2022 CVEs (page 63)
Page 63 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3573 | Medium | 5.4 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio… |
CVE-2022-3514 | Medium | 4.3 | 2023-01-12 | An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all version… |
CVE-2022-4344 | Medium | 6.3 | 2023-01-12 | Memory exhaustion in the Kafka protocol dissector in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service via packet injection or crafted captu… |
CVE-2022-4874 | High | 7.5 | 2023-01-11 | Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, t… |
CVE-2022-4873 | Critical | 9.8 | 2023-01-11 | On Netcomm router models NF20MESH, NF20, and NL1902 a stack based buffer overflow affects the sessionKey parameter. By providing a specific number of bytes, th… |
CVE-2022-4498 | Critical | 9.8 | 2023-01-11 | In TP-Link routers, Archer C5 and WR710N-V1, running the latest available code, when receiving HTTP Basic Authentication the httpd service can be sent a crafte… |
CVE-2022-46176 | Medium | 5.3 | 2023-01-11 | Cargo is a Rust package manager. The Rust Security Response WG was notified that Cargo did not perform SSH host key verification when cloning indexes and depen… |
CVE-2022-4499 | High | 7.5 | 2023-01-11 | TP-Link routers, Archer C5 and WR710N-V1, using the latest software, the strcmp function used for checking credentials in httpd, is susceptible to a side-chann… |
CVE-2022-4885 | Medium | 5.0 | 2023-01-11 | A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical. This vulnerability affects unknown code of the file src/scripts/jeffer… |
CVE-2022-4457 | Medium | 5.5 | 2023-01-11 | Due to a misconfiguration in the manifest file of the WARP client for Android, it was possible to a perform a task hijacking attack. An attacker could create a… |
CVE-2022-4428 | High | 8.9 | 2023-01-11 | support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitra… |
CVE-2022-40615 | Medium | 6.3 | 2023-01-11 | IBM Sterling Partner Engagement Manager 6.1, 6.2, and 6.2.1 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, whi… |
CVE-2022-34335 | Medium | 6.5 | 2023-01-11 | IBM Sterling Partner Engagement Manager 6.1.2, 6.2.0, and 6.2.1 could allow an authenticated user to exhaust server resources which could lead to a denial of… |
CVE-2022-4543 | Medium | 5.5 | 2023-01-11 | A flaw named "EntryBleed" was found in the Linux Kernel Page Table Isolation (KPTI). This issue could allow a local attacker to leak KASLR base via prefetch si… |
CVE-2022-4415 | Medium | 5.5 | 2023-01-11 | A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel… |
CVE-2022-47864 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeCategories.php. |
CVE-2022-47862 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the customer_id parameter in ajax_represent.php. |
CVE-2022-47861 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeLead.php. |
CVE-2022-47860 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeProduct.php. |
CVE-2022-47859 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the user_id parameter in changePassword.php. |
CVE-2022-47866 | Critical | 9.8 | 2023-01-11 | Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php. |
CVE-2022-47865 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php. |
CVE-2022-4696 | High | 7.8 | 2023-01-11 | There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_W… |
CVE-2022-42967 | High | 7.5 | 2023-01-11 | Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code executio… |
CVE-2022-34441 | High | 8.0 | 2023-01-11 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2022-34440 | High | 8.4 | 2023-01-11 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of t… |
CVE-2022-23814 | Medium | 5.3 | 2023-01-11 | Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute envir… |
CVE-2022-23813 | Medium | 5.3 | 2023-01-11 | The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest memory in a confident… |
CVE-2022-42271 | High | 8.4 | 2023-01-11 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execut… |
CVE-2022-0553 | Medium | 6.5 | 2023-01-11 | There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrie… |
CVE-2022-48253 | Critical | 9.8 | 2023-01-11 | nhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote server. The vulnerabilit… |
CVE-2022-48252 | Critical | 9.8 | 2023-01-11 | The jokob-sk/Pi.Alert fork (before 22.12.20) of Pi.Alert allows Remote Code Execution via nmap_scan.php (scan parameter) OS Command Injection. |
CVE-2022-43393 | High | 8.2 | 2023-01-11 | An improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70(ABMH.8)C0, which c… |
CVE-2022-43392 | Medium | 6.5 | 2023-01-11 | A buffer overflow vulnerability in the parameter of web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker t… |
CVE-2022-43391 | Medium | 6.5 | 2023-01-11 | A buffer overflow vulnerability in the parameter of the CGI program in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attac… |
CVE-2022-43390 | Medium | 5.4 | 2023-01-11 | A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute… |
CVE-2022-43389 | High | 8.6 | 2023-01-11 | A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attack… |
CVE-2022-4382 | Medium | 6.4 | 2023-01-10 | A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device th… |
CVE-2022-4379 | High | 7.5 | 2023-01-10 | A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial |
CVE-2022-4338 | Critical | 9.8 | 2023-01-10 | An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. |
CVE-2022-4337 | Critical | 9.8 | 2023-01-10 | An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch. |
CVE-2022-46449 | High | 7.5 | 2023-01-10 | An issue in MPD (Music Player Daemon) v0.23.10 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2022-46163 | High | 7.5 | 2023-01-10 | Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be… |
CVE-2022-45167 | Medium | 4.3 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to access the profile information of a… |
CVE-2022-45166 | Medium | 6.5 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of user-controlled parameters that are used… |
CVE-2022-45165 | Medium | 6.5 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a user-controlled parameter that is used to create… |
CVE-2022-45164 | Medium | 4.3 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to cancel (delete) a booking, created… |
CVE-2022-38492 | High | 7.7 | 2023-01-10 | An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. One parameter allows SQL injection. Version 2022.1.110.1.02 fixes the vulnerability. |
CVE-2022-38491 | High | 8.2 | 2023-01-10 | An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Versi… |
CVE-2022-38490 | Critical | 9.6 | 2023-01-10 | An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Some parameters allow SQL injection. Version 2022.1.110.1.02 corrects this issue. |
CVE-2022-38489 | Medium | 4.8 | 2023-01-10 | An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). Version 2022.1.110.1.02 fixes the vulne… |
CVE-2022-38482 | Medium | 4.3 | 2023-01-10 | A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4. |
CVE-2022-38481 | Medium | 6.1 | 2023-01-10 | An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several features. |
CVE-2022-38393 | High | 7.5 | 2023-01-10 | A denial of service vulnerability exists in the cfg_server cm_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration… |
CVE-2022-38105 | High | 7.5 | 2023-01-10 | An information disclosure vulnerability exists in the cm_processREQ_NC opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration service. A spe… |
CVE-2022-36443 | High | 7.8 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some communication channels (wireless and SD card)… |
CVE-2022-36442 | Medium | 5.5 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is possible to install an unauthorized appl… |
CVE-2022-36441 | High | 7.1 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applicati… |
CVE-2022-35401 | High | 8.1 | 2023-01-10 | An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP re… |
CVE-2022-30332 | Medium | 5.3 | 2023-01-10 | In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depen… |
CVE-2022-4636 | High | 7.5 | 2023-01-10 | Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which… |
CVE-2022-4711 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to… |
CVE-2022-4710 | Medium | 6.1 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insuffi… |
CVE-2022-4709 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to… |
CVE-2022-4708 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up t… |
CVE-2022-4707 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing no… |
CVE-2022-4705 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, a… |
CVE-2022-4704 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, a… |
CVE-2022-4703 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to… |
CVE-2022-4702 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to… |
CVE-2022-4701 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up… |
CVE-2022-4700 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to… |
CVE-2022-47083 | High | 8.8 | 2023-01-10 | A PHP Object Injection vulnerability in the unserialize() function Spitfire CMS v1.0.475 allows authenticated attackers to execute arbitrary code via sending c… |
CVE-2022-4422 | Critical | 9.8 | 2023-01-10 | Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in… |
CVE-2022-46610 | High | 8.8 | 2023-01-10 | 72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attackers to execute arbitr… |
CVE-2022-3792 | Critical | 9.8 | 2023-01-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GullsEye GullsEye terminal operating system allows SQL In… |
CVE-2022-47967 | High | 7.8 | 2023-01-10 | A vulnerability has been identified in Solid Edge (All versions < V2023 MP1). The DOCMGMT.DLL contains a memory corruption vulnerability that could be triggere… |
CVE-2022-47935 | High | 7.8 | 2023-01-10 | A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt10… |
CVE-2022-46823 | Critical | 9.3 | 2023-01-10 | A vulnerability has been identified in Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.4), Mendix SAML (Mendix 9 compatible, New Track) (All v… |
CVE-2022-45094 | High | 8.4 | 2023-01-10 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (… |
CVE-2022-45093 | High | 8.5 | 2023-01-10 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (… |
CVE-2022-45092 | Critical | 9.9 | 2023-01-10 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (… |
CVE-2022-43514 | High | 7.7 | 2023-01-10 | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl… |
CVE-2022-43513 | High | 8.2 | 2023-01-10 | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl… |
CVE-2022-38773 | Medium | 4.6 | 2023-01-10 | Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during… |
CVE-2022-4429 | Medium | 5.3 | 2023-01-10 | Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issu… |
CVE-2022-4294 | High | 7.1 | 2023-01-10 | Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may… |
CVE-2022-48251 | High | 7.5 | 2023-01-10 | The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offe… |
CVE-2022-4497 | Medium | 5.4 | 2023-01-09 | The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could… |
CVE-2022-4491 | Medium | 5.4 | 2023-01-09 | The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4479 | Medium | 5.4 | 2023-01-09 | The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4468 | Medium | 5.4 | 2023-01-09 | The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4426 | Medium | 4.3 | 2023-01-09 | The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the optio… |
CVE-2022-4394 | Medium | 5.4 | 2023-01-09 | The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perfo… |
CVE-2022-4393 | Medium | 5.4 | 2023-01-09 | The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as… |
CVE-2022-4392 | Medium | 5.4 | 2023-01-09 | The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contr… |
CVE-2022-4391 | Medium | 5.4 | 2023-01-09 | The Vision Interactive For WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to pe… |
CVE-2022-4374 | Medium | 6.1 | 2023-01-09 | The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2022-4368 | Medium | 6.1 | 2023-01-09 | The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot h… |
CVE-2022-4325 | Medium | 6.1 | 2023-01-09 | The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle… |