2022 CVEs (page 54)
Page 54 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4717 | Medium | 5.4 | 2023-02-06 | The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4681 | Critical | 9.8 | 2023-02-06 | The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available… |
CVE-2022-4677 | Medium | 5.4 | 2023-02-06 | The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low… |
CVE-2022-4674 | Medium | 5.4 | 2023-02-06 | The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contribu… |
CVE-2022-4670 | Medium | 5.4 | 2023-02-06 | The PDF.js Viewer WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where… |
CVE-2022-4664 | Medium | 5.4 | 2023-02-06 | The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where th… |
CVE-2022-4657 | Medium | 5.4 | 2023-02-06 | The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post wher… |
CVE-2022-4626 | Medium | 5.4 | 2023-02-06 | The PPWP WordPress plugin before 1.8.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow… |
CVE-2022-4577 | Medium | 5.4 | 2023-02-06 | The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4489 | High | 7.2 | 2023-02-06 | The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP… |
CVE-2022-4459 | Medium | 5.4 | 2023-02-06 | The WP Show Posts WordPress plugin before 1.1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4384 | Medium | 6.5 | 2023-02-06 | The Stream WordPress plugin before 3.9.2 does not prevent users with little privileges on the site (like subscribers) from using its alert creation functionali… |
CVE-2022-4321 | Medium | 6.1 | 2023-02-06 | The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be… |
CVE-2022-32663 | High | 7.5 | 2023-02-06 | In Wi-Fi driver, there is a possible system crash due to null pointer dereference. This could lead to remote denial of service with no additional execution pri… |
CVE-2022-32656 | Medium | 6.7 | 2023-02-06 | In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution… |
CVE-2022-32655 | Medium | 6.7 | 2023-02-06 | In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution… |
CVE-2022-32654 | Medium | 6.7 | 2023-02-06 | In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution… |
CVE-2022-32643 | Medium | 6.4 | 2023-02-06 | In ccd, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32642 | Medium | 6.4 | 2023-02-06 | In ccd, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32595 | Medium | 4.4 | 2023-02-06 | In widevine, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution pri… |
CVE-2022-4902 | Low | 3.5 | 2023-02-06 | A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-a… |
CVE-2022-41342 | Medium | 6.0 | 2023-02-06 | Improper buffer restrictions in the Intel(R) C++ Compiler Classic before version 2021.7.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow a… |
CVE-2022-40196 | High | 7.8 | 2023-02-06 | Improper access control in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.2.1 and Intel C++ Compiler Classic before version 2021.7.1 for some Intel… |
CVE-2022-38136 | Medium | 6.7 | 2023-02-06 | Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel Fortran Compiler for Windows before version 2022.2.1 for some Intel(R)… |
CVE-2022-2933 | Medium | 5.4 | 2023-02-06 | The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect n… |
CVE-2022-47071 | Critical | 9.8 | 2023-02-06 | In NVS365 V01, the background network test function can trigger command execution. |
CVE-2022-48078 | Critical | 9.8 | 2023-02-06 | pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode. |
CVE-2022-48019 | High | 7.8 | 2023-02-06 | The components wfshbr64.sys and wfshbr32.sys in Another Eden before v3.0.20 and before v2.14.200 allows attackers to perform privilege escalation via a crafted… |
CVE-2022-48164 | High | 7.5 | 2023-02-06 | An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configura… |
CVE-2022-48085 | Medium | 5.4 | 2023-02-06 | Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter. |
CVE-2022-44343 | High | 7.5 | 2023-02-06 | CRMEB 4.4.4 is vulnerable to Any File download. |
CVE-2022-45722 | Medium | 6.1 | 2023-02-06 | ezEIP v5.3.0(0649) was discovered to contain a cross-site scripting (XSS) vulnerability. |
CVE-2022-29416 | Medium | 4.7 | 2023-02-06 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Afterpay Gateway for WooCommerce <= 3.5.0 versions. |
CVE-2022-27628 | Medium | 4.7 | 2023-02-06 | Cross-Site Request Forgery (CSRF) vulnerability in AA-Team WZone – Lite Version plugin 3.1 Lite versions. |
CVE-2022-25855 | High | 7.4 | 2023-02-06 | All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. |
CVE-2022-25853 | High | 7.4 | 2023-02-06 | All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization. |
CVE-2022-45786 | High | 8.1 | 2023-02-04 | There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, al… |
CVE-2022-24895 | Medium | 6.3 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. When authenticating users Symfony by default regenerates the… |
CVE-2022-24894 | Medium | 5.9 | 2023-02-03 | Symfony is a PHP framework for web and console applications and a set of reusable PHP components. The Symfony HTTP cache system, acts as a reverse proxy: It ca… |
CVE-2022-23498 | High | 7.1 | 2023-02-03 | Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_s… |
CVE-2022-48165 | High | 7.5 | 2023-02-03 | An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configura… |
CVE-2022-47762 | High | 7.5 | 2023-02-03 | In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability. |
CVE-2022-47070 | High | 7.5 | 2023-02-03 | NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the server twice. In the second package, the ser… |
CVE-2022-45588 | High | 7.8 | 2023-02-03 | All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the… |
CVE-2022-45496 | High | 7.8 | 2023-02-03 | Buffer overflow vulnerability in function json_parse_string in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows… |
CVE-2022-45493 | High | 7.8 | 2023-02-03 | Buffer overflow vulnerability in function json_parse_key in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows at… |
CVE-2022-45492 | High | 7.8 | 2023-02-03 | Buffer overflow vulnerability in function json_parse_number in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows… |
CVE-2022-45491 | High | 7.8 | 2023-02-03 | Buffer overflow vulnerability in function json_parse_value in sheredom json.h before commit 0825301a07cbf51653882bf2b153cc81fdadf41 (November 14, 2022) allows… |
CVE-2022-42909 | Medium | 6.5 | 2023-02-03 | WEPA Print Away does not verify that a user has authorization to access documents before generating print orders and associated release codes. This could allow… |
CVE-2022-42908 | Medium | 6.3 | 2023-02-03 | WEPA Print Away is vulnerable to a stored XSS. It does not properly sanitize uploaded filenames, allowing an attacker to deceive a user into uploading a docume… |
CVE-2022-31733 | Critical | 9.1 | 2023-02-03 | Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells… |
CVE-2022-34138 | High | 7.5 | 2023-02-03 | Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information. |
CVE-2022-48074 | Medium | 5.3 | 2023-02-03 | An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file. |
CVE-2022-4634 | High | 7.8 | 2023-02-03 | All versions prior to Delta Electronic’s CNCSoft version 1.01.34 (running ScreenEditor versions 1.01.5 and prior) are vulnerable to a stack-based buffer overfl… |
CVE-2022-48023 | Medium | 4.3 | 2023-02-03 | Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad… |
CVE-2022-48022 | Medium | 4.3 | 2023-02-03 | An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are no… |
CVE-2022-48021 | Critical | 9.8 | 2023-02-03 | A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server. |
CVE-2022-47132 | High | 8.8 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users. |
CVE-2022-47131 | Medium | 4.8 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page. |
CVE-2022-47130 | Medium | 4.3 | 2023-02-03 | A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privilege… |
CVE-2022-38389 | High | 7.1 | 2023-02-03 | IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2022-22486 | Critical | 10.0 | 2023-02-03 | IBM Tivoli Workload Scheduler 9.4, 9.5, and 10.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker cou… |
CVE-2022-48114 | Critical | 9.8 | 2023-02-02 | RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable. |
CVE-2022-48113 | Critical | 9.8 | 2023-02-02 | A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers… |
CVE-2022-48140 | Medium | 5.4 | 2023-02-02 | DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename. |
CVE-2022-48130 | Critical | 9.8 | 2023-02-02 | Tenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNet, staticRouteMask… |
CVE-2022-48082 | Critical | 9.8 | 2023-02-02 | Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag. |
CVE-2022-48079 | Critical | 9.8 | 2023-02-02 | Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a craft… |
CVE-2022-46842 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in JS Help Desk plugin <= 2.7.1 versions. |
CVE-2022-46815 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 versions. |
CVE-2022-45807 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) in WPVibes WP Mail Log plugin <= 1.0.1 versions. |
CVE-2022-45067 | Medium | 4.3 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in DevsCred Exclusive Addons Elementor plugin <= 2.6.1 versions. |
CVE-2022-44585 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions. |
CVE-2022-40692 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions. |
CVE-2022-3560 | Medium | 5.5 | 2023-02-02 | A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc… |
CVE-2022-36401 | Medium | 5.4 | 2023-02-02 | Cross-Site Request Forgery (CSRF) vulnerability in TeraWallet – For WooCommerce plugin <= 1.3.24 versions. |
CVE-2022-46604 | High | 8.8 | 2023-02-02 | An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leadin… |
CVE-2022-46552 | High | 8.8 | 2023-02-02 | D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vu… |
CVE-2022-46965 | High | 8.1 | 2023-02-02 | PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability. |
CVE-2022-43665 | Medium | 5.5 | 2023-02-02 | A denial of service vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.8.645. A specially-crafted PE file can lead to killing target p… |
CVE-2022-2546 | Medium | 4.7 | 2023-02-02 | The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX acti… |
CVE-2022-40269 | Medium | 6.8 | 2023-02-02 | Authentication Bypass by Spoofing vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000, Mitsubishi Electr… |
CVE-2022-40268 | Medium | 6.1 | 2023-02-02 | Improper Restriction of Rendered UI Layers or Frames vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.14.000 to 01.47.000… |
CVE-2022-33323 | High | 7.5 | 2023-02-02 | Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote u… |
CVE-2022-37034 | Medium | 5.3 | 2023-02-01 | In dotCMS 5.x-22.06, it is possible to call the TempResource multiple times, each time requesting the dotCMS server to download a large file. If done repeatedl… |
CVE-2022-47872 | High | 8.8 | 2023-02-01 | A Server-Side Request Forgery (SSRF) in maccms10 v2021.1000.2000 allows attackers to force the application to make arbitrary requests via a crafted payload inj… |
CVE-2022-45783 | Medium | 6.5 | 2023-02-01 | An issue was discovered in dotCMS core 4.x through 22.10.2. An authenticated directory traversal vulnerability in the dotCMS API can lead to Remote Code Execut… |
CVE-2022-45782 | High | 8.8 | 2023-02-01 | An issue was discovered in dotCMS core 5.3.8.5 through 5.3.8.15 and 21.03 through 22.10.1. A cryptographically insecure random generation algorithm for passwor… |
CVE-2022-3913 | Medium | 5.3 | 2023-02-01 | Rapid7 Nexpose and InsightVM versions 6.6.82 through 6.6.177 fail to validate the certificate of the update server when downloading updates. This failure could… |
CVE-2022-37033 | Medium | 6.5 | 2023-02-01 | In dotCMS 5.x-22.06, TempFileAPI allows a user to create a temporary file based on a passed in URL, while attempting to block any SSRF access to local IP addre… |
CVE-2022-3083 | Low | 3.9 | 2023-02-01 | All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigati… |
CVE-2022-31364 | High | 8.2 | 2023-02-01 | Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary… |
CVE-2022-31363 | High | 8.2 | 2023-02-01 | Cypress : https://www.infineon.com/ Cypress Bluetooth Mesh SDK BSA0107_05.01.00-BX8-AMESH-08 is affected by: Buffer Overflow. The impact is: execute arbitrary… |
CVE-2022-30904 | High | 8.2 | 2023-02-01 | In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no check for the SegN f… |
CVE-2022-46934 | Medium | 6.1 | 2023-02-01 | kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java. |
CVE-2022-47983 | Medium | 5.4 | 2023-02-01 | IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI… |
CVE-2022-43922 | Medium | 5.3 | 2023-02-01 | IBM App Connect Enterprise Certified Container 4.1, 4.2, 5.0, 5.1, 5.2, 6.0, 6.1, and 6.2 could disclose sensitive information to an attacker due to a weak has… |
CVE-2022-4254 | High | 8.8 | 2023-02-01 | sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters |
CVE-2022-48094 | Medium | 4.9 | 2023-02-01 | lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php. |
CVE-2022-48093 | High | 7.2 | 2023-02-01 | Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php. |