2022 CVEs (page 48)
Page 48 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39228 | Medium | 5.3 | 2023-03-01 | vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password co… |
CVE-2022-45608 | High | 8.8 | 2023-03-01 | An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER_USER) to gain escalated privileges (vertically) and become an Administr… |
CVE-2022-36021 | Medium | 5.5 | 2023-03-01 | Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pat… |
CVE-2022-47148 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss. |
CVE-2022-46806 | Medium | 5.4 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification. |
CVE-2022-46805 | Medium | 5.4 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 leading to activation/deactiva… |
CVE-2022-46798 | Medium | 5.4 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.5.1 leading to plugin settings change. |
CVE-2022-46797 | Medium | 5.4 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 lead… |
CVE-2022-45804 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy c… |
CVE-2022-45068 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1. |
CVE-2022-40198 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change. |
CVE-2022-38468 | Medium | 4.3 | 2023-03-01 | Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration. |
CVE-2022-37938 | Critical | 9.8 | 2023-03-01 | Unauthenticated server side request forgery in HPE Serviceguard Manager |
CVE-2022-37937 | Critical | 9.8 | 2023-03-01 | Pre-auth memory corruption in HPE Serviceguard |
CVE-2022-37936 | Critical | 9.8 | 2023-03-01 | Unauthenticated Java deserialization vulnerability in Serviceguard Manager |
CVE-2022-37935 | Medium | 5.5 | 2023-03-01 | HPE OneView for VMware vCenter, in certain circumstances, may disclose the “HPE OneView” Username and Password. |
CVE-2022-27677 | High | 7.8 | 2023-03-01 | Failure to validate privileges during installation of AMD Ryzen™ Master may allow an attacker with low privileges to modify files potentially leading to privi… |
CVE-2022-27672 | Medium | 4.7 | 2023-03-01 | When SMT is enabled, certain AMD processors may speculatively execute instructions using a target from the sibling thread after an SMT mode switch potentially… |
CVE-2022-20952 | Medium | 5.3 | 2023-03-01 | A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could a… |
CVE-2022-38220 | Medium | 6.1 | 2023-03-01 | An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary web script or HTML. |
CVE-2022-47076 | High | 7.5 | 2023-02-28 | An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx. |
CVE-2022-47075 | High | 7.5 | 2023-02-28 | An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmploye… |
CVE-2022-23240 | Medium | 6.5 | 2023-02-28 | Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows unauthorize… |
CVE-2022-23239 | Medium | 4.8 | 2023-02-28 | Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which allows administrat… |
CVE-2022-41727 | Medium | 5.5 | 2023-02-28 | An attacker can craft a malformed TIFF image which will consume a significant amount of memory when passed to DecodeConfig. This could lead to a denial of serv… |
CVE-2022-41725 | High | 7.5 | 2023-02-28 | A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm… |
CVE-2022-41724 | High | 7.5 | 2023-02-28 | Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respecti… |
CVE-2022-41723 | High | 7.5 | 2023-02-28 | A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of… |
CVE-2022-41722 | High | 7.5 | 2023-02-28 | A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b"… |
CVE-2022-20551 | Medium | 6.7 | 2023-02-28 | In createTrack of AudioFlinger.cpp, there is a possible way to record audio without a privacy indicator due to a logic error in the code. This could lead to lo… |
CVE-2022-20481 | Medium | 5.5 | 2023-02-28 | In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset. This could lead to local information disclosure with n… |
CVE-2022-20455 | Medium | 5.5 | 2023-02-28 | In addAutomaticZenRule of ZenModeHelper.java, there is a possible persistent denial of service due to resource exhaustion. This could lead to local denial of s… |
CVE-2022-47612 | Medium | 4.3 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update. |
CVE-2022-47179 | Medium | 4.3 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <= 5.6.11 leads to post duplication as a draft. |
CVE-2022-43459 | Medium | 5.4 | 2023-02-28 | Cross-Site Request Forgery (CSRF) vulnerability in Forms by CaptainForm – Form Builder for WordPress plugin <= 2.5.3 versions. |
CVE-2022-4895 | High | 8.6 | 2023-02-28 | Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on… |
CVE-2022-3884 | High | 7.3 | 2023-02-28 | Incorrect Default Permissions vulnerability in Hitachi Ops Center Analyzer on Windows (Hitachi Ops Center Analyzer RAID Agent component) allows local users to… |
CVE-2022-46723 | Critical | 9.8 | 2023-02-27 | This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 11.7.1. A remote user may be able to write arbitrary… |
CVE-2022-46713 | Medium | 4.7 | 2023-02-27 | A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. An app may be… |
CVE-2022-46712 | High | 7.8 | 2023-02-27 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13. An app may be able to cause unexpected system te… |
CVE-2022-46705 | Medium | 4.3 | 2023-02-27 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, mac… |
CVE-2022-46704 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may… |
CVE-2022-42838 | Low | 3.3 | 2023-02-27 | An issue with app access to camera data was addressed with improved logic. This issue is fixed in macOS Ventura 13. A camera extension may be able to continue… |
CVE-2022-42833 | High | 7.8 | 2023-02-27 | An out-of-bounds read was addressed with improved input validation. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with… |
CVE-2022-42826 | High | 8.8 | 2023-02-27 | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13, iOS 16.1 and iPadOS 16, Safari 16.1. Processing… |
CVE-2022-42797 | High | 7.8 | 2023-02-27 | An injection issue was addressed with improved input validation. This issue is fixed in Xcode 14.1. An app may be able to gain root privileges. |
CVE-2022-32949 | High | 7.8 | 2023-02-27 | This issue was addressed with improved checks. This issue is fixed in iOS 15.7.1 and iPadOS 15.7.1, tvOS 16. An app may be able to execute arbitrary code with… |
CVE-2022-32906 | Medium | 5.3 | 2023-02-27 | This issue was addressed with using HTTPS when sending information over the network. This issue is fixed in Apple Music 3.9.10 for Android. A user in a privile… |
CVE-2022-32902 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6, macOS Big Sur 11.7. An app may be abl… |
CVE-2022-32900 | High | 7.8 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in macOS Monterey 12.6, macOS Big Sur 11.7. An app may be able to gain elevated… |
CVE-2022-32896 | Medium | 5.5 | 2023-02-27 | This issue was addressed by enabling hardened runtime. This issue is fixed in macOS Monterey 12.6, macOS Big Sur 11.7. A user may be able to view sensitive use… |
CVE-2022-32891 | Medium | 6.1 | 2023-02-27 | The issue was addressed with improved UI handling. This issue is fixed in Safari 16, tvOS 16, watchOS 9, iOS 16. Visiting a website that frames malicious conte… |
CVE-2022-32855 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in iOS 15.6 and iPadOS 15.6. A user may be able to view restricted content from… |
CVE-2022-32846 | High | 7.5 | 2023-02-27 | A logic issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive… |
CVE-2022-32844 | Medium | 6.3 | 2023-02-27 | A race condition was addressed with improved state handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app with arbitrary ker… |
CVE-2022-32836 | High | 7.5 | 2023-02-27 | This issue was addressed with improved state management. This issue is fixed in Apple Music 3.9.10 for Android. An app may be able to access user-sensitive dat… |
CVE-2022-32830 | High | 7.5 | 2023-02-27 | An out-of-bounds read issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.6, iOS 15.6 and iPadOS 15.6. Processing a maliciously c… |
CVE-2022-32824 | Medium | 5.5 | 2023-02-27 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6. An app may be able to disclose… |
CVE-2022-32784 | Medium | 6.5 | 2023-02-27 | The issue was addressed with improved UI handling. This issue is fixed in Safari 15.6, iOS 15.6 and iPadOS 15.6. Visiting a maliciously crafted website may lea… |
CVE-2022-26760 | Critical | 9.8 | 2023-02-27 | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 15.5 and iPadOS 15.5. A malicious application may be able to… |
CVE-2022-22668 | Medium | 5.5 | 2023-02-27 | A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.4 and iPadOS 15.4, macOS Monterey 12.3. A malicious application may be ab… |
CVE-2022-22582 | Medium | 5.5 | 2023-02-27 | A validation issue existed in the handling of symlinks. This issue was addressed with improved validation of symlinks. This issue is fixed in Security Update 2… |
CVE-2022-48305 | Medium | 5.5 | 2023-02-27 | There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274. Successful exploitation of this vulnerability m… |
CVE-2022-48284 | Critical | 9.8 | 2023-02-27 | A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could all… |
CVE-2022-48283 | Critical | 9.8 | 2023-02-27 | A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability. Successful exploitation of this vulnerability could all… |
CVE-2022-48261 | High | 7.5 | 2023-02-27 | There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation of this vulnerability may cause the printer service to… |
CVE-2022-48260 | High | 7.5 | 2023-02-27 | There is a buffer overflow vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to device service exceptions. |
CVE-2022-48259 | Critical | 9.8 | 2023-02-27 | There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could allow attackers to gain higher privileges. |
CVE-2022-48255 | Critical | 9.8 | 2023-02-27 | There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. A Huawei printer has a system command injection vulnerability. Successful exploi… |
CVE-2022-48254 | Medium | 4.6 | 2023-02-27 | There is a data processing error vulnerability in Leia-B29 2.0.0.49(M03). Successful exploitation could bypass lock screen authentication. |
CVE-2022-48230 | High | 7.5 | 2023-02-27 | There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could lead to DoS. |
CVE-2022-4829 | Medium | 5.4 | 2023-02-27 | The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the… |
CVE-2022-4795 | Medium | 5.4 | 2023-02-27 | The Galleries by Angie Makes WordPress plugin through 1.67 does not validate and escape some of its shortcode attributes before outputting them back in a page/… |
CVE-2022-4788 | Medium | 5.4 | 2023-02-27 | The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2022-4757 | Medium | 5.4 | 2023-02-27 | The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-4679 | Medium | 5.4 | 2023-02-27 | The Wufoo Shortcode WordPress plugin before 1.52 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2022-4550 | High | 7.5 | 2023-02-27 | The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP s… |
CVE-2022-45697 | High | 7.8 | 2023-02-27 | Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory. |
CVE-2022-45140 | Critical | 9.8 | 2023-02-27 | The configuration backend allows an unauthenticated user to write arbitrary data with root privileges to the storage, which could lead to unauthenticated remot… |
CVE-2022-45139 | Medium | 5.3 | 2023-02-27 | A CORS Misconfiguration in the web-based management allows a malicious third party webserver to misuse all basic information pages on the webserver. In combina… |
CVE-2022-45138 | Critical | 9.8 | 2023-02-27 | The configuration backend of the web-based management can be used by unauthenticated users, although only authenticated users should be able to use the API. Th… |
CVE-2022-45137 | Medium | 6.1 | 2023-02-27 | The configuration backend of the web-based management is vulnerable to reflected XSS (Cross-Site Scripting) attacks that targets the users browser. This leads… |
CVE-2022-40237 | Medium | 6.5 | 2023-02-27 | IBM MQ for HPE NonStop 8.1.0 is vulnerable to a denial of service attack due to an error within the CCDT and channel synchronization logic. IBM X-Force ID: 2… |
CVE-2022-34910 | Medium | 4.1 | 2023-02-27 | An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It uses a local database to store data and accounts. However, the password i… |
CVE-2022-34909 | High | 7.7 | 2023-02-27 | An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It allows SQL Injection, by which an attacker can bypass authentication and… |
CVE-2022-34908 | High | 8.2 | 2023-02-27 | An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not requ… |
CVE-2022-31405 | Medium | 6.5 | 2023-02-27 | MV iDigital Clinic Enterprise (iDCE) 1.0 stores passwords in cleartext. |
CVE-2022-48363 | High | 7.5 | 2023-02-26 | In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain situations involving… |
CVE-2022-48362 | High | 8.8 | 2023-02-25 | Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, aut… |
CVE-2022-2024 | Critical | 9.8 | 2023-02-25 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11. |
CVE-2022-23535 | High | 7.3 | 2023-02-24 | LiteDB is a small, fast and lightweight .NET NoSQL embedded database. Versions prior to 5.0.13 are subject to Deserialization of Untrusted Data. LiteDB uses a… |
CVE-2022-44310 | High | 7.5 | 2023-02-24 | In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret. |
CVE-2022-4203 | Medium | 4.9 | 2023-02-24 | A read buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after certificate cha… |
CVE-2022-43923 | Medium | 6.2 | 2023-02-24 | IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local user. IBM X-Force ID: 241584. |
CVE-2022-48345 | Medium | 6.1 | 2023-02-24 | sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities. |
CVE-2022-1607 | Medium | 4.6 | 2023-02-24 | Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.Thi… |
CVE-2022-46440 | Medium | 5.5 | 2023-02-24 | ttftool v0.9.2 was discovered to contain a segmentation violation via the readU16 function at ttf.c. |
CVE-2022-46785 | Medium | 6.1 | 2023-02-23 | SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 1 of 2). |
CVE-2022-46784 | Medium | 6.1 | 2023-02-23 | SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was originally found in 5.5.1 GA.) |
CVE-2022-36231 | Critical | 9.8 | 2023-02-23 | pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3. |