2022 CVEs (page 54)
Page 54 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44617 | High | 7.5 | 2023-02-06 | A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an… |
CVE-2022-3229 | Critical | 9.8 | 2023-02-06 | Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker ca… |
CVE-2022-28923 | Medium | 6.1 | 2023-02-06 | Caddy v2.4.6 was discovered to contain an open redirection vulnerability which allows attackers to redirect users to phishing websites via crafted URLs. |
CVE-2022-48166 | High | 7.5 | 2023-02-06 | An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain adm… |
CVE-2022-48311 | Critical | 9.0 | 2023-02-06 | **UNSUPPORTED WHEN ASSIGNED** Cross Site Scripting (XSS) in HP Deskjet 2540 series printer Firmware Version CEP1FN1418BR and Product Model Number A9U23B allows… |
CVE-2022-45589 | High | 7.2 | 2023-02-06 | All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks in the provisioning s… |
CVE-2022-44268 | Medium | 6.5 | 2023-02-06 | ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the conten… |
CVE-2022-44267 | Medium | 6.5 | 2023-02-06 | ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin inp… |
CVE-2022-42951 | High | 8.1 | 2023-02-06 | An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server n… |
CVE-2022-42950 | Medium | 4.9 | 2023-02-06 | An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase… |
CVE-2022-42439 | Medium | 6.8 | 2023-02-06 | IBM App Connect Enterprise 11.0.0.17 through 11.0.0.19 and 12.0.4.0 and 12.0.5.0 contains an unspecified vulnerability in the Discovery Connector nodes which… |
CVE-2022-4838 | Medium | 5.4 | 2023-02-06 | The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which cou… |
CVE-2022-4836 | Medium | 5.4 | 2023-02-06 | The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which coul… |
CVE-2022-4833 | Medium | 5.4 | 2023-02-06 | The YourChannel: Everything you want in a YouTube plugin WordPress plugin before 1.2.3 does not validate and escape some of its shortcode attributes before out… |
CVE-2022-4826 | Medium | 5.4 | 2023-02-06 | The Simple Tooltips WordPress plugin before 2.1.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2022-4825 | Medium | 5.4 | 2023-02-06 | The WP-ShowHide WordPress plugin before 1.05 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could… |
CVE-2022-4824 | Medium | 5.4 | 2023-02-06 | The WP Blog and Widgets WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4762 | Medium | 5.4 | 2023-02-06 | The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4756 | Medium | 5.4 | 2023-02-06 | The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4747 | Medium | 5.4 | 2023-02-06 | The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them… |
CVE-2022-4717 | Medium | 5.4 | 2023-02-06 | The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4681 | Critical | 9.8 | 2023-02-06 | The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available… |
CVE-2022-4677 | Medium | 5.4 | 2023-02-06 | The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low… |
CVE-2022-4674 | Medium | 5.4 | 2023-02-06 | The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contribu… |
CVE-2022-4670 | Medium | 5.4 | 2023-02-06 | The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2022-4664 | Medium | 5.4 | 2023-02-06 | The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where th… |
CVE-2022-4657 | Medium | 5.4 | 2023-02-06 | The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2022-4626 | Medium | 5.4 | 2023-02-06 | The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow… |
CVE-2022-4577 | Medium | 5.4 | 2023-02-06 | The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4489 | High | 7.2 | 2023-02-06 | The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP… |
CVE-2022-4459 | Medium | 5.4 | 2023-02-06 | The WP Show Posts WordPress plugin before 1.1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4384 | Medium | 6.5 | 2023-02-06 | The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionali… |
CVE-2022-4321 | Medium | 6.1 | 2023-02-06 | The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be… |
CVE-2022-32663 | High | 7.5 | 2023-02-06 | In Wi-Fi driver, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution pri… |
CVE-2022-32656 | Medium | 6.7 | 2023-02-06 | In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution… |
CVE-2022-32655 | Medium | 6.7 | 2023-02-06 | In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution… |
CVE-2022-32654 | Medium | 6.7 | 2023-02-06 | In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution… |
CVE-2022-32643 | Medium | 6.4 | 2023-02-06 | In ccd, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32642 | Medium | 6.4 | 2023-02-06 | In ccd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32595 | Medium | 4.4 | 2023-02-06 | In widevine, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution pri… |
CVE-2022-4902 | Low | 3.5 | 2023-02-06 | A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-a… |
CVE-2022-41342 | Medium | 6.0 | 2023-02-06 | Improper buffer restrictions in the Intel(R) C++ Compiler Classic before version 2021.7.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a… |
CVE-2022-40196 | High | 7.8 | 2023-02-06 | Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 and Intel C++ Compiler Classic before version 2021.7.1 for some Intel… |
CVE-2022-38136 | Medium | 6.7 | 2023-02-06 | Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel Fortran Compiler for Windows before version 2022.2.1 for some Intel(R)… |
CVE-2022-2933 | Medium | 5.4 | 2023-02-06 | The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect n… |
CVE-2022-47071 | Critical | 9.8 | 2023-02-06 | In NVS365 V01, the background network test function can trigger command execution. |
CVE-2022-48078 | Critical | 9.8 | 2023-02-06 | pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode. |
CVE-2022-48019 | High | 7.8 | 2023-02-06 | The components wfshbr64.sys and wfshbr32.sys in Another Eden before v3.0.20 and before v2.14.200 allows attackers to perform privilege escalation via a crafted… |
CVE-2022-48164 | High | 7.5 | 2023-02-06 | An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configura… |
CVE-2022-48085 | Medium | 5.4 | 2023-02-06 | Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter. |
CVE-2022-44343 | High | 7.5 | 2023-02-06 | CRMEB 4.4.4 is vulnerable to Any File download. |
CVE-2022-45722 | Medium | 6.1 | 2023-02-06 | ezEIP v5.3.0(0649) was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2022-29416 | Medium | 4.7 | 2023-02-06 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Afterpay Gateway for WooCommerce <= 3.5.0 versions. |
CVE-2022-27628 | Medium | 4.7 | 2023-02-06 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions. |
CVE-2022-25855 | High | 7.4 | 2023-02-06 | All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. |
CVE-2022-25853 | High | 7.4 | 2023-02-06 | All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization. |
CVE-2022-45786 | High | 8.1 | 2023-02-04 | There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, al… |
CVE-2022-24895 | Medium | 6.3 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the… |
CVE-2022-24894 | Medium | 5.9 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It ca… |
CVE-2022-23498 | High | 7.1 | 2023-02-03 | Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_s… |
CVE-2022-48165 | High | 7.5 | 2023-02-03 | An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configura… |
CVE-2022-47762 | High | 7.5 | 2023-02-03 | In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability. |
CVE-2022-47070 | High | 7.5 | 2023-02-03 | NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the server twice. In the second package, the ser… |
CVE-2022-45588 | High | 7.8 | 2023-02-03 | All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the… |
CVE-2022-45496 | High | 7.8 | 2023-02-03 | Buffer overflow vulnerability in function json_parse_string in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows… |
CVE-2022-45493 | High | 7.8 | 2023-02-03 | Buffer overflow vulnerability in function json_parse_key in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows at… |
CVE-2022-45492 | High | 7.8 | 2023-02-03 | Buffer overflow vulnerability in function json_parse_number in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows… |
CVE-2022-45491 | High | 7.8 | 2023-02-03 | Buffer overflow vulnerability in function json_parse_value in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows… |
CVE-2022-42909 | Medium | 6.5 | 2023-02-03 | WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow… |
CVE-2022-42908 | Medium | 6.3 | 2023-02-03 | WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a docume… |
CVE-2022-31733 | Critical | 9.1 | 2023-02-03 | Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells… |
CVE-2022-34138 | High | 7.5 | 2023-02-03 | Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information. |
CVE-2022-48074 | Medium | 5.3 | 2023-02-03 | An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file. |
CVE-2022-4634 | High | 7.8 | 2023-02-03 | All versions prior to Delta Electronic’s CNCSoft version 1.01.34 (running ScreenEditor versions 1.01.5 and prior) are vulnerable to a stack-based buffer overfl… |
CVE-2022-48023 | Medium | 4.3 | 2023-02-03 | Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad… |
CVE-2022-48022 | Medium | 4.3 | 2023-02-03 | An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are no… |
CVE-2022-48021 | Critical | 9.8 | 2023-02-03 | A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server. |
CVE-2022-47132 | High | 8.8 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users. |
CVE-2022-47131 | Medium | 4.8 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page. |
CVE-2022-47130 | Medium | 4.3 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privilege… |
CVE-2022-38389 | High | 7.1 | 2023-02-03 | IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2022-22486 | Critical | 10.0 | 2023-02-03 | IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2022-48114 | Critical | 9.8 | 2023-02-02 | RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable. |
CVE-2022-48113 | Critical | 9.8 | 2023-02-02 | A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers… |
CVE-2022-48140 | Medium | 5.4 | 2023-02-02 | DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename. |
CVE-2022-48130 | Critical | 9.8 | 2023-02-02 | Tenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNet, staticRouteMask… |
CVE-2022-48082 | Critical | 9.8 | 2023-02-02 | Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag. |
CVE-2022-48079 | Critical | 9.8 | 2023-02-02 | Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a craft… |
CVE-2022-46842 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in JS Help Desk plugin <= 2.7.1 versions. |
CVE-2022-46815 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 versions. |
CVE-2022-45807 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin <= 1.0.1 versions. |
CVE-2022-45067 | Medium | 4.3 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in DevsCred Exclusive Addons Elementor plugin <= 2.6.1 versions. |
CVE-2022-44585 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions. |
CVE-2022-40692 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions. |
CVE-2022-3560 | Medium | 5.5 | 2023-02-02 | A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc… |
CVE-2022-36401 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin <= 1.3.24 versions. |
CVE-2022-46604 | High | 8.8 | 2023-02-02 | An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leadin… |
CVE-2022-46552 | High | 8.8 | 2023-02-02 | D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vu… |
CVE-2022-46965 | High | 8.1 | 2023-02-02 | PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability. |
CVE-2022-43665 | Medium | 5.5 | 2023-02-02 | A denial of service vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.8.645. A specially-crafted PE file can lead to killing target p… |