2022 CVEs (page 45)
Page 45 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47170 | Medium | 5.9 | 2023-03-28 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin… |
CVE-2022-46863 | Medium | 5.9 | 2023-03-28 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <= 9.6.4 versions. |
CVE-2022-46855 | Medium | 6.5 | 2023-03-28 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP Darko Responsive Pricing Table plugin <= 5.1.6 versions. |
CVE-2022-46848 | Medium | 6.5 | 2023-03-28 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin <= 3.9.1 versions. |
CVE-2022-45831 | High | 7.1 | 2023-03-28 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in biplob018 Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 2.8 versions. |
CVE-2022-45825 | High | 7.1 | 2023-03-28 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in iThemes WPComplete plugin <= 2.9.2 versions. |
CVE-2022-48361 | Medium | 5.3 | 2023-03-27 | The Always On Display (AOD) has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a failure in reading AOD… |
CVE-2022-48360 | High | 7.5 | 2023-03-27 | The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48359 | High | 7.5 | 2023-03-27 | The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentia… |
CVE-2022-48358 | High | 7.4 | 2023-03-27 | The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions. |
CVE-2022-48357 | High | 7.5 | 2023-03-27 | Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel. |
CVE-2022-48356 | High | 7.5 | 2023-03-27 | The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recogn… |
CVE-2022-48355 | Medium | 6.5 | 2023-03-27 | The Bluetooth module has a heap out-of-bounds read vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash. |
CVE-2022-48354 | Medium | 6.5 | 2023-03-27 | The Bluetooth module has a heap out-of-bounds write vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash. |
CVE-2022-48353 | Critical | 9.8 | 2023-03-27 | Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system servic… |
CVE-2022-48352 | High | 7.5 | 2023-03-27 | Some smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic. |
CVE-2022-48351 | High | 7.5 | 2023-03-27 | The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect availability. |
CVE-2022-48350 | High | 7.5 | 2023-03-27 | The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48349 | Critical | 9.1 | 2023-03-27 | The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidentiality and availability. |
CVE-2022-48348 | Critical | 9.1 | 2023-03-27 | The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity. |
CVE-2022-48347 | High | 7.5 | 2023-03-27 | The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48346 | High | 7.5 | 2023-03-27 | The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48291 | Medium | 6.5 | 2023-03-27 | The Bluetooth module has an authentication bypass vulnerability in the pairing process. Successful exploitation of this vulnerability may affect confidentialit… |
CVE-2022-3116 | High | 7.5 | 2023-03-27 | The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance. An attacker with network access to an application that depends on t… |
CVE-2022-2237 | Medium | 6.1 | 2023-03-27 | A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function. |
CVE-2022-46416 | Critical | 9.1 | 2023-03-27 | Parrot Bebop 4.7.1. allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker… |
CVE-2022-46415 | Critical | 9.1 | 2023-03-27 | DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacke… |
CVE-2022-48428 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible |
CVE-2022-48427 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible |
CVE-2022-48429 | Medium | 4.6 | 2023-03-27 | In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible |
CVE-2022-48426 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible |
CVE-2022-47146 | High | 7.1 | 2023-03-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions. |
CVE-2022-47925 | High | 7.5 | 2023-03-27 | The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insufficient input validat… |
CVE-2022-47924 | Medium | 6.5 | 2023-03-27 | An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wi… |
CVE-2022-46843 | High | 7.1 | 2023-03-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Le Van Toan Woocommerce Vietnam Checkout plugin <= 2.0.4 versions. |
CVE-2022-41354 | Medium | 4.3 | 2023-03-27 | An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications. |
CVE-2022-30705 | Medium | 5.4 | 2023-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions. |
CVE-2022-32199 | Medium | 6.5 | 2023-03-27 | db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. |
CVE-2022-4126 | Critical | 9.6 | 2023-03-27 | Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: befo… |
CVE-2022-39043 | Low | 2.4 | 2023-03-27 | Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to ac… |
CVE-2022-45597 | Critical | 9.8 | 2023-03-24 | ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. NOTE: the vendor does not consider this a vulnerability because the report is only about use of… |
CVE-2022-42528 | Medium | 5.5 | 2023-03-24 | In ffa_mrd_prot of shared_mem.c, there is a possible ID due to a logic error in the code. This could lead to local information disclosure with no additional ex… |
CVE-2022-42500 | Medium | 6.7 | 2023-03-24 | In OEM_OnRequest of sced.cpp, there is a possible shell command execution due to improper input validation. This could lead to local escalation of privilege wi… |
CVE-2022-42499 | Critical | 9.8 | 2023-03-24 | In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution… |
CVE-2022-42498 | Critical | 9.8 | 2023-03-24 | In Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional… |
CVE-2022-40208 | Medium | 4.3 | 2023-03-24 | In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt. |
CVE-2022-20542 | High | 7.8 | 2023-03-24 | In parseParamsBlob of types.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with n… |
CVE-2022-20532 | Critical | 9.8 | 2023-03-24 | In parseTrackFragmentRun() of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remote escalation of pr… |
CVE-2022-20499 | Medium | 5.5 | 2023-03-24 | In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no… |
CVE-2022-20467 | Medium | 5.5 | 2023-03-24 | In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a confused deputy. This could lead to local information disc… |
CVE-2022-47502 | High | 7.8 | 2023-03-24 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2022-38745 | High | 7.8 | 2023-03-24 | Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the curr… |
CVE-2022-42948 | Critical | 9.8 | 2023-03-24 | Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely… |
CVE-2022-28495 | Critical | 9.8 | 2023-03-24 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx para… |
CVE-2022-3146 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2022-3101 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2022-36413 | Critical | 9.1 | 2023-03-23 | Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications. |
CVE-2022-47145 | High | 7.1 | 2023-03-23 | Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions. |
CVE-2022-28496 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adm… |
CVE-2022-47173 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nasirahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced… |
CVE-2022-28497 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_write_bootloader function via the filename… |
CVE-2022-47589 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in this.Functional CTT Expresso para WooCommerce plugin <= 3.2.11 versions. |
CVE-2022-28493 | Critical | 9.8 | 2023-03-23 | A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service, |
CVE-2022-28491 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vul… |
CVE-2022-28492 | Critical | 9.8 | 2023-03-23 | TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login. |
CVE-2022-4224 | High | 8.8 | 2023-03-23 | In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS re… |
CVE-2022-47431 | High | 7.1 | 2023-03-23 | Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions. |
CVE-2022-45843 | Medium | 5.4 | 2023-03-23 | Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin <= 3.5.1.9 versions. |
CVE-2022-44742 | Medium | 4.8 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions. |
CVE-2022-22512 | Critical | 9.8 | 2023-03-23 | Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the W… |
CVE-2022-30037 | High | 7.2 | 2023-03-23 | XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the add function in cro… |
CVE-2022-28494 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename paramet… |
CVE-2022-43863 | Medium | 6.7 | 2023-03-22 | IBM QRadar SIEM 7.4 and 7.5 is vulnerable to privilege escalation, allowing a user with some admin capabilities to gain additional admin capabilities. IBM X-F… |
CVE-2022-45004 | Medium | 6.1 | 2023-03-22 | Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page. |
CVE-2022-45003 | High | 7.5 | 2023-03-22 | Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus. |
CVE-2022-4095 | High | 7.8 | 2023-03-22 | A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attack… |
CVE-2022-37940 | Medium | 5.3 | 2023-03-22 | Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow ho… |
CVE-2022-45634 | Medium | 4.3 | 2023-03-22 | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows authenticated attacker to gain access to sensitive account information |
CVE-2022-46300 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-46286 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45468 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45121 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-43512 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-41696 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45636 | High | 8.1 | 2023-03-21 | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) without authorization via arbitrary API req… |
CVE-2022-38458 | Medium | 6.5 | 2023-03-21 | A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted man-in-the-midd… |
CVE-2022-38452 | High | 7.2 | 2023-03-21 | A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted network request… |
CVE-2022-37337 | Critical | 9.1 | 2023-03-21 | A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead t… |
CVE-2022-36429 | High | 7.2 | 2023-03-21 | A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON ob… |
CVE-2022-45637 | Critical | 9.8 | 2023-03-21 | An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 service via insecure expiry mechanism. |
CVE-2022-45635 | High | 7.5 | 2023-03-21 | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure p… |
CVE-2022-42334 | Medium | 6.5 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2022-42333 | High | 8.6 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2022-42332 | High | 7.8 | 2023-03-21 | x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavai… |
CVE-2022-42331 | Medium | 5.5 | 2023-03-21 | x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs… |
CVE-2022-42485 | Medium | 5.4 | 2023-03-21 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <= 6.0 versions. |
CVE-2022-41831 | Medium | 5.4 | 2023-03-21 | Auth. (contributor+) Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin <= 3.1.2 versions. |
CVE-2022-41785 | Medium | 5.4 | 2023-03-21 | Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions. |
CVE-2022-45124 | High | 7.5 | 2023-03-20 | An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network pa… |
CVE-2022-43663 | High | 8.1 | 2023-03-20 | An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network pa… |