2022 CVEs (page 61)
Page 61 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-37436 | Medium | 5.3 | 2023-01-17 | Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into… |
CVE-2022-36760 | Critical | 9.0 | 2023-01-17 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requ… |
CVE-2022-47853 | Critical | 9.8 | 2023-01-17 | TOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell throug… |
CVE-2022-40704 | Medium | 6.1 | 2023-01-17 | A XSS vulnerability was found in phoromatic_r_add_test_details.php in phoronix-test-suite. |
CVE-2022-3650 | High | 7.8 | 2023-01-17 | A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump… |
CVE-2022-23739 | Critical | 9.8 | 2023-01-17 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub… |
CVE-2022-4121 | Medium | 5.5 | 2023-01-17 | In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to a remote denial of… |
CVE-2022-41861 | Medium | 6.5 | 2023-01-17 | A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash. |
CVE-2022-41860 | High | 7.5 | 2023-01-17 | In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup wil… |
CVE-2022-41859 | High | 7.5 | 2023-01-17 | In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size o… |
CVE-2022-41858 | High | 7.1 | 2023-01-17 | A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/sl… |
CVE-2022-4621 | High | 7.5 | 2023-01-17 | Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allow an attacker to perform changes with… |
CVE-2022-3091 | High | 7.5 | 2023-01-17 | RONDS EPM version 1.19.5 has a vulnerability in which a function could allow unauthenticated users to leak credentials. In some circumstances, an attacker ca… |
CVE-2022-2893 | High | 8.2 | 2023-01-17 | RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files… |
CVE-2022-47318 | High | 8.0 | 2023-01-17 | ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a… |
CVE-2022-46648 | High | 8.0 | 2023-01-17 | ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a… |
CVE-2022-46891 | High | 8.8 | 2023-01-17 | An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processing operations to gain… |
CVE-2022-43462 | Critical | 9.1 | 2023-01-17 | Auth. SQL Injection (SQLi) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions. |
CVE-2022-42462 | Medium | 4.8 | 2023-01-17 | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions. |
CVE-2022-30544 | Medium | 4.3 | 2023-01-17 | Cross-Site Request Forgery (CSRF) in MiKa's OSM – OpenStreetMap plugin <= 6.0.1 versions. |
CVE-2022-45440 | Medium | 4.4 | 2023-01-17 | A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A… |
CVE-2022-45439 | Medium | 6.5 | 2023-01-17 | A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0 in cleartext. An unauthenticated… |
CVE-2022-3087 | High | 7.8 | 2023-01-17 | Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary co… |
CVE-2022-4658 | Medium | 5.4 | 2023-01-16 | The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contri… |
CVE-2022-4655 | Medium | 5.4 | 2023-01-16 | The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low… |
CVE-2022-4653 | Medium | 5.4 | 2023-01-16 | The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contri… |
CVE-2022-4648 | Medium | 5.4 | 2023-01-16 | The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4578 | Medium | 5.4 | 2023-01-16 | The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in th… |
CVE-2022-4571 | Medium | 5.4 | 2023-01-16 | The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the… |
CVE-2022-4549 | Medium | 4.3 | 2023-01-16 | The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin… |
CVE-2022-4547 | High | 7.2 | 2023-01-16 | The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL stateme… |
CVE-2022-4544 | Medium | 5.4 | 2023-01-16 | The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could… |
CVE-2022-4508 | Medium | 5.4 | 2023-01-16 | The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which coul… |
CVE-2022-4507 | Medium | 5.4 | 2023-01-16 | The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-4487 | Medium | 5.4 | 2023-01-16 | The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which c… |
CVE-2022-4486 | Medium | 5.4 | 2023-01-16 | The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4484 | Medium | 5.4 | 2023-01-16 | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before… |
CVE-2022-4483 | Medium | 5.4 | 2023-01-16 | The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which cou… |
CVE-2022-4482 | Medium | 5.4 | 2023-01-16 | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them… |
CVE-2022-4481 | Medium | 5.4 | 2023-01-16 | The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4480 | Medium | 5.4 | 2023-01-16 | The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which c… |
CVE-2022-4478 | Medium | 5.4 | 2023-01-16 | The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4477 | Medium | 5.4 | 2023-01-16 | The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in… |
CVE-2022-4476 | Medium | 5.4 | 2023-01-16 | The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, whi… |
CVE-2022-4469 | Medium | 5.4 | 2023-01-16 | The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4465 | Medium | 5.4 | 2023-01-16 | The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4464 | Medium | 5.4 | 2023-01-16 | Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4460 | Medium | 5.4 | 2023-01-16 | The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the… |
CVE-2022-4453 | Medium | 5.4 | 2023-01-16 | The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which cou… |
CVE-2022-4451 | Medium | 5.4 | 2023-01-16 | The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4449 | Medium | 5.4 | 2023-01-16 | The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4447 | Critical | 9.8 | 2023-01-16 | The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to… |
CVE-2022-4442 | Medium | 4.8 | 2023-01-16 | The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privile… |
CVE-2022-4431 | Medium | 5.4 | 2023-01-16 | The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could al… |
CVE-2022-4330 | Medium | 4.8 | 2023-01-16 | The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-4320 | Medium | 6.1 | 2023-01-16 | The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Refle… |
CVE-2022-4309 | Low | 3.1 | 2023-01-16 | The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitra… |
CVE-2022-4299 | Medium | 4.8 | 2023-01-16 | The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2022-4295 | Medium | 6.1 | 2023-01-16 | The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2022-4199 | Medium | 4.8 | 2023-01-16 | The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2022-4101 | Critical | 9.1 | 2023-01-16 | The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated user… |
CVE-2022-4060 | Critical | 9.8 | 2023-01-16 | The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run co… |
CVE-2022-47630 | High | 7.4 | 2023-01-16 | Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvc… |
CVE-2022-3904 | Medium | 6.1 | 2023-01-16 | The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker… |
CVE-2022-2658 | Medium | 4.8 | 2023-01-16 | The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Sit… |
CVE-2022-4890 | Medium | 6.3 | 2023-01-16 | A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/ini… |
CVE-2022-45438 | Medium | 5.3 | 2023-01-16 | When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configurati… |
CVE-2022-43721 | Medium | 5.4 | 2023-01-16 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clickin… |
CVE-2022-43720 | Medium | 5.4 | 2023-01-16 | An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast messa… |
CVE-2022-43719 | High | 8.8 | 2023-01-16 | Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 an… |
CVE-2022-43718 | Medium | 5.4 | 2023-01-16 | Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connecti… |
CVE-2022-43717 | Medium | 5.4 | 2023-01-16 | Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authentic… |
CVE-2022-41703 | Medium | 5.4 | 2023-01-16 | A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the W… |
CVE-2022-4258 | High | 7.8 | 2023-01-16 | In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to gain privileges via a malicious .exe fi… |
CVE-2022-4889 | Medium | 5.5 | 2023-01-15 | A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public… |
CVE-2022-2815 | Medium | 6.5 | 2023-01-14 | Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10. |
CVE-2022-1812 | Critical | 9.8 | 2023-01-14 | Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10. |
CVE-2022-45353 | Medium | 4.3 | 2023-01-14 | Broken Access Control in Betheme theme <= 26.6.1 on WordPress. |
CVE-2022-38467 | Medium | 6.1 | 2023-01-14 | Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver. |
CVE-2022-41956 | Medium | 6.5 | 2023-01-14 | Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded p… |
CVE-2022-41955 | High | 8.8 | 2023-01-14 | Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded p… |
CVE-2022-23532 | High | 7.1 | 2023-01-14 | APOC (Awesome Procedures on Cypher) is an add-on library for Neo4j that provides hundreds of procedures and functions. A path traversal vulnerability found in… |
CVE-2022-41721 | High | 7.5 | 2023-01-13 | A request smuggling attack is possible when using MaxBytesHandler. When using MaxBytesHandler, the body of an HTTP request is not fully consumed. When the serv… |
CVE-2022-46093 | High | 8.2 | 2023-01-13 | Hospital Management System v1.0 is vulnerable to SQL Injection. Attackers can gain administrator privileges without the need for a password. |
CVE-2022-45299 | Critical | 9.8 | 2023-01-13 | An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL. |
CVE-2022-42136 | High | 8.8 | 2023-01-13 | Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access… |
CVE-2022-46956 | High | 7.2 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/manage_user.php. |
CVE-2022-46955 | Critical | 9.8 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=save_queue. |
CVE-2022-46954 | Critical | 9.8 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_transacti… |
CVE-2022-46953 | High | 7.2 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=save_window. |
CVE-2022-46952 | High | 7.2 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_user. |
CVE-2022-46951 | High | 7.2 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_uploads. |
CVE-2022-46950 | High | 7.2 | 2023-01-13 | Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_window. |
CVE-2022-46949 | High | 7.2 | 2023-01-13 | Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_helmet. |
CVE-2022-46947 | High | 7.2 | 2023-01-13 | Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category. |
CVE-2022-46946 | High | 7.2 | 2023-01-13 | Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_brand. |
CVE-2022-48091 | Medium | 5.4 | 2023-01-13 | Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php. |
CVE-2022-48090 | Medium | 6.5 | 2023-01-13 | Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php. |
CVE-2022-3693 | High | 7.5 | 2023-01-13 | Path Traversal vulnerability in Deytek Informatics FileOrbis File Management System allows Path Traversal. This issue affects FileOrbis File Management System… |
CVE-2022-42268 | High | 7.8 | 2023-01-13 | Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima. These applications allow execut… |