2022 CVEs (page 41)
Page 41 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43458 | Medium | 4.1 | 2023-04-16 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Code Tides Advanced Floating Content plugin <= 1.2.1 versions. |
CVE-2022-48314 | Medium | 6.5 | 2023-04-16 | The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect co… |
CVE-2022-48313 | Medium | 6.5 | 2023-04-16 | The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process. Successful exploitation of this vulnerability may affect co… |
CVE-2022-48312 | Critical | 9.1 | 2023-04-16 | The HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation of this vulnerability may affect confidentiality and integrity. |
CVE-2022-34128 | Critical | 9.8 | 2023-04-16 | The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php. |
CVE-2022-34127 | High | 7.5 | 2023-04-16 | The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter. |
CVE-2022-34126 | High | 7.5 | 2023-04-16 | The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter. |
CVE-2022-34125 | Medium | 6.5 | 2023-04-16 | front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file par… |
CVE-2022-30076 | Medium | 5.3 | 2023-04-16 | ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 through s20000. There i… |
CVE-2022-28353 | Medium | 6.1 | 2023-04-16 | In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS. |
CVE-2022-40946 | High | 7.5 | 2023-04-16 | On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via the sys_token parameter in a cgi-bin/web… |
CVE-2022-38841 | High | 8.8 | 2023-04-16 | Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page. |
CVE-2022-38840 | High | 7.5 | 2023-04-16 | cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosur… |
CVE-2022-37306 | Medium | 6.1 | 2023-04-16 | OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger. |
CVE-2022-37255 | High | 7.5 | 2023-04-16 | TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603. |
CVE-2022-37186 | Medium | 5.9 | 2023-04-16 | In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur whe… |
CVE-2022-37705 | Medium | 6.7 | 2023-04-16 | A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges. The vulnerable component is the runtar SUID program… |
CVE-2022-37704 | Medium | 6.7 | 2023-04-16 | Amanda 3.5.1 allows privilege escalation from the regular user backup to root. The SUID binary located at /lib/amanda/rundump will execute /usr/sbin/dump as ro… |
CVE-2022-2525 | Critical | 9.8 | 2023-04-15 | Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20. |
CVE-2022-47522 | High | 7.5 | 2023-04-15 | The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a tar… |
CVE-2022-45030 | High | 8.8 | 2023-04-15 | A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secure-file-priv). |
CVE-2022-43699 | Medium | 4.3 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an adversary who controls th… |
CVE-2022-43698 | Medium | 4.3 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list. |
CVE-2022-43697 | Medium | 6.1 | 2023-04-15 | OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob. |
CVE-2022-43696 | Medium | 6.1 | 2023-04-15 | OX App Suite before 7.10.6-rev20 allows XSS via upsell ads. |
CVE-2022-48178 | Medium | 5.4 | 2023-04-15 | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an inde… |
CVE-2022-48177 | Medium | 5.4 | 2023-04-15 | X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records… |
CVE-2022-46886 | Medium | 5.5 | 2023-04-14 | There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when cl… |
CVE-2022-47501 | High | 7.5 | 2023-04-14 | Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue af… |
CVE-2022-3748 | Critical | 9.8 | 2023-04-14 | Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through… |
CVE-2022-45180 | Medium | 6.5 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdesk_{DOMAIN]/export endpoint. A malicious… |
CVE-2022-45178 | High | 8.8 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. Broken Access Control exists under the /api/v1/vdeskintegration/saml/user/createorupdate e… |
CVE-2022-45175 | Medium | 6.5 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. An Insecure Direct Object Reference can occur under the 5.6.5-3/doc/{ID-FILE]/c/{N]/{C]/we… |
CVE-2022-45174 | Critical | 9.8 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication for SAML Users can occur under the /login/backup_cod… |
CVE-2022-45173 | Critical | 9.8 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Bypass of Two-Factor Authentication can occur under the /api/v1/vdeskintegration/challen… |
CVE-2022-45170 | Medium | 6.5 | 2023-04-14 | An issue was discovered in LIVEBOX Collaboration vDesk through v018. A Cryptographic Issue can occur under the /api/v1/vencrypt/decrypt/file endpoint. A malici… |
CVE-2022-47027 | Critical | 9.8 | 2023-04-14 | Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnera… |
CVE-2022-48468 | Medium | 5.5 | 2023-04-13 | protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member. |
CVE-2022-45358 | Medium | 5.4 | 2023-04-13 | Auth. (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Silkalns Activello theme <= 1.4.4 versions. |
CVE-2022-44625 | Medium | 4.8 | 2023-04-13 | Auth. (admin+) Stored Cross-Site Scripting') vulnerability in Zephilou Cyklodev WP Notify plugin <= 1.2.1 versions. |
CVE-2022-45064 | High | 8.0 | 2023-04-13 | The SlingRequestDispatcher doesn't correctly implement the RequestDispatcher API resulting in a generic type of include-based cross-site scripting issues on th… |
CVE-2022-40532 | High | 8.4 | 2023-04-13 | Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target. |
CVE-2022-40503 | High | 8.2 | 2023-04-13 | Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming. |
CVE-2022-33302 | Medium | 6.8 | 2023-04-13 | Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length. |
CVE-2022-33301 | Medium | 6.7 | 2023-04-13 | Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM. |
CVE-2022-33298 | Medium | 6.7 | 2023-04-13 | Memory corruption due to use after free in Modem while modem initialization. |
CVE-2022-33297 | Medium | 6.8 | 2023-04-13 | Information disclosure due to buffer overread in Linux sensors |
CVE-2022-33296 | Medium | 5.9 | 2023-04-13 | Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message. |
CVE-2022-33295 | High | 8.2 | 2023-04-13 | Information disclosure in Modem due to buffer over-read while parsing the wms message received given the buffer and its length. |
CVE-2022-33294 | High | 7.5 | 2023-04-13 | Transient DOS in Modem due to NULL pointer dereference while receiving response of lwm2m registration/update/bootstrap request message. |
CVE-2022-33291 | High | 8.2 | 2023-04-13 | Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length. |
CVE-2022-33289 | Medium | 6.8 | 2023-04-13 | Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card. |
CVE-2022-33288 | Critical | 9.3 | 2023-04-13 | Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information. |
CVE-2022-33287 | High | 8.2 | 2023-04-13 | Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet. |
CVE-2022-33282 | High | 8.4 | 2023-04-13 | Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback. |
CVE-2022-33270 | High | 7.5 | 2023-04-13 | Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message. |
CVE-2022-33269 | Critical | 9.3 | 2023-04-13 | Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment. |
CVE-2022-33259 | Critical | 9.8 | 2023-04-13 | Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received. |
CVE-2022-33258 | High | 8.2 | 2023-04-13 | Information disclosure due to buffer over-read in modem while reading configuration parameters. |
CVE-2022-33231 | Critical | 9.3 | 2023-04-13 | Memory corruption due to double free in core while initializing the encryption key. |
CVE-2022-33228 | High | 8.2 | 2023-04-13 | Information disclosure sue to buffer over-read in modem while processing ipv6 packet with hop-by-hop or destination option in header. |
CVE-2022-33223 | High | 7.5 | 2023-04-13 | Transient DOS in Modem due to null pointer dereference while processing the incoming packet with http chunked encoding. |
CVE-2022-33222 | High | 8.2 | 2023-04-13 | Information disclosure due to buffer over-read while parsing DNS response packets in Modem. |
CVE-2022-33211 | Critical | 9.8 | 2023-04-13 | memory corruption in modem due to improper check while calculating size of serialized CoAP message |
CVE-2022-25747 | High | 8.2 | 2023-04-13 | Information disclosure in modem due to improper input validation during parsing of upcoming CoAP message |
CVE-2022-25745 | Critical | 9.8 | 2023-04-13 | Memory corruption in modem due to improper input validation while handling the incoming CoAP message |
CVE-2022-25740 | Critical | 9.8 | 2023-04-13 | Memory corruption in modem due to buffer overwrite while building an IPv6 multicast address based on the MAC address of the iface |
CVE-2022-25739 | High | 7.5 | 2023-04-13 | Denial of service in modem due to missing null check while processing the ipv6 packet received during ECM call |
CVE-2022-25737 | High | 7.5 | 2023-04-13 | Information disclosure in modem due to missing NULL check while reading packets received from local network |
CVE-2022-25731 | High | 7.5 | 2023-04-13 | Information disclosure in modem due to buffer over-read while processing packets from DNS server |
CVE-2022-25730 | High | 8.2 | 2023-04-13 | Information disclosure in modem due to improper check of IP type while processing DNS server query |
CVE-2022-25726 | High | 8.2 | 2023-04-13 | Information disclosure in modem data due to array out of bound access while handling the incoming DNS response packet |
CVE-2022-25678 | Critical | 9.8 | 2023-04-13 | Memory correction in modem due to buffer overwrite during coap connection |
CVE-2022-47605 | Medium | 6.4 | 2023-04-12 | Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions. |
CVE-2022-47053 | Medium | 5.4 | 2023-04-12 | An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code… |
CVE-2022-24350 | Medium | 5.5 | 2023-04-12 | An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI function 0x17 verifies that the output buffer lies within the comman… |
CVE-2022-48437 | Medium | 5.3 | 2023-04-12 | An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors t… |
CVE-2022-46396 | Low | 3.3 | 2023-04-11 | An issue was discovered in the Arm Mali Kernel Driver. A non-privileged user can make improper GPU memory processing operations to access a limited amount outs… |
CVE-2022-43955 | High | 8.8 | 2023-04-11 | An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3.21, 6.4 all versio… |
CVE-2022-43952 | Low | 3.5 | 2023-04-11 | An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC version 7.1.1 and below, version 7.0… |
CVE-2022-43951 | Medium | 5.3 | 2023-04-11 | An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 and below, 8.8.11 and… |
CVE-2022-43948 | Medium | 6.7 | 2023-04-11 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.3, FortiADC version… |
CVE-2022-43947 | Medium | 5.0 | 2023-04-11 | An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and before 7.0.10, FortiPr… |
CVE-2022-43946 | High | 7.5 | 2023-04-11 | Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check time-of-use (TOCTOU) ra… |
CVE-2022-42477 | High | 7.1 | 2023-04-11 | An improper input validation vulnerability [CWE-20] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may allow an authentica… |
CVE-2022-42470 | High | 7.8 | 2023-04-11 | A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to… |
CVE-2022-42469 | Medium | 4.3 | 2023-04-11 | A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Mode may allow an a… |
CVE-2022-41331 | Critical | 9.8 | 2023-04-11 | A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a remote, unauthentic… |
CVE-2022-41330 | High | 8.8 | 2023-04-11 | An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7.2.0 through 7.2.3… |
CVE-2022-40682 | High | 7.8 | 2023-04-11 | A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauth… |
CVE-2022-40679 | High | 7.8 | 2023-04-11 | An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6… |
CVE-2022-35850 | Medium | 4.3 | 2023-04-11 | An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6… |
CVE-2022-27487 | High | 8.8 | 2023-04-11 | A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0… |
CVE-2022-27485 | Medium | 6.5 | 2023-04-11 | A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 thr… |
CVE-2022-43770 | Medium | 5.4 | 2023-04-11 | Hitachi Vantara Pentaho Business Analytics Server versions before 9.3.0.0, 9.2.0.4 and 8.3.0.27 does not correctly perform an authorization check in the dashb… |
CVE-2022-3695 | Medium | 6.5 | 2023-04-11 | Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.3.0.0, 9.2.0.4 and 8.3.0.27 allow a malicious URL to inject content into a dashboard whe… |
CVE-2022-47468 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47467 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47466 | Medium | 5.5 | 2023-04-11 | In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service. |
CVE-2022-47465 | Medium | 5.5 | 2023-04-11 | In vdsp service, there is a missing permission check. This could lead to local denial of service in vdsp service. |