2022 CVEs (page 56)
Page 56 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-32512 | Medium | 5.3 | 2023-01-30 | A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause remote code execution when a command w… |
CVE-2022-22732 | Low | 3.9 | 2023-01-30 | A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause all remote domains to access the resources (data) supplied by the server… |
CVE-2022-22731 | Medium | 6.5 | 2023-01-30 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists in a function that could allow an attacker to cre… |
CVE-2022-0223 | Medium | 6.5 | 2023-01-30 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwri… |
CVE-2022-48006 | Critical | 9.8 | 2023-01-30 | An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploited via… |
CVE-2022-40137 | Medium | 6.7 | 2023-01-30 | A buffer overflow in the WMI SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges to execute arbitrary code. |
CVE-2022-40136 | Medium | 4.4 | 2023-01-30 | An information leak vulnerability in SMI Handler used to configure platform settings over WMI in some Lenovo models may allow an attacker with local access and… |
CVE-2022-40135 | Medium | 4.4 | 2023-01-30 | An information leak vulnerability in the Smart USB Protection SMI Handler in some Lenovo models may allow an attacker with local access and elevated privileges… |
CVE-2022-40134 | Medium | 4.4 | 2023-01-30 | An information leak vulnerability in the SMI Set BIOS Password SMI Handler in some Lenovo models may allow an attacker with local access and elevated privilege… |
CVE-2022-34888 | Low | 2.7 | 2023-01-30 | The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible t… |
CVE-2022-34885 | High | 7.2 | 2023-01-30 | An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arbitrary code. |
CVE-2022-34884 | High | 7.2 | 2023-01-30 | A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of ser… |
CVE-2022-4872 | Medium | 4.3 | 2023-01-30 | The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belon… |
CVE-2022-4837 | Medium | 5.4 | 2023-01-30 | The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4835 | Medium | 5.4 | 2023-01-30 | The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4834 | Medium | 5.4 | 2023-01-30 | The CPT Bootstrap Carousel WordPress plugin through 1.12 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4831 | Medium | 5.4 | 2023-01-30 | The Custom User Profile Fields for User Registration WordPress plugin before 1.8.1 does not validate and escape some of its shortcode attributes before outputt… |
CVE-2022-4828 | Medium | 5.4 | 2023-01-30 | The Bold Timeline Lite WordPress plugin before 1.1.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, whi… |
CVE-2022-4794 | High | 7.5 | 2023-01-30 | The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass fire… |
CVE-2022-4793 | Medium | 5.4 | 2023-01-30 | The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as con… |
CVE-2022-4792 | Medium | 5.4 | 2023-01-30 | The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as… |
CVE-2022-4787 | Medium | 5.4 | 2023-01-30 | Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as co… |
CVE-2022-4781 | Medium | 5.4 | 2023-01-30 | The Accordion Shortcodes WordPress plugin through 2.4.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as lo… |
CVE-2022-4776 | Medium | 5.4 | 2023-01-30 | The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4765 | Medium | 5.4 | 2023-01-30 | The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4763 | Medium | 5.4 | 2023-01-30 | The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which coul… |
CVE-2022-4749 | Medium | 5.4 | 2023-01-30 | The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in th… |
CVE-2022-4699 | Medium | 5.4 | 2023-01-30 | The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4680 | High | 7.2 | 2023-01-30 | The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to… |
CVE-2022-4671 | Medium | 5.4 | 2023-01-30 | The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could a… |
CVE-2022-4667 | Medium | 5.4 | 2023-01-30 | The RSS Aggregator by Feedzy WordPress plugin before 4.1.1 does not validate and escape some of its block options before outputting them back in the page, whic… |
CVE-2022-4654 | Medium | 5.4 | 2023-01-30 | The Pricing Tables WordPress Plugin WordPress plugin before 3.2.3 does not validate and escape one of its shortcode attributes, which could allow users with a… |
CVE-2022-4651 | Medium | 5.4 | 2023-01-30 | The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as… |
CVE-2022-4649 | Medium | 5.4 | 2023-01-30 | The WP Extended Search WordPress plugin before 2.1.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low a… |
CVE-2022-4553 | Medium | 4.3 | 2023-01-30 | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make logged in admins perfo… |
CVE-2022-4552 | Medium | 6.1 | 2023-01-30 | The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could… |
CVE-2022-4496 | Medium | 6.1 | 2023-01-30 | The SAML SSO Standard WordPress plugin version 16.0.0 before 16.0.8, SAML SSO Premium WordPress plugin version 12.0.0 before 12.1.0 and SAML SSO Premium Multis… |
CVE-2022-4472 | Medium | 5.4 | 2023-01-30 | The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which c… |
CVE-2022-4470 | Medium | 5.4 | 2023-01-30 | The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the pag… |
CVE-2022-4395 | Critical | 9.8 | 2023-01-30 | The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary file… |
CVE-2022-4306 | Medium | 5.4 | 2023-01-30 | The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Refle… |
CVE-2022-26872 | High | 8.3 | 2023-01-30 | AMI Megarac Password reset interception via API |
CVE-2022-23334 | Critical | 9.8 | 2023-01-30 | The Robot application in Ip-label Newtest before v8.5R0 was discovered to use weak signature checks on executed binaries, allowing attackers to have write acce… |
CVE-2022-46087 | Medium | 5.4 | 2023-01-30 | CloudSchool v3.0.1 is vulnerable to Cross Site Scripting (XSS). A normal user can steal session cookies of the admin users through notification received by the… |
CVE-2022-45788 | High | 7.5 | 2023-01-30 | A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause arbitrary code execution, denial of service and loss of c… |
CVE-2022-42484 | Critical | 9.8 | 2023-01-30 | An OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbit… |
CVE-2022-38451 | High | 7.5 | 2023-01-30 | A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary… |
CVE-2022-2988 | Medium | 4.3 | 2023-01-30 | A CWE-787: Out-of-bounds Write vulnerability exists that could cause sensitive information leakage when accessing a malicious web page from the commissioning s… |
CVE-2022-46359 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-46358 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-46357 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-46356 | High | 8.8 | 2023-01-30 | Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, and information disclo… |
CVE-2022-25967 | High | 8.1 | 2023-01-30 | Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variables with view options… |
CVE-2022-25936 | High | 7.5 | 2023-01-30 | Versions of the package servst before 2.0.3 are vulnerable to Directory Traversal due to improper sanitization of the filePath variable. |
CVE-2022-48303 | Medium | 5.5 | 2023-01-30 | GNU Tar through 1.34 has a one-byte out-of-bounds read that results in use of uninitialized memory for a conditional jump. Exploitation to change the flow of c… |
CVE-2022-27596 | Critical | 9.8 | 2023-01-30 | A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject malicious co… |
CVE-2022-48285 | High | 7.3 | 2023-01-29 | loadAsync in JSZip before 3.8.0 allows Directory Traversal via a crafted ZIP archive. |
CVE-2022-39324 | Medium | 6.7 | 2023-01-27 | Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily c… |
CVE-2022-23552 | High | 7.3 | 2023-01-27 | Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had… |
CVE-2022-4255 | Medium | 4.3 | 2023-01-27 | An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user ema… |
CVE-2022-4205 | Medium | 6.3 | 2023-01-27 | In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash. |
CVE-2022-4201 | Low | 3.5 | 2023-01-27 | A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local add… |
CVE-2022-46968 | Medium | 5.4 | 2023-01-27 | A stored cross-site scripting (XSS) vulnerability in /index.php?page=help of Revenue Collection System v1.0 allows attackers to execute arbitrary web scripts o… |
CVE-2022-43980 | Medium | 5.2 | 2023-01-27 | There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, inc… |
CVE-2022-43979 | Medium | 5.9 | 2023-01-27 | There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted… |
CVE-2022-43978 | Medium | 5.6 | 2023-01-27 | There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a… |
CVE-2022-39813 | Medium | 6.1 | 2023-01-27 | Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username parameter, or NMSCIWebGu… |
CVE-2022-39812 | High | 7.5 | 2023-01-27 | Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitra… |
CVE-2022-39811 | Critical | 9.1 | 2023-01-27 | Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying pe… |
CVE-2022-48108 | Critical | 9.8 | 2023-01-27 | D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allow… |
CVE-2022-48107 | Critical | 9.8 | 2023-01-27 | D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows… |
CVE-2022-39380 | Medium | 5.3 | 2023-01-27 | Wire web-app is part of Wire communications. Versions prior to 2022-11-02 are subject to Improper Handling of Exceptional Conditions. In the wire-webapp, certa… |
CVE-2022-48118 | Medium | 6.1 | 2023-01-27 | Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter. |
CVE-2022-48116 | High | 7.2 | 2023-01-27 | AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php. |
CVE-2022-4335 | Medium | 4.3 | 2023-01-27 | A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which allows an attacker… |
CVE-2022-4285 | Medium | 5.5 | 2023-01-27 | An illegal memory access flaw was found in the binutils package. Parsing an ELF file containing corrupt symbol version information may result in a denial of se… |
CVE-2022-4139 | High | 7.8 | 2023-01-27 | An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw c… |
CVE-2022-48013 | Medium | 5.4 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability… |
CVE-2022-48012 | Medium | 6.1 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd. |
CVE-2022-48011 | Critical | 9.8 | 2023-01-27 | Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function. |
CVE-2022-48010 | Medium | 5.4 | 2023-01-27 | LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenul… |
CVE-2022-48008 | Critical | 9.8 | 2023-01-27 | An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-48007 | Medium | 5.4 | 2023-01-27 | A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2022-48073 | High | 7.5 | 2023-01-27 | Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext. |
CVE-2022-48072 | High | 7.8 | 2023-01-27 | Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function. |
CVE-2022-48071 | High | 7.5 | 2023-01-27 | Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext. |
CVE-2022-48070 | High | 7.8 | 2023-01-27 | Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function. |
CVE-2022-48069 | High | 7.5 | 2023-01-27 | Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter. |
CVE-2022-48067 | Medium | 5.5 | 2023-01-27 | An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack. |
CVE-2022-48066 | Critical | 9.8 | 2023-01-27 | An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie. |
CVE-2022-47632 | Medium | 6.8 | 2023-01-27 | Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate va… |
CVE-2022-44718 | Low | 3.5 | 2023-01-27 | An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attacker must visit the v… |
CVE-2022-44717 | Low | 3.1 | 2023-01-27 | An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 1 of 2). After successful login, an attacker must visit the v… |
CVE-2022-44715 | High | 8.8 | 2023-01-27 | Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload. |
CVE-2022-44298 | Critical | 9.8 | 2023-01-27 | SiteServer CMS 7.1.3 is vulnerable to SQL Injection. |
CVE-2022-44029 | Medium | 6.1 | 2023-01-27 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 6 of 6. |
CVE-2022-44028 | Medium | 6.1 | 2023-01-27 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 5 of 6. |
CVE-2022-44027 | Medium | 6.1 | 2023-01-27 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 4 of 6. |
CVE-2022-44026 | Medium | 6.1 | 2023-01-27 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 3 of 6. |
CVE-2022-44025 | Medium | 6.1 | 2023-01-27 | An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 2 of 6. |