2022 CVEs (page 45)
Page 45 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-48347 | High | 7.5 | 2023-03-27 | The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48346 | High | 7.5 | 2023-03-27 | The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality. |
CVE-2022-48291 | Medium | 6.5 | 2023-03-27 | The Bluetooth module has an authentication bypass vulnerability in the pairing process. Successful exploitation of this vulnerability may affect confidentialit… |
CVE-2022-3116 | High | 7.5 | 2023-03-27 | The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance. An attacker with network access to an application that depends on t… |
CVE-2022-2237 | Medium | 6.1 | 2023-03-27 | A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function. |
CVE-2022-46416 | Critical | 9.1 | 2023-03-27 | Parrot Bebop 4.7.1. allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacker… |
CVE-2022-46415 | Critical | 9.1 | 2023-03-27 | DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. To accomplish this, the attacke… |
CVE-2022-48428 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible |
CVE-2022-48427 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible |
CVE-2022-48429 | Medium | 4.6 | 2023-03-27 | In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible |
CVE-2022-48426 | Medium | 4.6 | 2023-03-27 | In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible |
CVE-2022-47146 | High | 7.1 | 2023-03-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions. |
CVE-2022-47925 | High | 7.5 | 2023-03-27 | The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insufficient input validat… |
CVE-2022-47924 | Medium | 6.5 | 2023-03-27 | An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wi… |
CVE-2022-46843 | High | 7.1 | 2023-03-27 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Le Van Toan Woocommerce Vietnam Checkout plugin <= 2.0.4 versions. |
CVE-2022-41354 | Medium | 4.3 | 2023-03-27 | An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications. |
CVE-2022-30705 | Medium | 5.4 | 2023-03-27 | Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <= 2.35.1.2.3 versions. |
CVE-2022-32199 | Medium | 6.5 | 2023-03-27 | db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the file parameter. |
CVE-2022-4126 | Critical | 9.6 | 2023-03-27 | Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: befo… |
CVE-2022-39043 | Low | 2.4 | 2023-03-27 | Juiker app stores debug logs which contains sensitive information to mobile external storage. An unauthenticated physical attacker can access these files to ac… |
CVE-2022-45597 | Critical | 9.8 | 2023-03-24 | ComponentSpace.Saml2 4.4.0 Missing SSL Certificate Validation. NOTE: the vendor does not consider this a vulnerability because the report is only about use of… |
CVE-2022-42528 | Medium | 5.5 | 2023-03-24 | In ffa_mrd_prot of shared_mem.c, there is a possible ID due to a logic error in the code. This could lead to local information disclosure with no additional ex… |
CVE-2022-42500 | Medium | 6.7 | 2023-03-24 | In OEM_OnRequest of sced.cpp, there is a possible shell command execution due to improper input validation. This could lead to local escalation of privilege wi… |
CVE-2022-42499 | Critical | 9.8 | 2023-03-24 | In sms_SendMmCpErrMsg of sms_MmConManagement.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote code execution… |
CVE-2022-42498 | Critical | 9.8 | 2023-03-24 | In Pixel cellular firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution with no additional… |
CVE-2022-40208 | Medium | 4.3 | 2023-03-24 | In Moodle, insufficient limitations in some quiz web services made it possible for students to bypass sequential navigation during a quiz attempt. |
CVE-2022-20542 | High | 7.8 | 2023-03-24 | In parseParamsBlob of types.cpp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with n… |
CVE-2022-20532 | Critical | 9.8 | 2023-03-24 | In parseTrackFragmentRun() of MPEG4Extractor.cpp, there is a possible out of bounds read due to an integer overflow. This could lead to remote escalation of pr… |
CVE-2022-20499 | Medium | 5.5 | 2023-03-24 | In validateForCommonR1andR2 of PasspointConfiguration.java, uncaught errors in parsing stored configs could lead to local persistent denial of service with no… |
CVE-2022-20467 | Medium | 5.5 | 2023-03-24 | In isBluetoothShareUri of BluetoothOppUtility.java, there is a possible incorrect file read due to a confused deputy. This could lead to local information disc… |
CVE-2022-47502 | High | 7.8 | 2023-03-24 | Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can… |
CVE-2022-38745 | High | 7.8 | 2023-03-24 | Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the curr… |
CVE-2022-42948 | Critical | 9.8 | 2023-03-24 | Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components. By injecting crafted HTML code, it is possible to remotely… |
CVE-2022-28495 | Critical | 9.8 | 2023-03-24 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setWebWlanIdx function via the webWlanIdx para… |
CVE-2022-3146 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2022-3101 | Medium | 5.5 | 2023-03-23 | A flaw was found in tripleo-ansible. Due to an insecure default configuration, the permissions of a sensitive file are not sufficiently restricted. This flaw a… |
CVE-2022-36413 | Critical | 9.1 | 2023-03-23 | Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications. |
CVE-2022-47145 | High | 7.1 | 2023-03-23 | Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions. |
CVE-2022-28496 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via the adminuser and adm… |
CVE-2022-47173 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nasirahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced… |
CVE-2022-28497 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_write_bootloader function via the filename… |
CVE-2022-47589 | Medium | 5.9 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in this.Functional CTT Expresso para WooCommerce plugin <= 3.2.11 versions. |
CVE-2022-28493 | Critical | 9.8 | 2023-03-23 | A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service, |
CVE-2022-28491 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name parameter. This vul… |
CVE-2022-28492 | Critical | 9.8 | 2023-03-23 | TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login. |
CVE-2022-4224 | High | 8.8 | 2023-03-23 | In multiple products of CODESYS v3 in multiple versions a remote low privileged user could utilize this vulnerability to read and modify system files and OS re… |
CVE-2022-47431 | High | 7.1 | 2023-03-23 | Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions. |
CVE-2022-45843 | Medium | 5.4 | 2023-03-23 | Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Nextend Smart Slider 3 plugin <= 3.5.1.9 versions. |
CVE-2022-44742 | Medium | 4.8 | 2023-03-23 | Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions. |
CVE-2022-22512 | Critical | 9.8 | 2023-03-23 | Hard-coded credentials in Web-UI of multiple VARTA Storage products in multiple versions allows an unauthorized attacker to gain administrative access to the W… |
CVE-2022-30037 | High | 7.2 | 2023-03-23 | XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the add function in cro… |
CVE-2022-28494 | Critical | 9.8 | 2023-03-23 | TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via the filename paramet… |
CVE-2022-43863 | Medium | 6.7 | 2023-03-22 | IBM QRadar SIEM 7.4 and 7.5 is vulnerable to privilege escalation, allowing a user with some admin capabilities to gain additional admin capabilities. IBM X-F… |
CVE-2022-45004 | Medium | 6.1 | 2023-03-22 | Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page. |
CVE-2022-45003 | High | 7.5 | 2023-03-22 | Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus. |
CVE-2022-4095 | High | 7.8 | 2023-03-22 | A use-after-free flaw was found in Linux kernel before 5.19.2. This issue occurs in cmd_hdl_filter in drivers/staging/rtl8712/rtl8712_cmd.c, allowing an attack… |
CVE-2022-37940 | Medium | 5.3 | 2023-03-22 | Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow ho… |
CVE-2022-45634 | Medium | 4.3 | 2023-03-22 | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows authenticated attacker to gain access to sensitive account information |
CVE-2022-46300 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-46286 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45468 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45121 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-43512 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-41696 | Medium | 5.5 | 2023-03-21 | Versions of VISAM VBASE Automation Base prior to 11.7.5 may disclose information if a valid user opens a specially crafted file. |
CVE-2022-45636 | High | 8.1 | 2023-03-21 | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) without authorization via arbitrary API req… |
CVE-2022-38458 | Medium | 6.5 | 2023-03-21 | A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted man-in-the-midd… |
CVE-2022-38452 | High | 7.2 | 2023-03-21 | A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted network request… |
CVE-2022-37337 | Critical | 9.1 | 2023-03-21 | A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request can lead t… |
CVE-2022-36429 | High | 7.2 | 2023-03-21 | A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. A specially-crafted JSON ob… |
CVE-2022-45637 | Critical | 9.8 | 2023-03-21 | An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 service via insecure expiry mechanism. |
CVE-2022-45635 | High | 7.5 | 2023-03-21 | An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account information via insecure p… |
CVE-2022-42334 | Medium | 6.5 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2022-42333 | High | 8.6 | 2023-03-21 | x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond… |
CVE-2022-42332 | High | 7.8 | 2023-03-21 | x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Paging (HAP) is unavai… |
CVE-2022-42331 | Medium | 5.5 | 2023-03-21 | x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one entrypath performs… |
CVE-2022-42485 | Medium | 5.4 | 2023-03-21 | Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Galaxy Weblinks Gallery with thumbnail slider plugin <= 6.0 versions. |
CVE-2022-41831 | Medium | 5.4 | 2023-03-21 | Auth. (contributor+) Cross-Site Scripting vulnerability in TCBarrett WP Glossary plugin <= 3.1.2 versions. |
CVE-2022-41785 | Medium | 5.4 | 2023-03-21 | Auth. (contributor+) Stored Cross-Site Scripting vulnerability in Galleryape Gallery Images Ape plugin <= 2.2.8 versions. |
CVE-2022-45124 | High | 7.5 | 2023-03-20 | An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network pa… |
CVE-2022-43663 | High | 8.1 | 2023-03-20 | An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. A specially crafted network pa… |
CVE-2022-4148 | Medium | 4.3 | 2023-03-20 | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow an… |
CVE-2022-3894 | Medium | 4.3 | 2023-03-20 | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.5 does not have CSRF check when deleting a client, and does not ensure that the object t… |
CVE-2022-47591 | High | 7.1 | 2023-03-20 | Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions. |
CVE-2022-47592 | High | 7.1 | 2023-03-20 | Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <= 0.1 versions. |
CVE-2022-4933 | Medium | 6.3 | 2023-03-20 | A vulnerability, which was classified as critical, has been found in ATM Consulting dolibarr_module_quicksupplierprice up to 1.1.6. Affected by this issue is t… |
CVE-2022-48425 | High | 7.8 | 2023-03-19 | In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. |
CVE-2022-48424 | High | 7.8 | 2023-03-19 | In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur. |
CVE-2022-48423 | High | 7.8 | 2023-03-19 | In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur. |
CVE-2022-48422 | High | 7.8 | 2023-03-19 | ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working direct… |
CVE-2022-46867 | Medium | 4.3 | 2023-03-17 | Cross-Site Request Forgery (CSRF) vulnerability in Chasil Universal Star Rating plugin <= 2.1.0 version. |
CVE-2022-46854 | Medium | 5.4 | 2023-03-17 | Cross-Site Request Forgery (CSRF) vulnerability in Obox Themes Launchpad – Coming Soon & Maintenance Mode plugin <= 1.0.13 versions. |
CVE-2022-45817 | Medium | 5.4 | 2023-03-17 | Cross-Site Scripting (XSS) vulnerability in Erin Garscadden GC Testimonials plugin <= 1.3.2 versions. |
CVE-2022-45814 | Medium | 5.4 | 2023-03-17 | Stored Cross-Site Scripting (XSS) vulnerability in Fabian von Allmen WP Calendar plugin <= 1.5.3 versions. |
CVE-2022-43461 | Medium | 4.8 | 2023-03-17 | Stored Cross-Site Scripting (XSS) vulnerability in John West Slideshow SE plugin <= 2.5.5 versions. |
CVE-2022-43606 | High | 7.5 | 2023-03-16 | A use-of-uninitialized-pointer vulnerability exists in the Forward Open connection_management_entry functionality of EIP Stack Group OpENer development commit… |
CVE-2022-43605 | Critical | 10.0 | 2023-03-16 | An out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c… |
CVE-2022-43604 | Critical | 10.0 | 2023-03-16 | An out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c… |
CVE-2022-43441 | High | 8.1 | 2023-03-16 | A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1. A specially-crafted Javascript file can l… |
CVE-2022-34423 | High | 7.5 | 2023-03-16 | Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability. A local malicious user with high Privileg… |
CVE-2022-26080 | Medium | 6.3 | 2023-03-16 | Use of Insufficiently Random Values vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant.This issue affects Pulsar Plus Syst… |