2022 CVEs (page 49)
Page 49 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41216 | High | 8.3 | 2023-02-22 | Local File Inclusion vulnerability within Cloudflow allows attackers to retrieve confidential information from the system. |
CVE-2022-2883 | High | 7.5 | 2023-02-22 | In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service |
CVE-2022-38779 | Medium | 6.1 | 2023-02-22 | An open redirect issue was discovered in Kibana that could lead to a user being redirected to an arbitrary website if they use a maliciously crafted Kibana URL. |
CVE-2022-46637 | Critical | 9.8 | 2023-02-21 | Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services. |
CVE-2022-48282 | Medium | 6.6 | 2023-02-21 | Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause… |
CVE-2022-45677 | Critical | 9.8 | 2023-02-21 | SQL Injection Vulnerability in tanujpatra228 Tution Management System (TMS) via the email parameter to processes/student_login.process.php. |
CVE-2022-45564 | Critical | 9.8 | 2023-02-21 | SQL Injection vulnerability in znfit Home improvement ERP management system V50_20220207,v42 allows attackers to execute arbitrary sql commands via the userCod… |
CVE-2022-3353 | Medium | 5.9 | 2023-02-21 | A vulnerability exists in the IEC 61850 communication stack that affects multiple Hitachi Energy products. An attacker could exploit the vulnerability by… |
CVE-2022-31394 | High | 7.5 | 2023-02-21 | Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform… |
CVE-2022-4897 | Medium | 6.1 | 2023-02-21 | The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected… |
CVE-2022-4791 | Medium | 5.4 | 2023-02-21 | The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which c… |
CVE-2022-4786 | Medium | 5.4 | 2023-02-21 | The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2022-4785 | Medium | 5.4 | 2023-02-21 | The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2022-4784 | Medium | 5.4 | 2023-02-21 | The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2022-4777 | Medium | 5.4 | 2023-02-21 | The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |
CVE-2022-4764 | Medium | 5.4 | 2023-02-21 | The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/p… |
CVE-2022-4761 | Medium | 5.4 | 2023-02-21 | The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wh… |
CVE-2022-4754 | Medium | 5.4 | 2023-02-21 | The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a… |
CVE-2022-4752 | Medium | 5.4 | 2023-02-21 | The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2022-4750 | Medium | 5.4 | 2023-02-21 | The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting t… |
CVE-2022-4714 | Medium | 5.4 | 2023-02-21 | The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as cont… |
CVE-2022-4669 | Medium | 5.4 | 2023-02-21 | The Page Builder: Live Composer WordPress plugin before 1.5.23 does not validate and escape some of its shortcode attributes before outputting them back in a p… |
CVE-2022-4666 | Medium | 5.4 | 2023-02-21 | The Markup (JSON-LD) structured in schema.org WordPress plugin through 4.8.1 does not validate and escape some of its shortcode attributes before outputting th… |
CVE-2022-4622 | Medium | 5.4 | 2023-02-21 | The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post w… |
CVE-2022-4386 | Medium | 4.3 | 2023-02-21 | The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any use… |
CVE-2022-4385 | Medium | 4.3 | 2023-02-21 | The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in use… |
CVE-2022-48340 | High | 7.5 | 2023-02-21 | In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free. |
CVE-2022-48339 | High | 7.8 | 2023-02-20 | An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file… |
CVE-2022-48338 | High | 7.3 | 2023-02-20 | An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-f… |
CVE-2022-48337 | Critical | 9.8 | 2023-02-20 | GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system… |
CVE-2022-44216 | High | 7.5 | 2023-02-20 | Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password. |
CVE-2022-3901 | High | 7.2 | 2023-02-20 | Prototype Pollution in Visioweb.js 1.10.6 allows attackers to execute XSS on the client system. |
CVE-2022-48321 | Medium | 6.8 | 2023-02-20 | Limited Server-Side Request Forgery (SSRF) in agent-receiver in Tribe29's Checkmk <= 2.1.0p11 allows an attacker to communicate with local network restricted e… |
CVE-2022-48320 | Medium | 5.4 | 2023-02-20 | Cross-site Request Forgery (CSRF) in Tribe29's Checkmk <= 2.1.0p17, Checkmk <= 2.0.0p31, and all versions of Checkmk 1.6.0 (EOL) allow an attacker to add new v… |
CVE-2022-48319 | Medium | 6.5 | 2023-02-20 | Sensitive host secret disclosed in cmk-update-agent.log file in Tribe29's Checkmk <= 2.1.0p13, Checkmk <= 2.0.0p29, and all versions of Checkmk 1.6.0 (EOL) all… |
CVE-2022-48318 | Medium | 5.3 | 2023-02-20 | No authorisation controls in the RestAPI documentation for Tribe29's Checkmk <= 2.1.0p13 and Checkmk <= 2.0.0p29 which may lead to unintended information discl… |
CVE-2022-48317 | Medium | 5.6 | 2023-02-20 | Expired sessions were not securely terminated in the RestAPI for Tribe29's Checkmk <= 2.1.0p10 and Checkmk <= 2.0.0p28 allowing an attacker to use expired sess… |
CVE-2022-47909 | Medium | 6.8 | 2023-02-20 | Livestatus Query Language (LQL) injection in the AuthUser HTTP query header of Tribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk… |
CVE-2022-46836 | Critical | 9.1 | 2023-02-20 | PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to in… |
CVE-2022-46303 | High | 8.0 | 2023-02-20 | Command injection in SMS notifications in Tribe29 Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker with User Management per… |
CVE-2022-48329 | Critical | 9.8 | 2023-02-20 | MISP before 2.4.166 unsafely allows users to use the order parameter, related to app/Model/Attribute.php, app/Model/GalaxyCluster.php, app/Model/Workflow.php… |
CVE-2022-48328 | Critical | 9.8 | 2023-02-20 | app/Controller/Component/IndexFilterComponent.php in MISP before 2.4.167 mishandles ordered_url_params and additional_delimiters. |
CVE-2022-40348 | Medium | 5.4 | 2023-02-18 | Cross Site Scripting (XSS) vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'name' and 'email' parameters, allows attackers to ex… |
CVE-2022-48115 | Medium | 6.1 | 2023-02-17 | The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS). |
CVE-2022-40021 | Critical | 9.8 | 2023-02-17 | QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability. |
CVE-2022-43579 | Medium | 4.6 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 is vulnerable to cross-site scripting. This vulnerability allo… |
CVE-2022-40231 | Medium | 4.3 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.0.3.7 and 6.1.0.0 through 6.1.2.0 could allow an authenticated user to perform unauthorized acti… |
CVE-2022-34351 | Medium | 5.9 | 2023-02-17 | IBM QRadar SIEM 7.4 and 7.5 is vulnerable to information exposure allowing a non-tenant user with a specific domain security profile assigned to see some data… |
CVE-2022-43930 | Medium | 6.2 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to an Information Disclosure as sensitive information may be included in a log file. IB… |
CVE-2022-41734 | Medium | 5.3 | 2023-02-17 | IBM Maximo Asset Management 7.6.1.2 and 7.6.1.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is return… |
CVE-2022-40232 | Medium | 6.3 | 2023-02-17 | IBM Sterling B2B Integrator Standard Edition 6.1.0.0 through 6.1.1.1, and 6.1.2.0 could allow an authenticated user to perform actions they should not have ac… |
CVE-2022-20803 | High | 8.6 | 2023-02-17 | A vulnerability in the OLE2 file parser of Clam AntiVirus (ClamAV) versions 0.104.0 through 0.104.2 could allow an unauthenticated, remote attacker to cause a… |
CVE-2022-43929 | Medium | 4.9 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 11.1 and 11.5 may be vulnerable to a Denial of Service when executing a specially crafted 'Load' command. IBM X-Force ID… |
CVE-2022-43927 | Medium | 5.9 | 2023-02-17 | IBM Db2 for Linux, UNIX and Windows 10.5, 11.1, and 11.5 is vulnerable to information Disclosure due to improper privilege management when a specially crafted… |
CVE-2022-36775 | Medium | 6.5 | 2023-02-17 | IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper validation of input b… |
CVE-2022-47986 | Critical | 9.8 | 2023-02-17 | IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw… |
CVE-2022-45701 | High | 8.8 | 2023-02-17 | Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature. |
CVE-2022-40032 | Critical | 9.8 | 2023-02-17 | SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitr… |
CVE-2022-32972 | High | 7.8 | 2023-02-17 | Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation. |
CVE-2022-40347 | Critical | 9.8 | 2023-02-17 | SQL Injection vulnerability in Intern Record System version 1.0 in /intern/controller.php in 'phone', 'email', 'deptType' and 'name' parameters, allows attacke… |
CVE-2022-47703 | High | 7.5 | 2023-02-16 | TIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5.0_LCD_20200513, Firmware Version MV8.003, and Hardware Version… |
CVE-2022-44299 | Medium | 4.9 | 2023-02-16 | SiteServerCMS 7.1.3 sscms has a file read vulnerability. |
CVE-2022-0637 | Medium | 6.1 | 2023-02-16 | open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6 |
CVE-2022-48327 | Medium | 6.1 | 2023-02-16 | Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) dataInicia… |
CVE-2022-48326 | Medium | 6.1 | 2023-02-16 | Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) nome, (2)… |
CVE-2022-48325 | Medium | 6.1 | 2023-02-16 | Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) year, (2)… |
CVE-2022-48324 | Medium | 6.1 | 2023-02-16 | Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) pesquisa… |
CVE-2022-41614 | Medium | 5.5 | 2023-02-16 | Insufficiently protected credentials in the Intel(R) ON Event Series Android application before version 2.0 may allow an authenticated user to potentially enab… |
CVE-2022-41314 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in some Intel(R) Network Adapter installer software may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-38090 | Medium | 6.0 | 2023-02-16 | Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially ena… |
CVE-2022-38056 | Low | 3.8 | 2023-02-16 | Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of privilege via netwo… |
CVE-2022-37340 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in some Intel(R) QAT drivers for Windows before version 1.6 may allow an authenticated user to potentially enable escalation of privil… |
CVE-2022-36797 | Low | 3.3 | 2023-02-16 | Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.1 may allow an authenticated user to poten… |
CVE-2022-36416 | Medium | 4.4 | 2023-02-16 | Protection mechanism failure in the Intel(R) Ethernet 500 Series Controller drivers for VMware before version 1.10.0.13 may allow an authenticated user to pote… |
CVE-2022-36397 | High | 7.3 | 2023-02-16 | Incorrect default permissions in the software installer for some Intel(R) QAT drivers for Linux before version 4.17 may allow an authenticated user to potentia… |
CVE-2022-36382 | Medium | 6.0 | 2023-02-16 | Out-of-bounds write in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 1.7.0.8 and some Intel(R) Ethernet 700 S… |
CVE-2022-36369 | High | 7.8 | 2023-02-16 | Improper access control in some QATzip software maintained by Intel(R) before version 1.0.9 may allow an authenticated user to potentially enable escalation of… |
CVE-2022-36289 | Low | 2.8 | 2023-02-16 | Protection mechanism failure in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service v… |
CVE-2022-36287 | Medium | 4.0 | 2023-02-16 | Uncaught exception in the FCS Server software maintained by Intel before version 1.1.79.3 may allow a privileged user to potentially enable denial of service v… |
CVE-2022-35883 | Low | 2.2 | 2023-02-16 | NULL pointer dereference in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable denial of service via l… |
CVE-2022-35729 | High | 7.5 | 2023-02-16 | Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enable denial of servic… |
CVE-2022-34864 | Medium | 4.2 | 2023-02-16 | Out-of-bounds read in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentially enable escalation… |
CVE-2022-34854 | Medium | 6.7 | 2023-02-16 | Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-34843 | Medium | 4.8 | 2023-02-16 | Integer overflow in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentially enable escalation o… |
CVE-2022-34841 | Medium | 5.7 | 2023-02-16 | Improper buffer restrictions in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privi… |
CVE-2022-34346 | Medium | 4.8 | 2023-02-16 | Out-of-bounds read in the Intel(R) Media SDK software before version 22.2.2 may allow an authenticated user to potentially enable escalation of privilege via l… |
CVE-2022-33972 | Medium | 6.1 | 2023-02-16 | Incorrect calculation in microcode keying mechanism for some 3rd Generation Intel(R) Xeon(R) Scalable Processors may allow a privileged user to potentially ena… |
CVE-2022-33964 | High | 7.4 | 2023-02-16 | Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalation of privilege… |
CVE-2022-33946 | Medium | 5.6 | 2023-02-16 | Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-33196 | High | 7.2 | 2023-02-16 | Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which… |
CVE-2022-33190 | High | 7.1 | 2023-02-16 | Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2022-32971 | Low | 3.1 | 2023-02-16 | Improper authentication in the Intel(R) SUR software before version 2.4.8902 may allow a privileged user to potentially enable escalation of privilege via netw… |
CVE-2022-32575 | Medium | 4.8 | 2023-02-16 | Out-of-bounds write in the Intel(R) Trace Analyzer and Collector software before version 2021.5 may allow an authenticated user to potentially enable escalatio… |
CVE-2022-31476 | Medium | 5.5 | 2023-02-16 | Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable denial of service via local… |
CVE-2022-30692 | Medium | 5.9 | 2023-02-16 | Improper conditions check in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable denial of service via ne… |
CVE-2022-29523 | Low | 3.3 | 2023-02-16 | Improper conditions check in the Open CAS software maintained by Intel(R) before version 22.3.1 may allow an authenticated user to potentially enable denial of… |
CVE-2022-29514 | High | 7.7 | 2023-02-16 | Improper access control in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable escalation of privilege vi… |
CVE-2022-29494 | Medium | 6.5 | 2023-02-16 | Improper input validation in firmware for OpenBMC in some Intel(R) platforms before versions egs-0.91-179 and bhs-04-45 may allow an authenticated user to pote… |
CVE-2022-29493 | Medium | 4.5 | 2023-02-16 | Uncaught exception in webserver for the Integrated BMC in some Intel(R) platforms before versions 2.86, 2.09 and 2.78 may allow a privileged user to potentiall… |
CVE-2022-27808 | Medium | 6.3 | 2023-02-16 | Insufficient control flow management in some Intel(R) Ethernet Controller Administrative Tools drivers for Windows before version 1.5.0.2 may allow an authenti… |