2022 CVEs (page 51)
Page 51 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47372 | High | 7.6 | 2023-02-15 | Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability… |
CVE-2022-45437 | Medium | 6.5 | 2023-02-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all allows Cross-Site Scr… |
CVE-2022-45436 | Medium | 6.1 | 2023-02-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Artica PFMS Pandora FMS v765 on all platforms, allows Cro… |
CVE-2022-32953 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the SdHostDriver buffer used by SMM and non-SMM code could cause TOCTOU… |
CVE-2022-32476 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the AhciBusDxe shared buffer used by SMM and non-SMM code could cause T… |
CVE-2022-32473 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the HddPassword shared buffer used by SMM and non-SMM code could cause… |
CVE-2022-32470 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the FwBlockServiceSmm shared buffer used by SMM and non-SMM code could… |
CVE-2022-32955 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the NvmExpressDxe buffer used by SMM and non-SMM code could cause TOCTO… |
CVE-2022-32954 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.1 through 5.5. DMA attacks on the SdMmcDevice buffer used by SMM and non-SMM code could cause TOCTOU… |
CVE-2022-32478 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the IdeBusDxe shared buffer used by SMM and non-SMM code could cause TO… |
CVE-2022-32474 | High | 7.0 | 2023-02-15 | An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. DMA attacks on the StorageSecurityCommandDxe shared buffer used by SMM and non-SMM cod… |
CVE-2022-32471 | High | 7.0 | 2023-02-15 | An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. The IhisiDxe driver uses the command buffer to pass input and output data… |
CVE-2022-29557 | High | 8.8 | 2023-02-15 | LexisNexis Firco Compliance Link 3.7 allows CSRF. |
CVE-2022-41564 | Medium | 6.8 | 2023-02-14 | The Hawk Console component of TIBCO Software Inc.'s TIBCO Hawk and TIBCO Operational Intelligence Hawk RedTail contains a vulnerability that will return the EM… |
CVE-2022-22564 | Medium | 5.9 | 2023-02-14 | Dell EMC Unity versions before 5.2.0.0.5.173 , use(es) broken cryptographic algorithm. A remote unauthenticated attacker could potentially exploit this vulnera… |
CVE-2022-4286 | Medium | 6.1 | 2023-02-14 | A reflected cross-site scripting (XSS) vulnerability exists in System Diagnostics Manager of B&R Automation Runtime versions >=3.00 and <=C4.93 that enables a… |
CVE-2022-46862 | Medium | 4.3 | 2023-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master – Best Quiz, Exam and Survey Plugin for WordPress plugin <= 8.0.7 version… |
CVE-2022-47977 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0). The affected application contains a memory… |
CVE-2022-47936 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0), Parasolid V34.0 (All versions < V34.0.252)… |
CVE-2022-35868 | Medium | 6.7 | 2023-02-14 | A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (A… |
CVE-2022-31808 | High | 7.8 | 2023-02-14 | A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions < V2.85.43). Affecte… |
CVE-2022-43469 | Medium | 5.4 | 2023-02-14 | Cross-Site Request Forgery (CSRF) vulnerability in Orchestrated Corona Virus (COVID-19) Banner & Live Data plugin <= 1.7.0.6 versions. |
CVE-2022-4138 | Medium | 6.4 | 2023-02-13 | A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and… |
CVE-2022-3759 | Medium | 4.3 | 2023-02-13 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versio… |
CVE-2022-3411 | Medium | 6.5 | 2023-02-13 | A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1 allows an authenticated… |
CVE-2022-47034 | Critical | 9.8 | 2023-02-13 | A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication. |
CVE-2022-4905 | Low | 3.5 | 2023-02-13 | A vulnerability was found in UDX Stateless Media Plugin 3.1.1 on WordPress. It has been declared as problematic. This vulnerability affects the function setup_… |
CVE-2022-45962 | Medium | 6.5 | 2023-02-13 | Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php. |
CVE-2022-48110 | Medium | 6.1 | 2023-02-13 | CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's posi… |
CVE-2022-45285 | Medium | 6.1 | 2023-02-13 | Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-48077 | High | 7.8 | 2023-02-13 | Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a… |
CVE-2022-41134 | Medium | 5.4 | 2023-02-13 | Cross-Site Request Forgery (CSRF) in OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamification & Opt-in Forms plugin <= 1.0.15 versions. |
CVE-2022-3089 | Medium | 6.3 | 2023-02-13 | Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and pass… |
CVE-2022-4830 | Medium | 5.4 | 2023-02-13 | The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-4783 | Medium | 5.4 | 2023-02-13 | The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/po… |
CVE-2022-4759 | Medium | 5.4 | 2023-02-13 | The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the… |
CVE-2022-4745 | High | 7.1 | 2023-02-13 | The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow atta… |
CVE-2022-4682 | Medium | 5.4 | 2023-02-13 | The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post whe… |
CVE-2022-4678 | Medium | 5.4 | 2023-02-13 | The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/pos… |
CVE-2022-4656 | Medium | 5.4 | 2023-02-13 | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users… |
CVE-2022-4628 | Medium | 5.4 | 2023-02-13 | The Easy PayPal Buy Now Button WordPress plugin before 1.7.4 does not validate and escape some of its shortcode attributes before outputting them back in a pag… |
CVE-2022-4580 | Medium | 5.4 | 2023-02-13 | The Twenty20 Image Before-After WordPress plugin through 1.5.9 does not validate and escape some of its shortcode attributes before outputting them back in a p… |
CVE-2022-4562 | Medium | 5.4 | 2023-02-13 | The Meks Flexible Shortcodes WordPress plugin before 1.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the pag… |
CVE-2022-4551 | Medium | 5.4 | 2023-02-13 | The Rich Table of Contents WordPress plugin before 1.3.9 does not validate and escape some of its shortcode attributes before outputting them back in a page/po… |
CVE-2022-4546 | High | 7.2 | 2023-02-13 | The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection expl… |
CVE-2022-4512 | Medium | 5.4 | 2023-02-13 | The Better Font Awesome WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post… |
CVE-2022-4488 | Medium | 5.4 | 2023-02-13 | The Widgets on Pages WordPress plugin before 1.8.0 does not validate and escape its shortcode attributes before outputting them back in the page, which could a… |
CVE-2022-4473 | Medium | 5.4 | 2023-02-13 | The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4471 | Medium | 5.4 | 2023-02-13 | The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sho… |
CVE-2022-4458 | Medium | 5.4 | 2023-02-13 | The amr shortcode any widget WordPress plugin through 4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4448 | Medium | 5.4 | 2023-02-13 | The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the sh… |
CVE-2022-4445 | Critical | 9.8 | 2023-02-13 | The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available… |
CVE-2022-40022 | Critical | 9.8 | 2023-02-13 | Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability. |
CVE-2022-3891 | Medium | 5.3 | 2023-02-13 | The WP FullCalendar WordPress plugin before 1.5 does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the… |
CVE-2022-45725 | High | 8.8 | 2023-02-13 | Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on the target via an HTTP… |
CVE-2022-45724 | Medium | 5.4 | 2023-02-13 | Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to an unauthenticated pag… |
CVE-2022-45455 | High | 7.8 | 2023-02-13 | Local privilege escalation due to incomplete uninstallation cleanup. The following products are affected: Acronis Cyber Protect Home Office (Windows) before bu… |
CVE-2022-45454 | High | 7.5 | 2023-02-13 | Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Agent (Windows) before build 30161, Acronis C… |
CVE-2022-34397 | Medium | 6.9 | 2023-02-13 | Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization bypass vulnerability, all… |
CVE-2022-48323 | Critical | 9.8 | 2023-02-13 | Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. A remote and unauthenticated attacker ca… |
CVE-2022-48322 | Critical | 9.8 | 2023-02-13 | NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability. This affects MR60 before 1.1.7.132, MS60 before 1… |
CVE-2022-25937 | Medium | 6.5 | 2023-02-13 | Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root directory. This is re… |
CVE-2022-43460 | High | 7.5 | 2023-02-13 | Driver Distributor v2.2.3.1 and earlier contains a vulnerability where passwords are stored in a recoverable format. If an attacker obtains a configuration fil… |
CVE-2022-4557 | Critical | 9.8 | 2023-02-12 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Group Arge Energy and Control Systems Smartpower Web allo… |
CVE-2022-47452 | Medium | 5.5 | 2023-02-12 | In gnss driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services. |
CVE-2022-47451 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. |
CVE-2022-47450 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47371 | Medium | 5.5 | 2023-02-12 | In bt driver, there is a thread competition leads to early release of resources to be accessed. This could lead to local denial of service in kernel. |
CVE-2022-47370 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. |
CVE-2022-47369 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. |
CVE-2022-47368 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services. |
CVE-2022-47367 | Medium | 5.5 | 2023-02-12 | In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. |
CVE-2022-47366 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services. |
CVE-2022-47365 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services. |
CVE-2022-47364 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services. |
CVE-2022-47363 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service in wlan services. |
CVE-2022-47361 | High | 7.8 | 2023-02-12 | In firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed. |
CVE-2022-47360 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47359 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47358 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47357 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47356 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47355 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47354 | Medium | 5.5 | 2023-02-12 | In log service, there is a missing permission check. This could lead to local denial of service in log service. |
CVE-2022-47348 | Medium | 5.5 | 2023-02-12 | In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services. |
CVE-2022-47347 | Medium | 5.5 | 2023-02-12 | In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services. |
CVE-2022-47346 | Medium | 5.5 | 2023-02-12 | In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services. |
CVE-2022-47345 | Medium | 5.5 | 2023-02-12 | In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services. |
CVE-2022-47344 | Medium | 5.5 | 2023-02-12 | In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services. |
CVE-2022-47343 | Medium | 5.5 | 2023-02-12 | In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services. |
CVE-2022-47342 | Medium | 5.5 | 2023-02-12 | In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services. |
CVE-2022-47341 | Medium | 6.7 | 2023-02-12 | In engineermode services, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed. |
CVE-2022-47339 | Medium | 6.7 | 2023-02-12 | In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution… |
CVE-2022-47333 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47332 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47331 | Medium | 4.7 | 2023-02-12 | In wlan driver, there is a race condition. This could lead to local denial of service in wlan services. |
CVE-2022-47330 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47329 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47328 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |
CVE-2022-47327 | Medium | 5.5 | 2023-02-12 | In wlan driver, there is a possible missing permission check. This could lead to local information disclosure. |