2022 CVEs (page 40)
Page 40 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-34292 | High | 7.1 | 2023-04-27 | Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 API by controlling… |
CVE-2022-31647 | High | 7.1 | 2023-04-27 | Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder param… |
CVE-2022-47758 | Critical | 9.8 | 2023-04-27 | Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack. |
CVE-2022-45876 | Medium | 5.5 | 2023-04-26 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45456 | High | 7.5 | 2023-04-26 | Denial of service due to unauthenticated API endpoint. The following products are affected: Acronis Agent (Windows, macOS, Linux) before build 30161. |
CVE-2022-44232 | High | 7.5 | 2023-04-26 | libming 0.4.8 0.4.8 is vulnerable to Buffer Overflow. In getInt() in decompile.c unknown type may lead to denial of service. This is a different vulnerability… |
CVE-2022-27979 | Medium | 5.4 | 2023-04-26 | A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the… |
CVE-2022-27978 | High | 7.5 | 2023-04-26 | Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP request. |
CVE-2022-25278 | Medium | 6.5 | 2023-04-26 | Under certain circumstances, the Drupal core form API evaluates form element access incorrectly. This may lead to a user being able to alter data they should n… |
CVE-2022-25277 | High | 7.2 | 2023-04-26 | Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots from filenames to prev… |
CVE-2022-25276 | Medium | 6.1 | 2023-04-26 | The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of the primary domain. U… |
CVE-2022-39989 | Critical | 9.8 | 2023-04-26 | An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administrators to change the… |
CVE-2022-25275 | High | 7.5 | 2023-04-26 | In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when generating derivativ… |
CVE-2022-25274 | Medium | 5.4 | 2023-04-26 | Drupal 9.3 implemented a generic entity access API for entity revisions. However, this API was not completely integrated with existing permissions, resulting i… |
CVE-2022-25273 | High | 7.5 | 2023-04-26 | Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validation. This could allow… |
CVE-2022-41739 | High | 7.9 | 2023-04-26 | IBM Spectrum Scale (IBM Spectrum Scale Container Native Storage Access 5.1.2.1 through 5.1.6.0) could allow programs running inside the container to overcome… |
CVE-2022-36769 | High | 7.2 | 2023-04-26 | IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the p… |
CVE-2022-45291 | High | 7.2 | 2023-04-25 | PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into settings.php. Attac… |
CVE-2022-40725 | High | 7.3 | 2023-04-25 | PingID Desktop prior to the latest released version 1.7.4 contains a vulnerability that can be exploited to bypass the maximum PIN attempts permitted before th… |
CVE-2022-40724 | Medium | 6.4 | 2023-04-25 | The PingFederate Local Identity Profiles '/pf/idprofile.ping' endpoint is vulnerable to Cross-Site Request Forgery (CSRF) through crafted GET requests. |
CVE-2022-40723 | Medium | 6.5 | 2023-04-25 | The PingID RADIUS PCV adapter for PingFederate, which supports RADIUS authentication with PingID MFA, is vulnerable to MFA bypass under certain configurations. |
CVE-2022-40722 | High | 7.7 | 2023-04-25 | A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to… |
CVE-2022-40482 | Medium | 5.3 | 2023-04-25 | The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2… |
CVE-2022-23721 | Low | 3.8 | 2023-04-25 | PingID integration for Windows login prior to 2.9 does not handle duplicate usernames, which can lead to a username collision when two people with the same use… |
CVE-2022-47608 | Medium | 5.9 | 2023-04-25 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions. |
CVE-2022-31244 | High | 7.8 | 2023-04-25 | Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation. |
CVE-2022-42335 | High | 7.8 | 2023-04-25 | x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unav… |
CVE-2022-45837 | High | 7.1 | 2023-04-25 | Reflected Cross-Site Scripting (XSS) vulnerability in Denis 微信机器人高级版 plugin <= 6.0.1 versions. |
CVE-2022-28354 | Medium | 6.1 | 2023-04-24 | In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period. |
CVE-2022-41612 | Medium | 5.9 | 2023-04-24 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Shareaholic Similar Posts plugin <= 3.1.6 versions. |
CVE-2022-47598 | Medium | 5.9 | 2023-04-24 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Plugins Pro WP Super Popup plugin <= 1.1.2 versions. |
CVE-2022-47158 | Medium | 5.9 | 2023-04-24 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pakpobox alfred24 Click & Collect plugin <= 1.1.7 versions. |
CVE-2022-45084 | Medium | 6.3 | 2023-04-24 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Softaculous Loginizer plugin <= 1.7.5 versions. |
CVE-2022-48477 | Medium | 4.1 | 2023-04-24 | In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing |
CVE-2022-48476 | High | 7.5 | 2023-04-24 | In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible |
CVE-2022-45080 | Medium | 5.4 | 2023-04-23 | Cross-Site Request Forgery (CSRF) vulnerability in KrishaWeb Add Multiple Marker plugin <= 1.2 versions. |
CVE-2022-45074 | Medium | 4.3 | 2023-04-23 | Cross-Site Request Forgery (CSRF) vulnerability in Paramveer Singh for Arete IT Private Limited Activity Reactions For Buddypress plugin <= 1.0.22 versions. |
CVE-2022-47435 | Medium | 5.9 | 2023-04-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Olive Design WP-OliveCart plugin <= 1.1.3 versions. |
CVE-2022-45361 | Medium | 5.9 | 2023-04-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Boris Kuzmanov 0mk Shortener plugin <= 0.2 versions. |
CVE-2022-44743 | Medium | 6.5 | 2023-04-23 | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.11.2 versions. |
CVE-2022-44594 | Medium | 4.8 | 2023-04-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Codebangers All in One Time Clock Lite plugin <= 1.3.320 versions. |
CVE-2022-44631 | Medium | 4.8 | 2023-04-23 | Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in 1app Technologies, Inc 1app Business Forms plugin <= 1.0.0 versions. |
CVE-2022-44582 | Medium | 4.8 | 2023-04-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apptivo Apptivo Business Site CRM plugin <= 3.0.12 versions. |
CVE-2022-4944 | Medium | 4.3 | 2023-04-22 | A vulnerability, which was classified as problematic, has been found in kalcaddle KodExplorer up to 4.49. Affected by this issue is some unknown functionality… |
CVE-2022-47509 | Medium | 6.1 | 2023-04-21 | The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWin… |
CVE-2022-47505 | High | 7.8 | 2023-04-21 | The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user a… |
CVE-2022-36963 | High | 7.2 | 2023-04-21 | The SolarWinds Platform was susceptible to the Command Injection Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform a… |
CVE-2022-47930 | Medium | 6.8 | 2023-04-21 | An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes… |
CVE-2022-48150 | Medium | 6.1 | 2023-04-21 | Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI. |
CVE-2022-36788 | High | 8.1 | 2023-04-20 | A heap-based buffer overflow vulnerability exists in the TriangleMesh clone functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a5500. A specially-craf… |
CVE-2022-46302 | High | 8.8 | 2023-04-20 | Broad access controls could allow site users to directly interact with the system Apache installation when providing the reverse proxy configurations for Tribe… |
CVE-2022-29944 | Medium | 5.3 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. There is an incorrect comparison of paths installed by intents. An existing intents does not redirect to a new path, eve… |
CVE-2022-29609 | Medium | 5.3 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. An intent with the same source and destination shows the INSTALLING state, indicating that its flow rules are installing… |
CVE-2022-29608 | High | 7.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. An intent with a port that is an intermediate point of its path installs an invalid flow rule, causing a network loop. |
CVE-2022-29607 | High | 7.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. Modification of an existing intent to have the same source and destination shows the INSTALLED state without any flow ru… |
CVE-2022-29606 | Critical | 9.8 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. An intent with a large port number shows the CORRUPT state, which is misleading to a network operator. Improper handling… |
CVE-2022-29605 | High | 7.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. IntentManager attempts to install the IPv6 flow rules of an intent into an OpenFlow 1.0 switch that does not support IPv… |
CVE-2022-29604 | Critical | 9.8 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. An intent with an uppercase letter in a device ID shows the CORRUPT state, which is misleading to a network operator. Im… |
CVE-2022-24109 | Medium | 6.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. To attack an intent installed by a normal user, a remote attacker can install a duplicate intent with a different key, a… |
CVE-2022-24035 | High | 7.5 | 2023-04-20 | An issue was discovered in ONOS 2.5.1. The purge-requested intent remains on the list, but it does not respond to changes in topology (e.g., link failure). In… |
CVE-2022-4942 | Low | 3.5 | 2023-04-20 | A vulnerability was found in mportuga eslint-detailed-reporter up to 0.9.0 and classified as problematic. Affected by this issue is the function renderIssue in… |
CVE-2022-2084 | Medium | 5.5 | 2023-04-19 | Sensitive data could be exposed in world readable logs of cloud-init before version 22.3 when schema failures are reported. This leak could include hashed pass… |
CVE-2022-4308 | Medium | 6.1 | 2023-04-19 | Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked. |
CVE-2022-38125 | Low | 2.9 | 2023-04-19 | Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiting Trust in Client. |
CVE-2022-2507 | Medium | 5.3 | 2023-04-19 | In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage |
CVE-2022-43378 | Medium | 6.5 | 2023-04-18 | A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into performing unintended… |
CVE-2022-43377 | High | 7.5 | 2023-04-18 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brute force attack is p… |
CVE-2022-43376 | High | 7.6 | 2023-04-18 | A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code and session manipu… |
CVE-2022-34755 | Medium | 6.3 | 2023-04-18 | A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted fi… |
CVE-2022-45836 | Medium | 6.3 | 2023-04-18 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in W3 Eden, Inc. Download Manager plugin <= 3.2.59 versions. |
CVE-2022-44632 | Medium | 4.8 | 2023-04-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Denis Buka Content Repeater – Custom Posts Simplified plugin <= 1.1.13 versions. |
CVE-2022-46640 | Critical | 9.8 | 2023-04-18 | Nanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP request. |
CVE-2022-45839 | Medium | 5.3 | 2023-04-18 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WHA WHA Puzzle plugin <= 1.0.9 versions. |
CVE-2022-45838 | Medium | 6.1 | 2023-04-18 | Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARForms Form Builder plugin <= 1.5.5 versions. |
CVE-2022-44735 | Medium | 4.8 | 2023-04-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gus Sevilla WP Clictracker plugin <= 1.0.5 versions. |
CVE-2022-46389 | Medium | 6.1 | 2023-04-17 | There exists a reflected XSS within the logout functionality of ServiceNow versions lower than Quebec Patch 10 Hotfix 11b, Rome Patch 10 Hotfix 3b, San Diego P… |
CVE-2022-44726 | Medium | 5.4 | 2023-04-17 | The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view. |
CVE-2022-45849 | Medium | 5.4 | 2023-04-16 | Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions. |
CVE-2022-44734 | Medium | 4.8 | 2023-04-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions. |
CVE-2022-43480 | Medium | 6.1 | 2023-04-16 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions. |
CVE-2022-43458 | Medium | 4.1 | 2023-04-16 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Code Tides Advanced Floating Content plugin <= 1.2.1 versions. |
CVE-2022-48314 | Medium | 6.5 | 2023-04-16 | The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect co… |
CVE-2022-48313 | Medium | 6.5 | 2023-04-16 | The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect co… |
CVE-2022-48312 | Critical | 9.1 | 2023-04-16 | The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity. |
CVE-2022-34128 | Critical | 9.8 | 2023-04-16 | The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php. |
CVE-2022-34127 | High | 7.5 | 2023-04-16 | The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter. |
CVE-2022-34126 | High | 7.5 | 2023-04-16 | The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter. |
CVE-2022-34125 | Medium | 6.5 | 2023-04-16 | front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file par… |
CVE-2022-30076 | Medium | 5.3 | 2023-04-16 | ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There i… |
CVE-2022-28353 | Medium | 6.1 | 2023-04-16 | In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS. |
CVE-2022-40946 | High | 7.5 | 2023-04-16 | On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via the sys_token parameter in a cgi-bin/web… |
CVE-2022-38841 | High | 8.8 | 2023-04-16 | Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page. |
CVE-2022-38840 | High | 7.5 | 2023-04-16 | cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosur… |
CVE-2022-37306 | Medium | 6.1 | 2023-04-16 | OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger. |
CVE-2022-37255 | High | 7.5 | 2023-04-16 | TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603. |
CVE-2022-37186 | Medium | 5.9 | 2023-04-16 | In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur whe… |
CVE-2022-37705 | Medium | 6.7 | 2023-04-16 | A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program… |
CVE-2022-37704 | Medium | 6.7 | 2023-04-16 | Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as ro… |
CVE-2022-2525 | Critical | 9.8 | 2023-04-15 | Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20. |
CVE-2022-47522 | High | 7.5 | 2023-04-15 | The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a tar… |