 contains a Local File Inclusion vulnerability in GeoWebServer via Path. |
CVE-2022-43855 | Medium | 6.2 | 2024-03-08 | IBM SPSS Statistics 26.0, 27.0.1, and 28.0 IO Module could allow a local user to create multiple files that could exhaust the file handles capacity and cause a… |
CVE-2022-46499 | High | 8.8 | 2024-03-07 | Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_admin_view_single_patient.php. |
CVE-2022-46498 | Low | 2.7 | 2024-03-07 | Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at his_admin_view_single_employee.php. |
CVE-2022-46497 | High | 8.1 | 2024-03-07 | Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_doc_view_single_patien.php. |
CVE-2022-46091 | Medium | 4.7 | 2024-03-07 | Cross Site Scripting (XSS) vulnerability in the feedback form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2022-46089 | Medium | 6.1 | 2024-03-07 | Cross Site Scripting (XSS) vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to execute arbitrary web scri… |
CVE-2022-22399 | Medium | 5.4 | 2024-03-05 | IBM Aspera Faspex 5.0.0 and 5.0.1 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an atta… |
CVE-2022-46088 | Medium | 6.1 | 2024-03-05 | Online Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the feedback form. |
CVE-2022-48630 | Medium | 5.5 | 2024-03-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZ The commit refer… |
CVE-2022-48629 | High | 8.1 | 2024-03-05 | In the Linux kernel, the following vulnerability has been resolved: crypto: qcom-rng - ensure buffer for generate is completely filled The generate function… |
CVE-2022-43890 | Medium | 5.3 | 2024-03-04 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks again… |
CVE-2022-43880 | Medium | 4.4 | 2024-03-03 | IBM QRadar WinCollect Agent 10.0 through 10.1.2 could allow a privileged user to cause a denial of service. IBM X-Force ID: 240151. |
CVE-2022-48628 | Medium | 5.5 | 2024-03-02 | In the Linux kernel, the following vulnerability has been resolved: ceph: drop messages from MDS when unmounting When unmounting all the dirty buffers will b… |
CVE-2022-48627 | Medium | 5.5 | 2024-03-02 | In the Linux kernel, the following vulnerability has been resolved: vt: fix memory overlapping when deleting chars in the buffer A memory overlapping copy oc… |
CVE-2022-36677 | Medium | 6.1 | 2024-02-29 | Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document. |
CVE-2022-34270 | Critical | 9.8 | 2024-02-29 | An issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the Administrator role via UserWSUserManager. |
CVE-2022-34269 | High | 8.8 | 2024-02-29 | An issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can perform a ws-legacy/load_dtd?system_id= blind SSRF attack to de… |
CVE-2022-48626 | High | 7.8 | 2024-02-26 | In the Linux kernel, the following vulnerability has been resolved: moxart: fix potential use-after-free on remove path It was reported that the mmc host str… |
CVE-2022-34357 | Medium | 6.5 | 2024-02-26 | IBM Cognos Analytics Mobile Server 11.1.7, 11.2.4, and 12.0.0 is vulnerable to Denial of Service due to due to weak or absence of rate limiting. By making unli… |
CVE-2022-43842 | High | 8.6 | 2024-02-23 | IBM Aspera Console 3.4.0 through 3.4.2 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the att… |
CVE-2022-25377 | High | 7.5 | 2024-02-22 | The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ directory traversal. I… |
CVE-2022-45179 | Medium | 5.4 | 2024-02-21 | An issue was discovered in LIVEBOX Collaboration vDesk through v031. A basic XSS vulnerability exists under the /api/v1/vdeskintegration/todo/createorupdate en… |
CVE-2022-45177 | High | 7.5 | 2024-02-21 | An issue was discovered in LIVEBOX Collaboration vDesk through v031. An Observable Response Discrepancy can occur under the /api/v1/vdeskintegration/user/isena… |
CVE-2022-45169 | Medium | 5.4 | 2024-02-21 | An issue was discovered in LIVEBOX Collaboration vDesk through v031. A URL Redirection to an Untrusted Site (Open Redirect) can occur under the /api/v1/notific… |
CVE-2022-45320 | Medium | 6.3 | 2024-02-20 | Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticated users to become… |
CVE-2022-48625 | High | 7.5 | 2024-02-20 | Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary. |
CVE-2022-48624 | High | 7.8 | 2024-02-19 | close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE. |
CVE-2022-48621 | High | 7.5 | 2024-02-18 | Vulnerability of missing authentication for critical functions in the Wi-Fi module.Successful exploitation of this vulnerability may affect service confidentia… |
CVE-2022-42443 | Low | 2.2 | 2024-02-17 | An undisclosed issue in Trusteer iOS SDK for mobile versions prior to 5.7 and Trusteer Android SDK for mobile versions prior to 5.7 may allow uploading of file… |
CVE-2022-41738 | High | 7.5 | 2024-02-17 | IBM Storage Scale Container Native Storage Access 5.1.2.1 -through 5.1.7.0 could allow an attacker to initiate connections to containers from external networks… |
CVE-2022-41737 | High | 7.1 | 2024-02-17 | IBM Storage Scale Container Native Storage Access 5.1.2.1 through 5.1.7.0 could allow a local attacker to initiate connections from a container outside the cur… |
CVE-2022-23093 | Medium | 6.5 | 2024-02-15 | ping reads raw IP packets from the network to process responses in the pr_pack() function. As part of processing a response ping has to reconstruct the IP hea… |
CVE-2022-23092 | High | 8.8 | 2024-02-15 | The implementation of lib9p's handling of RWALK messages was missing a bounds check needed when unpacking the message contents. The missing check means that t… |
CVE-2022-23091 | Medium | 4.0 | 2024-02-15 | A particular case of memory sharing is mishandled in the virtual memory system. This is very similar to SA-21:08.vm, but with a different root cause. An unpr… |
CVE-2022-23090 | High | 7.7 | 2024-02-15 | The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may cause the referenc… |
CVE-2022-23089 | Medium | 4.7 | 2024-02-15 | When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An ou… |
CVE-2022-23088 | Critical | 9.8 | 2024-02-15 | The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-F… |
CVE-2022-23087 | High | 8.8 | 2024-02-15 | The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP che… |
CVE-2022-23086 | High | 7.8 | 2024-02-15 | Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size heade… |
CVE-2022-23085 | High | 8.2 | 2024-02-15 | A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memo… |
CVE-2022-23084 | High | 7.5 | 2024-02-15 | The total size of the user-provided nmreq to nmreq_copyin() was first computed and then trusted during the copyin. This time-of-check to time-of-use bug could… |
CVE-2022-48220 | Medium | 6.4 | 2024-02-14 | Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass… |
CVE-2022-48219 | Medium | 6.4 | 2024-02-14 | Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass… |
CVE-2022-48623 | Critical | 9.1 | 2024-02-13 | The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a den… |
CVE-2022-22506 | Medium | 4.6 | 2024-02-12 | IBM Robotic Process Automation 21.0.2 contains a vulnerability that could allow user ids may be exposed across tenants. IBM X-Force ID: 227293. |
CVE-2022-34311 | Medium | 4.3 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the user's session due to insufficiently pr… |
CVE-2022-34309 | Medium | 5.9 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2022-38714 | Medium | 4.9 | 2024-02-12 | IBM DataStage on Cloud Pak for Data 4.0.6 to 4.5.2 stores sensitive credential information that can be read by a privileged user. IBM X-Force ID: 235060. |
CVE-2022-34310 | Medium | 5.9 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2022-34381 | Critical | 9.1 | 2024-02-02 | Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain an unmaintained third-party component vu… |
CVE-2022-40744 | Medium | 4.8 | 2024-02-02 | IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2022-47072 | Critical | 9.8 | 2024-01-31 | SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to run arbitrary SQL commands via the Find parameter in the Select Classi… |
CVE-2022-48622 | High | 7.8 | 2024-01-26 | In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c… |
CVE-2022-4964 | Medium | 5.5 | 2024-01-24 | Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set. |