2022 CVEs (page 56)
Page 56 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-48175 | Critical | 9.8 | 2023-01-30 | Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request. |
CVE-2022-32748 | High | 7.9 | 2023-01-30 | A CWE-295: Improper Certificate Validation vulnerability exists that could cause the CAE software to give wrong data to end users when using CAE to configure d… |
CVE-2022-32747 | High | 8.0 | 2023-01-30 | A CWE-290: Authentication Bypass by Spoofing vulnerability exists that could cause legitimate users to be locked out of devices or facilitate backdoor account… |
CVE-2022-32529 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32528 | High | 8.6 | 2023-01-30 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause access to manipulate and read specific files in the IGSS project… |
CVE-2022-32527 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32526 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32525 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32524 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32523 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32522 | Critical | 9.8 | 2023-01-30 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow, potentially leading to remote code e… |
CVE-2022-32521 | High | 7.1 | 2023-01-30 | A CWE 502: Deserialization of Untrusted Data vulnerability exists that could allow code to be remotely executed on the server when unsafely deserialized data i… |
CVE-2022-32520 | High | 8.0 | 2023-01-30 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a… |
CVE-2022-32519 | High | 8.0 | 2023-01-30 | A CWE-257: Storing Passwords in a Recoverable Format vulnerability exists that could result in unwanted access to a DCE instance when performed over a network… |
CVE-2022-32518 | High | 8.0 | 2023-01-30 | A CWE-522: Insufficiently Protected Credentials vulnerability exists that could result in unwanted access to a DCE instance when performed over a network by a… |
CVE-2022-32517 | Medium | 6.5 | 2023-01-30 | A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause an adversary to trick the interface user/admin into inte… |
CVE-2022-32516 | High | 7.5 | 2023-01-30 | A CWE-352: Cross-Site Request Forgery (CSRF) vulnerability exists that could cause system’s configurations override and cause a reboot loop when the product su… |
CVE-2022-32515 | High | 8.6 | 2023-01-30 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause brute force attacks to take over the admin account w… |
CVE-2022-32514 | Critical | 9.8 | 2023-01-30 | A CWE-287: Improper Authentication vulnerability exists that could allow an attacker to gain control of the device when logging into a web page. Affected Produ… |
CVE-2022-32513 | Critical | 9.8 | 2023-01-30 | A CWE-521: Weak Password Requirements vulnerability exists that could allow an attacker to gain control of the device when the attacker brute forces the passwo… |
CVE-2022-32512 | Medium | 5.3 | 2023-01-30 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code execution when a command w… |
CVE-2022-22732 | Low | 3.9 | 2023-01-30 | A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server… |
CVE-2022-22731 | Medium | 6.5 | 2023-01-30 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attacker to cre… |
CVE-2022-0223 | Medium | 6.5 | 2023-01-30 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwri… |
CVE-2022-48006 | Critical | 9.8 | 2023-01-30 | An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploited via… |
CVE-2022-40137 | Medium | 6.7 | 2023-01-30 | A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code. |
CVE-2022-40136 | Medium | 4.4 | 2023-01-30 | An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and… |
CVE-2022-40135 | Medium | 4.4 | 2023-01-30 | An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges… |
CVE-2022-40134 | Medium | 4.4 | 2023-01-30 | An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privilege… |
CVE-2022-34888 | Low | 2.7 | 2023-01-30 | The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible t… |
CVE-2022-34885 | High | 7.2 | 2023-01-30 | An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arbitrary code. |
CVE-2022-34884 | High | 7.2 | 2023-01-30 | A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of ser… |
CVE-2022-4872 | Medium | 4.3 | 2023-01-30 | The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belon… |
CVE-2022-4837 | Medium | 5.4 | 2023-01-30 | The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4835 | Medium | 5.4 | 2023-01-30 | The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4834 | Medium | 5.4 | 2023-01-30 | The CPT Bootstrap Carousel WordPress plugin through 1.12 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4831 | Medium | 5.4 | 2023-01-30 | The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputt… |
CVE-2022-4828 | Medium | 5.4 | 2023-01-30 | The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, whi… |
CVE-2022-4794 | High | 7.5 | 2023-01-30 | The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass fire… |
CVE-2022-4793 | Medium | 5.4 | 2023-01-30 | The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as con… |
CVE-2022-4792 | Medium | 5.4 | 2023-01-30 | The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as… |
CVE-2022-4787 | Medium | 5.4 | 2023-01-30 | Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as co… |
CVE-2022-4781 | Medium | 5.4 | 2023-01-30 | The Accordion Shortcodes WordPress plugin through 2.4.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as lo… |
CVE-2022-4776 | Medium | 5.4 | 2023-01-30 | The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4765 | Medium | 5.4 | 2023-01-30 | The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4763 | Medium | 5.4 | 2023-01-30 | The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which coul… |
CVE-2022-4749 | Medium | 5.4 | 2023-01-30 | The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in th… |
CVE-2022-4699 | Medium | 5.4 | 2023-01-30 | The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4680 | High | 7.2 | 2023-01-30 | The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to… |
CVE-2022-4671 | Medium | 5.4 | 2023-01-30 | The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could a… |
CVE-2022-4667 | Medium | 5.4 | 2023-01-30 | The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, whic… |
CVE-2022-4654 | Medium | 5.4 | 2023-01-30 | The Pricing Tables WordPress Plugin WordPress plugin before 3.2.3 does not validate and escape one of its shortcode attributes, which could allow users with a… |
CVE-2022-4651 | Medium | 5.4 | 2023-01-30 | The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as… |
CVE-2022-4649 | Medium | 5.4 | 2023-01-30 | The WP Extended Search WordPress plugin before 2.1.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low a… |
CVE-2022-4553 | Medium | 4.3 | 2023-01-30 | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make logged in admins perfo… |
CVE-2022-4552 | Medium | 6.1 | 2023-01-30 | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could… |
CVE-2022-4496 | Medium | 6.1 | 2023-01-30 | The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multis… |
CVE-2022-4472 | Medium | 5.4 | 2023-01-30 | The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which c… |
CVE-2022-4470 | Medium | 5.4 | 2023-01-30 | The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the pag… |
CVE-2022-4395 | Critical | 9.8 | 2023-01-30 | The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary file… |
CVE-2022-4306 | Medium | 5.4 | 2023-01-30 | The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Refle… |
CVE-2022-26872 | High | 8.3 | 2023-01-30 | AMI Megarac Password reset interception via API |
CVE-2022-23334 | Critical | 9.8 | 2023-01-30 | The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write acce… |
CVE-2022-46087 | Medium | 5.4 | 2023-01-30 | CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS). A normal user can steal session cookies of the admin users through notification received by the… |
CVE-2022-45788 | High | 7.5 | 2023-01-30 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of c… |
CVE-2022-42484 | Critical | 9.8 | 2023-01-30 | An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbit… |
CVE-2022-38451 | High | 7.5 | 2023-01-30 | A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary… |
CVE-2022-2988 | Medium | 4.3 | 2023-01-30 | A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning s… |
CVE-2022-46359 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-46358 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-46357 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-46356 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-25967 | High | 8.1 | 2023-01-30 | Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options… |
CVE-2022-25936 | High | 7.5 | 2023-01-30 | Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable. |
CVE-2022-48303 | Medium | 5.5 | 2023-01-30 | GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of c… |
CVE-2022-27596 | Critical | 9.8 | 2023-01-30 | A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious co… |
CVE-2022-48285 | High | 7.3 | 2023-01-29 | loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive. |
CVE-2022-39324 | Medium | 6.7 | 2023-01-27 | Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily c… |
CVE-2022-23552 | High | 7.3 | 2023-01-27 | Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had… |
CVE-2022-4255 | Medium | 4.3 | 2023-01-27 | An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user ema… |
CVE-2022-4205 | Medium | 6.3 | 2023-01-27 | In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash. |
CVE-2022-4201 | Low | 3.5 | 2023-01-27 | A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local add… |
CVE-2022-46968 | Medium | 5.4 | 2023-01-27 | A stored cross-site scripting (XSS) vulnerability in /index.php?page=help of Revenue Collection System v1.0 allows attackers to execute arbitrary web scripts o… |
CVE-2022-43980 | Medium | 5.2 | 2023-01-27 | There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, inc… |
CVE-2022-43979 | Medium | 5.9 | 2023-01-27 | There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted… |
CVE-2022-43978 | Medium | 5.6 | 2023-01-27 | There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a… |
CVE-2022-39813 | Medium | 6.1 | 2023-01-27 | Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username parameter, or NMSCIWebGu… |
CVE-2022-39812 | High | 7.5 | 2023-01-27 | Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitra… |
CVE-2022-39811 | Critical | 9.1 | 2023-01-27 | Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying pe… |
CVE-2022-48108 | Critical | 9.8 | 2023-01-27 | D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allow… |
CVE-2022-48107 | Critical | 9.8 | 2023-01-27 | D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows… |
CVE-2022-39380 | Medium | 5.3 | 2023-01-27 | Wire web-app is part of Wire communications. Versions prior to 2022-11-02 are subject to Improper Handling of Exceptional Conditions. In the wire-webapp, certa… |
CVE-2022-48118 | Medium | 6.1 | 2023-01-27 | Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter. |
CVE-2022-48116 | High | 7.2 | 2023-01-27 | AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php. |
CVE-2022-4335 | Medium | 4.3 | 2023-01-27 | A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker… |
CVE-2022-4285 | Medium | 5.5 | 2023-01-27 | An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of se… |
CVE-2022-4139 | High | 7.8 | 2023-01-27 | An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw c… |
CVE-2022-48013 | Medium | 5.4 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability… |
CVE-2022-48012 | Medium | 6.1 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. |
CVE-2022-48011 | Critical | 9.8 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. |