2022 CVEs (page 61)
Page 61 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-46732 | Critical | 9.8 | 2023-01-18 | Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status. |
CVE-2022-46660 | High | 7.5 | 2023-01-18 | An unauthorized user could alter or write files with full control over the path and content of the file. |
CVE-2022-46331 | High | 7.5 | 2023-01-18 | An unauthorized user could possibly delete any file on the system. |
CVE-2022-43494 | High | 7.5 | 2023-01-18 | An unauthorized user could be able to read any file on the system, potentially exposing sensitive information. |
CVE-2022-39429 | Medium | 4.3 | 2023-01-18 | Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19c and 21c. Easily exploitable vulnerability allo… |
CVE-2022-38469 | High | 7.5 | 2023-01-18 | An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords. |
CVE-2022-41903 | Critical | 9.8 | 2023-01-17 | Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. This functionality is also ex… |
CVE-2022-23521 | Critical | 9.8 | 2023-01-17 | Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. These attributes can be defined by adding a `… |
CVE-2022-41953 | High | 8.6 | 2023-01-17 | Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line… |
CVE-2022-47929 | Medium | 5.5 | 2023-01-17 | In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (s… |
CVE-2022-46475 | Critical | 9.8 | 2023-01-17 | D-Link DIR 645A1 1.06B01_Beta01 was discovered to contain a stack overflow via the service= variable in the genacgi_main function. |
CVE-2022-43977 | Critical | 9.8 | 2023-01-17 | An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. The debug port accessible via TCP (a qconn service) lacks acces… |
CVE-2022-43976 | Critical | 9.8 | 2023-01-17 | An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. Direct access to the API is possible on TCP p… |
CVE-2022-43975 | High | 7.5 | 2023-01-17 | An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0_3.2.2.17p0_4.7p0. A vulnerability in the web server allows arbi… |
CVE-2022-40319 | High | 7.5 | 2023-01-17 | The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email address in a wa.exe URL… |
CVE-2022-39195 | Medium | 6.1 | 2023-01-17 | A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML via the c parameter. |
CVE-2022-2907 | Medium | 5.7 | 2023-01-17 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versio… |
CVE-2022-2251 | Medium | 4.8 | 2023-01-17 | Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who… |
CVE-2022-23538 | Medium | 5.2 | 2023-01-17 | github.com/sylabs/scs-library-client is the Go client for the Singularity Container Services (SCS) Container Library Service. When the scs-library-client is us… |
CVE-2022-4891 | Low | 3.5 | 2023-01-17 | A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisi… |
CVE-2022-37436 | Medium | 5.3 | 2023-01-17 | Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into… |
CVE-2022-36760 | Critical | 9.0 | 2023-01-17 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in mod_proxy_ajp of Apache HTTP Server allows an attacker to smuggle requ… |
CVE-2022-47853 | Critical | 9.8 | 2023-01-17 | TOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell throug… |
CVE-2022-40704 | Medium | 6.1 | 2023-01-17 | A XSS vulnerability was found in phoromatic_r_add_test_details.php in phoronix-test-suite. |
CVE-2022-3650 | High | 7.8 | 2023-01-17 | A privilege escalation flaw was found in Ceph. Ceph-crash.service allows a local attacker to escalate privileges to root in the form of a crash dump, and dump… |
CVE-2022-23739 | Critical | 9.8 | 2023-01-17 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server, allowing for escalation of privileges in GraphQL API requests from GitHub… |
CVE-2022-4121 | Medium | 5.5 | 2023-01-17 | In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to a remote denial of… |
CVE-2022-41861 | Medium | 6.5 | 2023-01-17 | A flaw was found in freeradius. A malicious RADIUS client or home server can send a malformed abinary attribute which can cause the server to crash. |
CVE-2022-41860 | High | 7.5 | 2023-01-17 | In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionaries. This lookup wil… |
CVE-2022-41859 | High | 7.5 | 2023-01-17 | In freeradius, the EAP-PWD function compute_password_element() leaks information about the password which allows an attacker to substantially reduce the size o… |
CVE-2022-41858 | High | 7.1 | 2023-01-17 | A flaw was found in the Linux kernel. A NULL pointer dereference may occur while a slip driver is in progress to detach in sl_tx_timeout in drivers/net/slip/sl… |
CVE-2022-4621 | High | 7.5 | 2023-01-17 | Panasonic Sanyo CCTV Network Cameras versions 1.02-05 and 2.03-0x are vulnerable to CSRFs that can be exploited to allow an attacker to perform changes with… |
CVE-2022-3091 | High | 7.5 | 2023-01-17 | RONDS EPM version 1.19.5 has a vulnerability in which a function could allow unauthenticated users to leak credentials. In some circumstances, an attacker ca… |
CVE-2022-2893 | High | 8.2 | 2023-01-17 | RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files… |
CVE-2022-47318 | High | 8.0 | 2023-01-17 | ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a… |
CVE-2022-46648 | High | 8.0 | 2023-01-17 | ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a… |
CVE-2022-46891 | High | 8.8 | 2023-01-17 | An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processing operations to gain… |
CVE-2022-43462 | Critical | 9.1 | 2023-01-17 | Auth. SQL Injection (SQLi) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions. |
CVE-2022-42462 | Medium | 4.8 | 2023-01-17 | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Adeel Ahmed's IP Blacklist Cloud plugin <= 5.00 versions. |
CVE-2022-30544 | Medium | 4.3 | 2023-01-17 | Cross-Site Request Forgery (CSRF) in MiKa's OSM – OpenStreetMap plugin <= 6.0.1 versions. |
CVE-2022-45440 | Medium | 4.4 | 2023-01-17 | A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on external storage media. A… |
CVE-2022-45439 | Medium | 6.5 | 2023-01-17 | A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0 in cleartext. An unauthenticated… |
CVE-2022-3087 | High | 7.8 | 2023-01-17 | Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary co… |
CVE-2022-4658 | Medium | 5.4 | 2023-01-16 | The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contri… |
CVE-2022-4655 | Medium | 5.4 | 2023-01-16 | The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low… |
CVE-2022-4653 | Medium | 5.4 | 2023-01-16 | The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contri… |
CVE-2022-4648 | Medium | 5.4 | 2023-01-16 | The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4578 | Medium | 5.4 | 2023-01-16 | The Video Conferencing with Zoom WordPress plugin before 4.0.10 does not validate and escape some of its shortcode attributes before outputting them back in th… |
CVE-2022-4571 | Medium | 5.4 | 2023-01-16 | The Seriously Simple Podcasting WordPress plugin before 2.19.1 does not validate and escape some of its shortcode attributes before outputting them back in the… |
CVE-2022-4549 | Medium | 4.3 | 2023-01-16 | The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin… |
CVE-2022-4547 | High | 7.2 | 2023-01-16 | The Conditional Payment Methods for WooCommerce WordPress plugin through 1.0 does not properly sanitise and escape a parameter before using it in a SQL stateme… |
CVE-2022-4544 | Medium | 5.4 | 2023-01-16 | The MashShare WordPress plugin before 3.8.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could… |
CVE-2022-4508 | Medium | 5.4 | 2023-01-16 | The ConvertKit WordPress plugin before 2.0.5 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which coul… |
CVE-2022-4507 | Medium | 5.4 | 2023-01-16 | The Real Cookie Banner WordPress plugin before 3.4.10 does not validate and escapes some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-4487 | Medium | 5.4 | 2023-01-16 | The Easy Accordion WordPress plugin before 2.2.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which c… |
CVE-2022-4486 | Medium | 5.4 | 2023-01-16 | The Meteor Slides WordPress plugin before 1.5.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4484 | Medium | 5.4 | 2023-01-16 | The Social Share, Social Login and Social Comments Plugin WordPress plugin before 7.13.44 does not validate and escape some of its shortcode attributes before… |
CVE-2022-4483 | Medium | 5.4 | 2023-01-16 | The Insert Pages WordPress plugin before 3.7.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which cou… |
CVE-2022-4482 | Medium | 5.4 | 2023-01-16 | The Carousel, Slider, Gallery by WP Carousel WordPress plugin before 2.5.3 does not validate and escape some of its shortcode attributes before outputting them… |
CVE-2022-4481 | Medium | 5.4 | 2023-01-16 | The Mesmerize Companion WordPress plugin before 1.6.135 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4480 | Medium | 5.4 | 2023-01-16 | The Click to Chat WordPress plugin before 3.18.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which c… |
CVE-2022-4478 | Medium | 5.4 | 2023-01-16 | The Font Awesome WordPress plugin before 4.3.2 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which co… |
CVE-2022-4477 | Medium | 5.4 | 2023-01-16 | The Smash Balloon Social Post Feed WordPress plugin before 4.1.6 does not validate and escapes some of its shortcode attributes before outputting them back in… |
CVE-2022-4476 | Medium | 5.4 | 2023-01-16 | The Download Manager WordPress plugin before 3.2.62 does not validate and escapes some of its shortcode attributes before outputting them back in the page, whi… |
CVE-2022-4469 | Medium | 5.4 | 2023-01-16 | The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4465 | Medium | 5.4 | 2023-01-16 | The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4464 | Medium | 5.4 | 2023-01-16 | Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4460 | Medium | 5.4 | 2023-01-16 | The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the… |
CVE-2022-4453 | Medium | 5.4 | 2023-01-16 | The 3D FlipBook WordPress plugin through 1.13.2 does not validate or escape some of its shortcode attributes before outputting them back in the page, which cou… |
CVE-2022-4451 | Medium | 5.4 | 2023-01-16 | The Social Sharing WordPress plugin before 3.3.45 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4449 | Medium | 5.4 | 2023-01-16 | The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, whic… |
CVE-2022-4447 | Critical | 9.8 | 2023-01-16 | The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to… |
CVE-2022-4442 | Medium | 4.8 | 2023-01-16 | The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privile… |
CVE-2022-4431 | Medium | 5.4 | 2023-01-16 | The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could al… |
CVE-2022-4330 | Medium | 4.8 | 2023-01-16 | The WP Attachments WordPress plugin before 5.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-4320 | Medium | 6.1 | 2023-01-16 | The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Refle… |
CVE-2022-4309 | Low | 3.1 | 2023-01-16 | The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitra… |
CVE-2022-4299 | Medium | 4.8 | 2023-01-16 | The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2022-4295 | Medium | 6.1 | 2023-01-16 | The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cros… |
CVE-2022-4199 | Medium | 4.8 | 2023-01-16 | The Link Library WordPress plugin before 7.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfo… |
CVE-2022-4101 | Critical | 9.1 | 2023-01-16 | The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated user… |
CVE-2022-4060 | Critical | 9.8 | 2023-01-16 | The User Post Gallery WordPress plugin through 2.19 does not limit what callback functions can be called by users, making it possible to any visitors to run co… |
CVE-2022-47630 | High | 7.4 | 2023-01-16 | Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvc… |
CVE-2022-3904 | Medium | 6.1 | 2023-01-16 | The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker… |
CVE-2022-2658 | Medium | 4.8 | 2023-01-16 | The WP Spell Check WordPress plugin before 9.13 does not escape ignored words, which could allow high privilege users such as admin to perform Stored Cross-Sit… |
CVE-2022-4890 | Medium | 6.3 | 2023-01-16 | A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/ini… |
CVE-2022-45438 | Medium | 5.3 | 2023-01-16 | When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configurati… |
CVE-2022-43721 | Medium | 5.4 | 2023-01-16 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clickin… |
CVE-2022-43720 | Medium | 5.4 | 2023-01-16 | An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast messa… |
CVE-2022-43719 | High | 8.8 | 2023-01-16 | Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 an… |
CVE-2022-43718 | Medium | 5.4 | 2023-01-16 | Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connecti… |
CVE-2022-43717 | Medium | 5.4 | 2023-01-16 | Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authentic… |
CVE-2022-41703 | Medium | 5.4 | 2023-01-16 | A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the W… |
CVE-2022-4258 | High | 7.8 | 2023-01-16 | In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to gain privileges via a malicious .exe fi… |
CVE-2022-4889 | Medium | 5.5 | 2023-01-15 | A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public… |
CVE-2022-2815 | Medium | 6.5 | 2023-01-14 | Insecure Storage of Sensitive Information in GitHub repository publify/publify prior to 9.2.10. |
CVE-2022-1812 | Critical | 9.8 | 2023-01-14 | Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10. |
CVE-2022-45353 | Medium | 4.3 | 2023-01-14 | Broken Access Control in Betheme theme <= 26.6.1 on WordPress. |
CVE-2022-38467 | Medium | 6.1 | 2023-01-14 | Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver. |
CVE-2022-41956 | Medium | 6.5 | 2023-01-14 | Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded p… |