2022 CVEs (page 59)
Page 59 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42372 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42371 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42370 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-42369 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-41153 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-41152 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-41151 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-41150 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-41149 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-41148 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-41147 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-41146 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-41145 | Medium | 5.5 | 2023-01-26 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to e… |
CVE-2022-41144 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-41143 | High | 7.8 | 2023-01-26 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDF-XChange Editor. User interaction is required to exploit t… |
CVE-2022-41142 | High | 8.8 | 2023-01-26 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. Authentication is required to exploit this vulnerabili… |
CVE-2022-41141 | High | 7.8 | 2023-01-26 | This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute… |
CVE-2022-41140 | High | 8.8 | 2023-01-26 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not requ… |
CVE-2022-40720 | High | 8.8 | 2023-01-26 | This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication i… |
CVE-2022-40719 | High | 8.8 | 2023-01-26 | This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication i… |
CVE-2022-40718 | High | 8.8 | 2023-01-26 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exp… |
CVE-2022-40717 | High | 8.8 | 2023-01-26 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected D-Link DIR-2150 4.0.1 routers. Authentication is not required to exp… |
CVE-2022-3806 | Critical | 9.8 | 2023-01-25 | Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer. |
CVE-2022-4554 | Medium | 5.4 | 2023-01-24 | B2B Customer Ordering System developed by ID Software Project and Consultancy Services before version 1.0.0.347 has an authenticated Reflected XSS vulnerabilit… |
CVE-2022-45639 | High | 7.8 | 2023-01-24 | OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: th… |
CVE-2022-46639 | High | 7.5 | 2023-01-23 | A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal. |
CVE-2022-40034 | Medium | 5.4 | 2023-01-23 | Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' parameter. |
CVE-2022-23005 | High | 8.7 | 2023-01-23 | Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This vulnerability may exist in some systems where… |
CVE-2022-4816 | Medium | 6.2 | 2023-01-23 | A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application. |
CVE-2022-3430 | Medium | 6.7 | 2023-01-23 | A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to modify secure boot… |
CVE-2022-37719 | High | 8.8 | 2023-01-23 | A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escalate privileges and execute arbitrary code… |
CVE-2022-37718 | High | 8.8 | 2023-01-23 | The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenti… |
CVE-2022-38725 | High | 7.5 | 2023-01-23 | An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog in… |
CVE-2022-4832 | Medium | 5.4 | 2023-01-23 | The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4790 | Medium | 5.4 | 2023-01-23 | The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a… |
CVE-2022-4789 | Medium | 5.4 | 2023-01-23 | The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as… |
CVE-2022-4775 | Medium | 5.4 | 2023-01-23 | The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4760 | Medium | 5.4 | 2023-01-23 | The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the pag… |
CVE-2022-4758 | Medium | 5.4 | 2023-01-23 | The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4753 | Medium | 5.4 | 2023-01-23 | The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4751 | Medium | 5.4 | 2023-01-23 | The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4746 | High | 7.5 | 2023-01-23 | The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possib… |
CVE-2022-4718 | Medium | 5.4 | 2023-01-23 | The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4716 | Medium | 5.4 | 2023-01-23 | The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which coul… |
CVE-2022-4715 | Medium | 5.4 | 2023-01-23 | The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, whi… |
CVE-2022-4706 | Medium | 5.4 | 2023-01-23 | The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the pag… |
CVE-2022-4693 | Critical | 9.8 | 2023-01-23 | The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the… |
CVE-2022-4675 | Medium | 5.4 | 2023-01-23 | The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low… |
CVE-2022-4673 | Medium | 5.4 | 2023-01-23 | The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as cont… |
CVE-2022-4672 | Medium | 5.4 | 2023-01-23 | The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in t… |
CVE-2022-4668 | Medium | 5.4 | 2023-01-23 | The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, whi… |
CVE-2022-4650 | Medium | 5.4 | 2023-01-23 | The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contribut… |
CVE-2022-4629 | Medium | 5.4 | 2023-01-23 | The Product Slider for WooCommerce WordPress plugin before 2.6.4 does not validate and escape some of its shortcode attributes before outputting them back in t… |
CVE-2022-4627 | Medium | 5.4 | 2023-01-23 | The ShiftNav WordPress plugin before 1.7.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could a… |
CVE-2022-4625 | Medium | 5.4 | 2023-01-23 | The Login Logout Menu WordPress plugin before 1.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4624 | Medium | 5.4 | 2023-01-23 | The GS Logo Slider WordPress plugin before 3.3.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which c… |
CVE-2022-4576 | Medium | 5.4 | 2023-01-23 | The Easy Bootstrap Shortcode WordPress plugin through 4.5.4 does not validate and escape some of its shortcode attributes before outputting them back in the pa… |
CVE-2022-4570 | Medium | 5.4 | 2023-01-23 | The Top 10 WordPress plugin before 3.2.3 does not validate and escape some of its Block attributes before outputting them back in the page, which could allow u… |
CVE-2022-4548 | Medium | 6.5 | 2023-01-23 | The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its settings, which could a… |
CVE-2022-4545 | Medium | 5.4 | 2023-01-23 | The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allo… |
CVE-2022-4542 | Medium | 5.4 | 2023-01-23 | The Compact WP Audio Player WordPress plugin before 1.9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4509 | Medium | 5.4 | 2023-01-23 | The Content Control WordPress plugin before 1.1.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4485 | Medium | 5.4 | 2023-01-23 | The Page-list WordPress plugin before 5.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could al… |
CVE-2022-4475 | Medium | 5.4 | 2023-01-23 | The Collapse-O-Matic WordPress plugin before 1.8.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4474 | Medium | 5.4 | 2023-01-23 | The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4467 | Medium | 5.4 | 2023-01-23 | The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4443 | Medium | 6.5 | 2023-01-23 | The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin c… |
CVE-2022-4383 | Critical | 9.8 | 2023-01-23 | The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action ava… |
CVE-2022-4346 | Medium | 5.3 | 2023-01-23 | The All-In-One Security (AIOS) WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address. |
CVE-2022-4323 | High | 7.2 | 2023-01-23 | The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perfo… |
CVE-2022-4307 | Medium | 6.1 | 2023-01-23 | The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with… |
CVE-2022-4305 | Critical | 9.8 | 2023-01-23 | The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could all… |
CVE-2022-4303 | High | 7.5 | 2023-01-23 | The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it… |
CVE-2022-4230 | High | 8.8 | 2023-01-23 | The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. By defaul… |
CVE-2022-4017 | High | 8.8 | 2023-01-23 | The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress… |
CVE-2022-47065 | High | 8.8 | 2023-01-23 | TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formN… |
CVE-2022-41505 | Medium | 6.4 | 2023-01-23 | An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UART pins, interruptin… |
CVE-2022-3811 | Medium | 4.8 | 2023-01-23 | The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2022-3425 | High | 7.2 | 2023-01-23 | The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perfo… |
CVE-2022-0316 | Critical | 9.8 | 2023-01-23 | The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-… |
CVE-2022-46959 | Medium | 4.3 | 2023-01-23 | An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal. |
CVE-2022-48281 | Medium | 5.5 | 2023-01-23 | processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image. |
CVE-2022-3918 | High | 8.8 | 2023-01-20 | A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers. In this vulnerability… |
CVE-2022-1109 | Medium | 5.5 | 2023-01-20 | An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service. |
CVE-2022-48279 | High | 7.5 | 2023-01-20 | In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is… |
CVE-2022-48152 | Critical | 9.8 | 2023-01-20 | SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicine… |
CVE-2022-48120 | Critical | 9.8 | 2023-01-20 | SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers… |
CVE-2022-47024 | High | 7.8 | 2023-01-20 | A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause den… |
CVE-2022-47021 | High | 7.8 | 2023-01-20 | A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause de… |
CVE-2022-47015 | Medium | 6.5 | 2023-01-20 | MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null… |
CVE-2022-47012 | High | 7.5 | 2023-01-20 | Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21. |
CVE-2022-45748 | High | 8.8 | 2023-01-20 | An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/AssetLib/Collada/Col… |
CVE-2022-45558 | Medium | 6.1 | 2023-01-20 | Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via the meta tag. |
CVE-2022-45557 | Medium | 6.1 | 2023-01-20 | Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names. |
CVE-2022-45542 | Medium | 5.4 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the FileManager component in GET parameter "filename" when editing any file. |
CVE-2022-45541 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-integer char. |
CVE-2022-45540 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-8 char. |
CVE-2022-45539 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in FileManager component in GET value "activepath" when creating a new file. |
CVE-2022-45538 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_GOBACK_URL". |
CVE-2022-45537 | Medium | 6.1 | 2023-01-20 | EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_LIST_URL". |