2022 CVEs (page 28)
Page 28 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45792 | High | 7.8 | 2024-01-22 | Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting fil… |
CVE-2022-45790 | High | 8.6 | 2024-01-22 | The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow a… |
CVE-2022-47160 | Medium | 6.5 | 2024-01-19 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wpmet Wp Social Login and Register Social Counter.This issue affects Wp Social Logi… |
CVE-2022-45845 | Medium | 4.3 | 2024-01-19 | Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9. |
CVE-2022-45083 | Medium | 6.6 | 2024-01-19 | Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Pro… |
CVE-2022-40700 | High | 8.2 | 2024-01-19 | Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone… |
CVE-2022-42884 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in ThemeinProgress WIP Custom Login.This issue affects WIP Custom Login: from n/a through 1.2.7. |
CVE-2022-41790 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76. |
CVE-2022-41786 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a thr… |
CVE-2022-41990 | High | 7.1 | 2024-01-17 | Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza 3D Tag Cloud allows Stored XSS.This issue affects 3D Tag Cloud: from n/a through 3.8. |
CVE-2022-41695 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5. |
CVE-2022-41619 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8. |
CVE-2022-40702 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1… |
CVE-2022-40203 | Medium | 6.3 | 2024-01-17 | Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a… |
CVE-2022-38141 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from n/a through 2.8. |
CVE-2022-36418 | Medium | 6.5 | 2024-01-17 | Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0. |
CVE-2022-31021 | Low | 3.3 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. A weakness in the Hyperledger AnonCreds specification that is not mitigated in the Ursa and AnonCreds… |
CVE-2022-3899 | High | 8.1 | 2024-01-16 | The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowi… |
CVE-2022-3836 | Medium | 4.8 | 2024-01-16 | The Seed Social WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2022-3829 | Medium | 4.8 | 2024-01-16 | The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-3764 | High | 7.2 | 2024-01-16 | The plugin does not filter the "delete_entries" parameter from user requests, leading to an SQL Injection vulnerability. |
CVE-2022-3739 | Medium | 5.4 | 2024-01-16 | The WP Best Quiz WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as Author to perform Cro… |
CVE-2022-3604 | High | 7.8 | 2024-01-16 | The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection. |
CVE-2022-3194 | Medium | 5.4 | 2024-01-16 | The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks agains… |
CVE-2022-2413 | Medium | 5.4 | 2024-01-16 | The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logg… |
CVE-2022-23180 | Medium | 4.3 | 2024-01-16 | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated u… |
CVE-2022-23179 | Medium | 4.8 | 2024-01-16 | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, whic… |
CVE-2022-1760 | Medium | 4.3 | 2024-01-16 | The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2022-1618 | Medium | 6.1 | 2024-01-16 | The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as well as escaping in t… |
CVE-2022-1617 | Medium | 6.1 | 2024-01-16 | The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in… |
CVE-2022-1609 | Critical | 9.8 | 2024-01-16 | The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, a… |
CVE-2022-1563 | Medium | 5.3 | 2024-01-16 | The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via Graph… |
CVE-2022-1538 | High | 7.2 | 2024-01-16 | Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (suc… |
CVE-2022-0775 | Medium | 4.3 | 2024-01-16 | The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such a… |
CVE-2022-0402 | Medium | 6.1 | 2024-01-16 | The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputt… |
CVE-2022-4962 | Medium | 4.3 | 2024-01-12 | A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the c… |
CVE-2022-4961 | Medium | 5.5 | 2024-01-12 | A vulnerability was found in Weitong Mall 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file platf… |
CVE-2022-48620 | Critical | 9.8 | 2024-01-12 | uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxevents is a large number. |
CVE-2022-4960 | Low | 3.5 | 2024-01-12 | A vulnerability, which was classified as problematic, has been found in cloudfavorites favorites-web 1.3.0. Affected by this issue is some unknown functionalit… |
CVE-2022-48619 | Medium | 5.5 | 2024-01-12 | An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capabi… |
CVE-2022-4959 | Low | 3.5 | 2024-01-11 | A vulnerability classified as problematic was found in qkmc-rk redbbs 1.0. Affected by this vulnerability is an unknown functionality of the component Nickname… |
CVE-2022-4958 | Low | 3.5 | 2024-01-11 | A vulnerability classified as problematic has been found in qkmc-rk redbbs 1.0. Affected is an unknown function of the component Post Handler. The manipulation… |
CVE-2022-40361 | Medium | 6.1 | 2024-01-11 | Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint. |
CVE-2022-45794 | High | 8.6 | 2024-01-10 | An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC… |
CVE-2022-48577 | Medium | 5.5 | 2024-01-10 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data. |
CVE-2022-48504 | Medium | 5.5 | 2024-01-10 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data. |
CVE-2022-47965 | High | 7.8 | 2024-01-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privil… |
CVE-2022-47915 | High | 7.8 | 2024-01-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privil… |
CVE-2022-46721 | High | 7.8 | 2024-01-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privil… |
CVE-2022-46710 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be shared via iCloud l… |
CVE-2022-42839 | Low | 3.3 | 2024-01-10 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be a… |
CVE-2022-42816 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file s… |
CVE-2022-32931 | Medium | 5.5 | 2024-01-10 | This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app with root privileges may be able to access private info… |
CVE-2022-32919 | Medium | 4.7 | 2024-01-10 | The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Visiting a website that frames maliciou… |
CVE-2022-45793 | Medium | 5.5 | 2024-01-10 | Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result i… |
CVE-2022-46025 | Critical | 9.1 | 2024-01-10 | Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, suc… |
CVE-2022-48618 | High | 7.0 | 2024-01-09 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arb… |
CVE-2022-36765 | High | 7.0 | 2024-01-09 | EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Succe… |
CVE-2022-36764 | High | 7.0 | 2024-01-09 | EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful… |
CVE-2022-36763 | High | 7.0 | 2024-01-09 | EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful… |
CVE-2022-28975 | Medium | 5.4 | 2024-01-09 | A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2022-40696 | Low | 3.7 | 2024-01-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (A… |
CVE-2022-36352 | Medium | 6.3 | 2024-01-08 | Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profi… |
CVE-2022-34344 | Medium | 5.4 | 2024-01-08 | Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynam… |
CVE-2022-45354 | Medium | 5.3 | 2024-01-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7… |
CVE-2022-3328 | High | 7.8 | 2024-01-08 | Race condition in snap-confine's must_mkdir_and_open_with_perms() |
CVE-2022-2602 | Medium | 5.3 | 2024-01-08 | io_uring UAF, Unix SCM garbage collection |
CVE-2022-2588 | Medium | 5.3 | 2024-01-08 | It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handl… |
CVE-2022-2586 | Medium | 5.3 | 2024-01-08 | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. |
CVE-2022-2585 | Medium | 5.3 | 2024-01-08 | It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free. |
CVE-2022-46839 | Critical | 10.0 | 2024-01-05 | Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk –… |
CVE-2022-3864 | Medium | 4.5 | 2024-01-04 | A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After restart the device i… |
CVE-2022-2081 | High | 7.5 | 2024-01-04 | A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attack… |
CVE-2022-3010 | High | 7.5 | 2024-01-02 | The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calcula… |
CVE-2022-46487 | High | 7.8 | 2023-12-30 | Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for Intel SGX allows a local… |
CVE-2022-46486 | Medium | 5.5 | 2023-12-30 | A lack of pointer-validation logic in the __scone_dispatch component of SCONE before v5.8.0 for Intel SGX allows attackers to access sensitive information. |
CVE-2022-44589 | High | 8.1 | 2023-12-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication… |
CVE-2022-36399 | Medium | 5.3 | 2023-12-28 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affect… |
CVE-2022-34268 | Critical | 9.8 | 2023-12-25 | An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the ho… |
CVE-2022-34267 | Critical | 9.8 | 2023-12-25 | An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Jav… |
CVE-2022-43675 | Medium | 6.1 | 2023-12-25 | An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename paramet… |
CVE-2022-41762 | Medium | 6.1 | 2023-12-25 | An issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the Network Element Manager via any parameter to log.pl, the benc… |
CVE-2022-41761 | Medium | 6.5 | 2023-12-25 | An issue was discovered in NOKIA NFM-T R19.9. An Absolute Path Traversal vulnerability exists under /cgi-bin/R19.9/viewlog.pl of the VM Manager WebUI via the l… |
CVE-2022-41760 | Medium | 6.5 | 2023-12-25 | An issue was discovered in NOKIA NFM-T R19.9. Relative Path Traversal can occur under /oms1350/data/cpb/log of the Network Element Manager via the filename par… |
CVE-2022-39822 | High | 8.8 | 2023-12-25 | In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An auth… |
CVE-2022-39820 | Medium | 6.5 | 2023-12-25 | In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KE… |
CVE-2022-39818 | High | 8.8 | 2023-12-25 | In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter. This allows… |
CVE-2022-39337 | High | 7.5 | 2023-12-22 | Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1… |
CVE-2022-47532 | Critical | 9.8 | 2023-12-22 | FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users§ion=cpanel&page=list request. |
CVE-2022-45377 | Medium | 6.5 | 2023-12-21 | Unrestricted Upload of File with Dangerous Type vulnerability in Glen Don L. Mongaya Drag and Drop Multiple File Upload for WooCommerce.This issue affects Drag… |
CVE-2022-44684 | Medium | 6.5 | 2023-12-20 | Windows Local Session Manager (LSM) Denial of Service Vulnerability |
CVE-2022-47599 | Medium | 5.5 | 2023-12-20 | Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit… |
CVE-2022-47597 | Medium | 5.3 | 2023-12-20 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Po… |
CVE-2022-43450 | Medium | 4.3 | 2023-12-19 | Authorization Bypass Through User-Controlled Key vulnerability in XWP Stream.This issue affects Stream: from n/a through 3.9.2. |
CVE-2022-45809 | Medium | 5.3 | 2023-12-19 | Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Ricard Torres Thumbs Rating.This issue affects Thumbs Rating: from n/a through 5.0.0. |
CVE-2022-40312 | Medium | 5.5 | 2023-12-18 | Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fu… |
CVE-2022-41677 | Medium | 5.3 | 2023-12-18 | An information disclosure vulnerability was discovered in Bosch IP camera devices allowing an unauthenticated attacker to retrieve information (like capabiliti… |
CVE-2022-24351 | Medium | 4.7 | 2023-12-16 | TOCTOU race-condition vulnerability in Insyde InsydeH2O with Kernel 5.2 before version 05.27.29, Kernel 5.3 before version 05.36.29, Kernel 5.4 version before… |
CVE-2022-45365 | High | 7.1 | 2023-12-14 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aleksandar Urošević Stock Ticker allows Reflected XSS.Thi… |
CVE-2022-43843 | Medium | 5.9 | 2023-12-14 | IBM Spectrum Scale 5.1.5.0 through 5.1.5.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive informat… |