2022 CVEs (page 30)
Page 30 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-48193 | Medium | 5.9 | 2023-11-06 | Weak ciphers in Softing smartLink SW-HT before 1.30 are enabled during secure communication (SSL). |
CVE-2022-48192 | High | 7.2 | 2023-11-06 | Cross-site Scripting vulnerability in Softing smartLink SW-HT before 1.30, which allows an attacker to execute a dynamic script (JavaScript, VBScript) in the c… |
CVE-2022-47432 | Medium | 6.7 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB allows SQL Inje… |
CVE-2022-47430 | Medium | 6.7 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar The School Management – Education & Learning Man… |
CVE-2022-47428 | Medium | 6.7 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System all… |
CVE-2022-47420 | Medium | 6.4 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL I… |
CVE-2022-46860 | High | 8.5 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaizenCoders Short URL allows SQL Injection.This issue af… |
CVE-2022-46849 | High | 7.6 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar Coming Soon Page – Responsive Coming Soon & Main… |
CVE-2022-45373 | High | 8.8 | 2023-11-06 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Jason Crouse, VeronaLabs Slimstat Analytics allows SQL In… |
CVE-2022-44569 | High | 7.8 | 2023-11-03 | A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication. |
CVE-2022-43555 | High | 7.8 | 2023-11-03 | Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation Vulnerability |
CVE-2022-43554 | High | 7.8 | 2023-11-03 | Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation Vulnerability |
CVE-2022-3172 | Medium | 5.1 | 2023-11-03 | A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client… |
CVE-2022-46818 | High | 8.2 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopi Ramasamy Email posts to subscribers allows SQL Injec… |
CVE-2022-47445 | High | 8.2 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Web-X Be POPIA Compliant be-popia-compliant allows SQL In… |
CVE-2022-47426 | Medium | 6.0 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Neshan Maps Platform Neshan Maps neshan-maps allows SQL I… |
CVE-2022-46859 | High | 8.5 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL… |
CVE-2022-46808 | High | 8.2 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems ARMember armember-membership allows SQ… |
CVE-2022-45805 | High | 8.2 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Paytm Paytm Payment Gateway paytm-payments allows SQL Inj… |
CVE-2022-47588 | Medium | 6.7 | 2023-11-03 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery s… |
CVE-2022-4900 | Medium | 6.2 | 2023-11-02 | A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow. |
CVE-2022-48461 | Medium | 4.4 | 2023-11-01 | In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privi… |
CVE-2022-48460 | Medium | 5.5 | 2023-11-01 | In setting service, there is a possible undefined behavior due to incorrect error handling. This could lead to local denial of service with no additional execu… |
CVE-2022-48459 | Medium | 5.5 | 2023-11-01 | In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution priv… |
CVE-2022-48458 | Medium | 5.5 | 2023-11-01 | In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution priv… |
CVE-2022-48457 | Medium | 5.5 | 2023-11-01 | In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution priv… |
CVE-2022-48456 | Medium | 4.4 | 2023-11-01 | In camera driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution pri… |
CVE-2022-48455 | Medium | 5.5 | 2023-11-01 | In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution… |
CVE-2022-48454 | Medium | 5.5 | 2023-11-01 | In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution… |
CVE-2022-3007 | High | 8.1 | 2023-10-31 | The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used… |
CVE-2022-39172 | Medium | 5.4 | 2023-10-30 | A stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low-privileged attacke… |
CVE-2022-20264 | Medium | 5.5 | 2023-10-30 | In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel information disclosure… |
CVE-2022-4575 | Medium | 6.7 | 2023-10-30 | A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attacker with physical or l… |
CVE-2022-4574 | Medium | 6.7 | 2023-10-30 | An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute… |
CVE-2022-4573 | Medium | 6.7 | 2023-10-30 | An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privileges to execute arbit… |
CVE-2022-48189 | Medium | 6.7 | 2023-10-30 | An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute a… |
CVE-2022-34834 | Medium | 4.8 | 2023-10-27 | An issue was discovered in VERMEG AgileReporter 21.3. Attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log. |
CVE-2022-34833 | Medium | 5.4 | 2023-10-27 | An issue was discovered in VERMEG AgileReporter 21.3. An admin can enter an XSS payload in the Analysis component. |
CVE-2022-34832 | Medium | 6.5 | 2023-10-27 | An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component. |
CVE-2022-3702 | Medium | 6.1 | 2023-10-27 | A denial of service vulnerability was reported in Lenovo Vantage HardwareScan Plugin version 1.3.0.5 and earlier that could allow a local attacker to delete c… |
CVE-2022-3701 | High | 7.8 | 2023-10-27 | A privilege elevation vulnerability was reported in the Lenovo Vantage SystemUpdate plugin version 2.0.0.212 and earlier that could allow a local attacker to… |
CVE-2022-3700 | Medium | 6.1 | 2023-10-27 | A Time of Check Time of Use (TOCTOU) vulnerability was reported in the Lenovo Vantage SystemUpdate Plugin version 2.0.0.212 and earlier that could allow a loca… |
CVE-2022-3681 | Medium | 6.5 | 2023-10-27 | A vulnerability has been identified in the MR2600 router v1.0.18 and earlier that could allow an attacker within range of the wireless network to successfully… |
CVE-2022-3611 | High | 7.6 | 2023-10-27 | An information disclosure vulnerability has been identified in the Lenovo App Store which may allow some applications to gain unauthorized access to sensitive… |
CVE-2022-3429 | Medium | 6.5 | 2023-10-27 | A denial-of-service vulnerability was found in the firmware used in Lenovo printers, where users send illegal or malformed strings to an open port, triggering… |
CVE-2022-34887 | Medium | 4.3 | 2023-10-27 | Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenticate with the adm… |
CVE-2022-34886 | High | 8.8 | 2023-10-27 | A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing an illegal string to… |
CVE-2022-4886 | High | 8.8 | 2023-10-25 | Ingress-nginx `path` sanitization can be bypassed with `log_format` directive. |
CVE-2022-3699 | High | 7.8 | 2023-10-25 | A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45 t… |
CVE-2022-3698 | Medium | 4.4 | 2023-10-25 | A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 … |
CVE-2022-38485 | Medium | 6.5 | 2023-10-25 | A directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. A remote authenticated attacker cou… |
CVE-2022-38484 | High | 8.8 | 2023-10-25 | An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Portal prior to versi… |
CVE-2022-0353 | Medium | 4.4 | 2023-10-25 | A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 … |
CVE-2022-22466 | Medium | 6.8 | 2023-10-23 | IBM Security Verify Governance 10.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication… |
CVE-2022-4943 | High | 7.5 | 2023-10-20 | The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin setting… |
CVE-2022-4290 | High | 8.8 | 2023-10-20 | The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, and including, 3.5 du… |
CVE-2022-3622 | Medium | 4.1 | 2023-10-20 | The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This mak… |
CVE-2022-3342 | High | 7.5 | 2023-10-20 | The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the ‘zbscrmcsvimpf’ parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' functio… |
CVE-2022-2441 | High | 8.8 | 2023-10-20 | The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This ma… |
CVE-2022-4954 | Medium | 5.5 | 2023-10-20 | The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to, and including, 0… |
CVE-2022-4712 | High | 7.2 | 2023-10-20 | The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site in versions up to, a… |
CVE-2022-42150 | Critical | 10.0 | 2023-10-19 | TinyLab linux-lab v1.1-rc1 and cloud-labv0.8-rc2, v1.1-rc1 are vulnerable to insecure permissions. The default configuration could cause Container Escape. |
CVE-2022-47583 | Critical | 9.8 | 2023-10-19 | Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal. |
CVE-2022-37830 | Critical | 9.6 | 2023-10-19 | Interway a.s WebJET CMS 8.6.896 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-27813 | High | 8.1 | 2023-10-19 | Motorola MTM5000 series firmwares lack properly configured memory protection of pages shared between the OMAP-L138 ARM and DSP cores. The SoC provides two memo… |
CVE-2022-26943 | High | 8.8 | 2023-10-19 | The Motorola MTM5000 series firmwares generate TETRA authentication challenges using a PRNG using a tick count register as its sole entropy source. Low boottim… |
CVE-2022-26942 | High | 8.2 | 2023-10-19 | The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one res… |
CVE-2022-26941 | Critical | 9.6 | 2023-10-19 | A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is imprope… |
CVE-2022-25334 | High | 8.2 | 2023-10-19 | The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) lacks a bounds check on the signature size field in the SK_LOAD module lo… |
CVE-2022-25333 | High | 8.2 | 2023-10-19 | The Texas Instruments OMAP L138 (secure variants) trusted execution environment (TEE) performs an RSA check implemented in mask ROM when loading a module throu… |
CVE-2022-25332 | Medium | 4.4 | 2023-10-19 | The AES implementation in the Texas Instruments OMAP L138 (secure variants), present in mask ROM, suffers from a timing side channel which can be exploited by… |
CVE-2022-24404 | Medium | 5.9 | 2023-10-19 | Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulat… |
CVE-2022-24402 | High | 8.8 | 2023-10-19 | The TETRA TEA1 keystream generator implements a key register initialization function that compresses the 80-bit key to only 32 bits for usage during the keystr… |
CVE-2022-24401 | High | 8.8 | 2023-10-19 | Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame c… |
CVE-2022-24400 | High | 7.5 | 2023-10-19 | A flaw in the TETRA authentication procecure allows a MITM adversary that can predict the MS challenge RAND2 to set session key DCK to zero. |
CVE-2022-3761 | Medium | 5.9 | 2023-10-17 | OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuratio… |
CVE-2022-43892 | Low | 3.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 does not validate, or incorrectly validates, a certificate which could disclose sensitive information which cou… |
CVE-2022-43891 | Low | 2.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2022-43893 | Low | 2.7 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a privileged user to cause by using a malicious payload. IBM X-Force ID: 240634. |
CVE-2022-43889 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information through an HTTP request that could aid an attacker in further attacks agai… |
CVE-2022-22386 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP St… |
CVE-2022-22385 | Medium | 5.9 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could disclose sensitive information to an attacked due to the transmission of data in clear text. IBM X-Force… |
CVE-2022-22380 | Medium | 5.0 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to spoof a trusted entity due to improperly validating certificates. IBM X-Force ID… |
CVE-2022-22375 | High | 7.2 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote authenticated attacker to execute arbitrary commands on the system by sending a specially… |
CVE-2022-22384 | Medium | 4.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow an attacker to modify messages returned from the server due to hazardous input validation. IBM X-Fo… |
CVE-2022-22377 | Medium | 5.3 | 2023-10-17 | IBM Security Verify Privilege On-Premises 11.5 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Str… |
CVE-2022-48612 | Medium | 6.1 | 2023-10-16 | A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.7 allows remote attackers to inject JavaScript into any webpag… |
CVE-2022-43868 | Medium | 5.3 | 2023-10-14 | IBM Security Verify Access OIDC Provider could disclose directory information that could aid attackers in further attacks against the system. IBM X-Force ID… |
CVE-2022-43740 | High | 7.5 | 2023-10-14 | IBM Security Verify Access OIDC Provider could allow a remote user to cause a denial of service due to uncontrolled resource consumption. IBM X-Force ID: 238… |
CVE-2022-33165 | Medium | 6.8 | 2023-10-14 | IBM Security Directory Server 6.4.0 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request… |
CVE-2022-33161 | Medium | 5.3 | 2023-10-14 | IBM Security Directory Server 6.4.0 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transpo… |
CVE-2022-32755 | Medium | 5.5 | 2023-10-14 | IBM Security Directory Server 6.4.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit th… |
CVE-2022-44758 | Medium | 6.5 | 2023-10-11 | BigFix Insights/IVR fixlet uses improper credential handling within certain fixlet content. An attacker can gain access to information that is not explicitly… |
CVE-2022-44757 | Medium | 6.5 | 2023-10-11 | BigFix Insights for Vulnerability Remediation (IVR) uses weak cryptography that can lead to credential exposure. An attacker could gain access to sensitive in… |
CVE-2022-42451 | Medium | 4.6 | 2023-10-11 | Certain credentials within the BigFix Patch Management Download Plug-ins are stored insecurely and could be exposed to a local privileged user. |
CVE-2022-22298 | Medium | 6.7 | 2023-10-10 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiIsolator version 1.0.0, FortiIsolator version 1.1… |
CVE-2022-30527 | High | 7.8 | 2023-10-10 | A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific folders containing… |
CVE-2022-48183 | Medium | 6.1 | 2023-10-09 | A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstan… |
CVE-2022-48182 | Medium | 6.1 | 2023-10-09 | A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstan… |
CVE-2022-3728 | Medium | 6.1 | 2023-10-09 | A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstan… |