2022 CVEs (page 28)
Page 28 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23090 | High | 7.7 | 2024-02-15 | The aio_aqueue function, used by the lio_listio system call, fails to release a reference to a credential in an error case. An attacker may cause the referenc… |
CVE-2022-23089 | Medium | 4.7 | 2024-02-15 | When dumping core and saving process information, proc_getargv() might return an sbuf which have a sbuf_len() of 0 or -1, which is not properly handled. An ou… |
CVE-2022-23088 | Critical | 9.8 | 2024-02-15 | The 802.11 beacon handling routine failed to validate the length of an IEEE 802.11s Mesh ID before copying it to a heap-allocated buffer. While a FreeBSD Wi-F… |
CVE-2022-23087 | High | 8.8 | 2024-02-15 | The e1000 network adapters permit a variety of modifications to an Ethernet packet when it is being transmitted. These include the insertion of IP and TCP che… |
CVE-2022-23086 | High | 7.8 | 2024-02-15 | Handlers for *_CFG_PAGE read / write ioctls in the mpr, mps, and mpt drivers allocated a buffer of a caller-specified size, but copied to it a fixed size heade… |
CVE-2022-23085 | High | 8.2 | 2024-02-15 | A user-provided integer option was passed to nmreq_copyin() without checking if it would overflow. This insufficient bounds checking could lead to kernel memo… |
CVE-2022-23084 | High | 7.5 | 2024-02-15 | The total size of the user-provided nmreq to nmreq_copyin() was first computed and then trusted during the copyin. This time-of-check to time-of-use bug could… |
CVE-2022-48220 | Medium | 6.4 | 2024-02-14 | Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass… |
CVE-2022-48219 | Medium | 6.4 | 2024-02-14 | Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass… |
CVE-2022-48623 | Critical | 9.1 | 2024-02-13 | The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive information or cause a den… |
CVE-2022-22506 | Medium | 4.6 | 2024-02-12 | IBM Robotic Process Automation 21.0.2 contains a vulnerability that could allow user ids may be exposed across tenants. IBM X-Force ID: 227293. |
CVE-2022-34311 | Medium | 4.3 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 could allow a user with physical access to the web browser to gain access to the user's session due to insufficiently pr… |
CVE-2022-34309 | Medium | 5.9 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2022-38714 | Medium | 4.9 | 2024-02-12 | IBM DataStage on Cloud Pak for Data 4.0.6 to 4.5.2 stores sensitive credential information that can be read by a privileged user. IBM X-Force ID: 235060. |
CVE-2022-34310 | Medium | 5.9 | 2024-02-12 | IBM CICS TX Standard and Advanced 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information… |
CVE-2022-34381 | Critical | 9.1 | 2024-02-02 | Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain an unmaintained third-party component vu… |
CVE-2022-40744 | Medium | 4.8 | 2024-02-02 | IBM Aspera Faspex 5.0.6 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alt… |
CVE-2022-47072 | Critical | 9.8 | 2024-01-31 | SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to run arbitrary SQL commands via the Find parameter in the Select Classi… |
CVE-2022-48622 | High | 7.8 | 2024-01-26 | In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_load_chunk in io-ani.c… |
CVE-2022-4964 | Medium | 5.5 | 2024-01-24 | Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set. |
CVE-2022-45792 | High | 7.8 | 2024-01-22 | Project files may contain malicious contents which the software will use to create files on the filesystem. This allows directory traversal and overwriting fil… |
CVE-2022-45790 | High | 8.6 | 2024-01-22 | The Omron FINS protocol has an authenticated feature to prevent access to memory regions. Authentication is susceptible to bruteforce attack, which may allow a… |
CVE-2022-47160 | Medium | 6.5 | 2024-01-19 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wpmet Wp Social Login and Register Social Counter.This issue affects Wp Social Logi… |
CVE-2022-45845 | Medium | 4.3 | 2024-01-19 | Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.This issue affects Smart Slider 3: from n/a through 3.5.1.9. |
CVE-2022-45083 | Medium | 6.6 | 2024-01-19 | Deserialization of Untrusted Data vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Pro… |
CVE-2022-40700 | High | 8.2 | 2024-01-19 | Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone… |
CVE-2022-42884 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in ThemeinProgress WIP Custom Login.This issue affects WIP Custom Login: from n/a through 1.2.7. |
CVE-2022-41790 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.1.76. |
CVE-2022-41786 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in WP Job Portal WP Job Portal – A Complete Job Board.This issue affects WP Job Portal – A Complete Job Board: from n/a thr… |
CVE-2022-41990 | High | 7.1 | 2024-01-17 | Cross-Site Request Forgery (CSRF) vulnerability in Vinoj Cardoza 3D Tag Cloud allows Stored XSS.This issue affects 3D Tag Cloud: from n/a through 3.8. |
CVE-2022-41695 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in SedLex Traffic Manager.This issue affects Traffic Manager: from n/a through 1.4.5. |
CVE-2022-41619 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8. |
CVE-2022-40702 | Medium | 5.4 | 2024-01-17 | Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1… |
CVE-2022-40203 | Medium | 6.3 | 2024-01-17 | Missing Authorization vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce.This issue affects Advanced Dynamic Pricing for WooCommerce: from n/a… |
CVE-2022-38141 | Medium | 4.3 | 2024-01-17 | Missing Authorization vulnerability in Zorem Sales Report Email for WooCommerce.This issue affects Sales Report Email for WooCommerce: from n/a through 2.8. |
CVE-2022-36418 | Medium | 6.5 | 2024-01-17 | Missing Authorization vulnerability in Vagary Digital HREFLANG Tags Lite.This issue affects HREFLANG Tags Lite: from n/a through 2.0.0. |
CVE-2022-31021 | Low | 3.3 | 2024-01-16 | Ursa is a cryptographic library for use with blockchains. A weakness in the Hyperledger AnonCreds specification that is not mitigated in the Ursa and AnonCreds… |
CVE-2022-3899 | High | 8.1 | 2024-01-16 | The 3dprint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowi… |
CVE-2022-3836 | Medium | 4.8 | 2024-01-16 | The Seed Social WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2022-3829 | Medium | 4.8 | 2024-01-16 | The Font Awesome 4 Menus WordPress plugin through 4.7.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-3764 | High | 7.2 | 2024-01-16 | The plugin does not filter the "delete_entries" parameter from user requests, leading to an SQL Injection vulnerability. |
CVE-2022-3739 | Medium | 5.4 | 2024-01-16 | The WP Best Quiz WordPress plugin through 1.0 does not sanitize and escape some parameters, which could allow users with a role as low as Author to perform Cro… |
CVE-2022-3604 | High | 7.8 | 2024-01-16 | The Contact Form Entries WordPress plugin before 1.3.0 does not validate data when its output in a CSV file, which could lead to CSV injection. |
CVE-2022-3194 | Medium | 5.4 | 2024-01-16 | The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks agains… |
CVE-2022-2413 | Medium | 5.4 | 2024-01-16 | The Slide Anything WordPress plugin before 2.3.47 does not properly sanitize or escape the slide title before outputting it in the admin pages, allowing a logg… |
CVE-2022-23180 | Medium | 4.3 | 2024-01-16 | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.4 doesn't have authorisation and nonce checks, which could allow any authenticated u… |
CVE-2022-23179 | Medium | 4.8 | 2024-01-16 | The Contact Form & Lead Form Elementor Builder WordPress plugin before 1.7.0 does not escape some of its form fields before outputting them in attributes, whic… |
CVE-2022-1760 | Medium | 4.3 | 2024-01-16 | The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in a… |
CVE-2022-1618 | Medium | 6.1 | 2024-01-16 | The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as well as escaping in t… |
CVE-2022-1617 | Medium | 6.1 | 2024-01-16 | The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in… |
CVE-2022-1609 | Critical | 9.8 | 2024-01-16 | The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, a… |
CVE-2022-1563 | Medium | 5.3 | 2024-01-16 | The WPGraphQL WooCommerce WordPress plugin before 0.12.4 does not prevent unauthenticated attackers from enumerating a shop's coupon codes and values via Graph… |
CVE-2022-1538 | High | 7.2 | 2024-01-16 | Theme Demo Import WordPress plugin before 1.1.1 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (suc… |
CVE-2022-0775 | Medium | 4.3 | 2024-01-16 | The WooCommerce WordPress plugin before 6.2.1 does not have proper authorisation check when deleting reviews, which could allow any authenticated users, such a… |
CVE-2022-0402 | Medium | 6.1 | 2024-01-16 | The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputt… |
CVE-2022-4962 | Medium | 4.3 | 2024-01-12 | A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the c… |
CVE-2022-4961 | Medium | 5.5 | 2024-01-12 | A vulnerability was found in Weitong Mall 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file platf… |
CVE-2022-48620 | Critical | 9.8 | 2024-01-12 | uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxevents is a large number. |
CVE-2022-4960 | Low | 3.5 | 2024-01-12 | A vulnerability, which was classified as problematic, has been found in cloudfavorites favorites-web 1.3.0. Affected by this issue is some unknown functionalit… |
CVE-2022-48619 | Medium | 5.5 | 2024-01-12 | An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause a denial of service (panic) because input_set_capabi… |
CVE-2022-4959 | Low | 3.5 | 2024-01-11 | A vulnerability classified as problematic was found in qkmc-rk redbbs 1.0. Affected by this vulnerability is an unknown functionality of the component Nickname… |
CVE-2022-4958 | Low | 3.5 | 2024-01-11 | A vulnerability classified as problematic has been found in qkmc-rk redbbs 1.0. Affected is an unknown function of the component Post Handler. The manipulation… |
CVE-2022-40361 | Medium | 6.1 | 2024-01-11 | Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint. |
CVE-2022-45794 | High | 8.6 | 2024-01-10 | An attacker with network access to the affected PLC (CJ-series and CS-series PLCs, all versions) may use a network protocol to read and write files on the PLC… |
CVE-2022-48577 | Medium | 5.5 | 2024-01-10 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data. |
CVE-2022-48504 | Medium | 5.5 | 2024-01-10 | The issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data. |
CVE-2022-47965 | High | 7.8 | 2024-01-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privil… |
CVE-2022-47915 | High | 7.8 | 2024-01-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privil… |
CVE-2022-46721 | High | 7.8 | 2024-01-10 | The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privil… |
CVE-2022-46710 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be shared via iCloud l… |
CVE-2022-42839 | Low | 3.3 | 2024-01-10 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be a… |
CVE-2022-42816 | Medium | 5.5 | 2024-01-10 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file s… |
CVE-2022-32931 | Medium | 5.5 | 2024-01-10 | This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app with root privileges may be able to access private info… |
CVE-2022-32919 | Medium | 4.7 | 2024-01-10 | The issue was addressed with improved UI handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Visiting a website that frames maliciou… |
CVE-2022-45793 | Medium | 5.5 | 2024-01-10 | Sysmac Studio installs executables in a directory with poor permissions. This can allow a locally-authenticated attacker to overwrite files which will result i… |
CVE-2022-46025 | Critical | 9.1 | 2024-01-10 | Totolink N200RE_V5 V9.3.5u.6255_B20211224 is vulnerable to Incorrect Access Control. The device allows remote attackers to obtain Wi-Fi system information, suc… |
CVE-2022-48618 | High | 7.0 | 2024-01-09 | The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arb… |
CVE-2022-36765 | High | 7.0 | 2024-01-09 | EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Succe… |
CVE-2022-36764 | High | 7.0 | 2024-01-09 | EDK2 is susceptible to a vulnerability in the Tcg2MeasurePeImage() function, allowing a user to trigger a heap buffer overflow via a local network. Successful… |
CVE-2022-36763 | High | 7.0 | 2024-01-09 | EDK2 is susceptible to a vulnerability in the Tcg2MeasureGptTable() function, allowing a user to trigger a heap buffer overflow via a local network. Successful… |
CVE-2022-28975 | Medium | 5.4 | 2024-01-09 | A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2022-40696 | Low | 3.7 | 2024-01-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (A… |
CVE-2022-36352 | Medium | 6.3 | 2024-01-08 | Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profi… |
CVE-2022-34344 | Medium | 5.4 | 2024-01-08 | Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynam… |
CVE-2022-45354 | Medium | 5.3 | 2024-01-08 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7… |
CVE-2022-3328 | High | 7.8 | 2024-01-08 | Race condition in snap-confine's must_mkdir_and_open_with_perms() |
CVE-2022-2602 | Medium | 5.3 | 2024-01-08 | io_uring UAF, Unix SCM garbage collection |
CVE-2022-2588 | Medium | 5.3 | 2024-01-08 | It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before freeing it if its handl… |
CVE-2022-2586 | Medium | 5.3 | 2024-01-08 | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was deleted. |
CVE-2022-2585 | Medium | 5.3 | 2024-01-08 | It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-after-free. |
CVE-2022-46839 | Critical | 10.0 | 2024-01-05 | Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk –… |
CVE-2022-3864 | Medium | 4.5 | 2024-01-04 | A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After restart the device i… |
CVE-2022-2081 | High | 7.5 | 2024-01-04 | A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. If the HCI Modbus TCP is enabled and configured, an attack… |
CVE-2022-3010 | High | 7.5 | 2024-01-02 | The Priva TopControl Suite contains predictable credentials for the SSH service, based on the Serial number. Which makes it possible for an attacker to calcula… |
CVE-2022-46487 | High | 7.8 | 2023-12-30 | Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for Intel SGX allows a local… |
CVE-2022-46486 | Medium | 5.5 | 2023-12-30 | A lack of pointer-validation logic in the __scone_dispatch component of SCONE before v5.8.0 for Intel SGX allows attackers to access sensitive information. |
CVE-2022-44589 | High | 8.1 | 2023-12-29 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange's Google Authenticator – WordPress Two Factor Authentication… |
CVE-2022-36399 | Medium | 5.3 | 2023-12-28 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affect… |
CVE-2022-34268 | Critical | 9.8 | 2023-12-25 | An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the ho… |
CVE-2022-34267 | Critical | 9.8 | 2023-12-25 | An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Jav… |