2022 CVEs (page 63)
Page 63 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-47866 | Critical | 9.8 | 2023-01-11 | Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php. |
CVE-2022-47865 | Critical | 9.8 | 2023-01-11 | Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php. |
CVE-2022-4696 | High | 7.8 | 2023-01-11 | There exists a use-after-free vulnerability in the Linux kernel through io_uring and the IORING_OP_SPLICE operation. If IORING_OP_SPLICE is missing the IO_WQ_W… |
CVE-2022-42967 | High | 7.5 | 2023-01-11 | Caret is vulnerable to an XSS attack when the user opens a crafted Markdown file when preview mode is enabled. This directly leads to client-side code executio… |
CVE-2022-34441 | High | 8.0 | 2023-01-11 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of… |
CVE-2022-34440 | High | 8.4 | 2023-01-11 | Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. An attacker with the knowledge of t… |
CVE-2022-23814 | Medium | 5.3 | 2023-01-11 | Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confidential compute envir… |
CVE-2022-23813 | Medium | 5.3 | 2023-01-11 | The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest memory in a confident… |
CVE-2022-42271 | High | 8.4 | 2023-01-11 | NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service or gain code execut… |
CVE-2022-0553 | Medium | 6.5 | 2023-01-11 | There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrie… |
CVE-2022-48253 | Critical | 9.8 | 2023-01-11 | nhttpd in Nostromo before 2.1 is vulnerable to a path traversal that may allow an attacker to execute arbitrary commands on the remote server. The vulnerabilit… |
CVE-2022-48252 | Critical | 9.8 | 2023-01-11 | The jokob-sk/Pi.Alert fork (before 22.12.20) of Pi.Alert allows Remote Code Execution via nmap_scan.php (scan parameter) OS Command Injection. |
CVE-2022-43393 | High | 8.2 | 2023-01-11 | An improper check for unusual or exceptional conditions in the HTTP request processing function of Zyxel GS1920-24v2 firmware prior to V4.70(ABMH.8)C0, which c… |
CVE-2022-43392 | Medium | 6.5 | 2023-01-11 | A buffer overflow vulnerability in the parameter of web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker t… |
CVE-2022-43391 | Medium | 6.5 | 2023-01-11 | A buffer overflow vulnerability in the parameter of the CGI program in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attac… |
CVE-2022-43390 | Medium | 5.4 | 2023-01-11 | A command injection vulnerability in the CGI program of Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an authenticated attacker to execute… |
CVE-2022-43389 | High | 8.6 | 2023-01-11 | A buffer overflow vulnerability in the library of the web server in Zyxel NR7101 firmware prior to V1.15(ACCC.3)C0, which could allow an unauthenticated attack… |
CVE-2022-4382 | Medium | 6.4 | 2023-01-10 | A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. It could be triggered by yanking out a device th… |
CVE-2022-4379 | High | 7.5 | 2023-01-10 | A use-after-free vulnerability was found in __nfs42_ssc_open() in fs/nfs/nfs4file.c in the Linux kernel. This flaw allows an attacker to conduct a remote denial |
CVE-2022-4338 | Critical | 9.8 | 2023-01-10 | An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. |
CVE-2022-4337 | Critical | 9.8 | 2023-01-10 | An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch. |
CVE-2022-46449 | High | 7.5 | 2023-01-10 | An issue in MPD (Music Player Daemon) v0.23.10 allows attackers to cause a Denial of Service (DoS) via a crafted input. |
CVE-2022-46163 | High | 7.5 | 2023-01-10 | Travel support program is a rails app to support the travel support program of openSUSE (TSP). Sensitive user data (bank account details, password Hash) can be… |
CVE-2022-45167 | Medium | 4.3 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to access the profile information of a… |
CVE-2022-45166 | Medium | 6.5 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a set of user-controlled parameters that are used… |
CVE-2022-45165 | Medium | 6.5 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application accepts a user-controlled parameter that is used to create… |
CVE-2022-45164 | Medium | 4.3 | 2023-01-10 | An issue was discovered in Archibus Web Central 2022.03.01.107. A service exposed by the application allows a basic user to cancel (delete) a booking, created… |
CVE-2022-38492 | High | 7.7 | 2023-01-10 | An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. One parameter allows SQL injection. Version 2022.1.110.1.02 fixes the vulnerability. |
CVE-2022-38491 | High | 8.2 | 2023-01-10 | An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Part of the application does not implement protection against brute-force attacks. Versi… |
CVE-2022-38490 | Critical | 9.6 | 2023-01-10 | An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. Some parameters allow SQL injection. Version 2022.1.110.1.02 corrects this issue. |
CVE-2022-38489 | Medium | 4.8 | 2023-01-10 | An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). Version 2022.1.110.1.02 fixes the vulne… |
CVE-2022-38482 | Medium | 4.3 | 2023-01-10 | A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4. |
CVE-2022-38481 | Medium | 6.1 | 2023-01-10 | An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. The application is prone to reflected Cross-site Scripting (XSS) in several features. |
CVE-2022-38393 | High | 7.5 | 2023-01-10 | A denial of service vulnerability exists in the cfg_server cm_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration… |
CVE-2022-38105 | High | 7.5 | 2023-01-10 | An information disclosure vulnerability exists in the cm_processREQ_NC opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration service. A spe… |
CVE-2022-36443 | High | 7.8 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The device allows the administrator to lock some communication channels (wireless and SD card)… |
CVE-2022-36442 | Medium | 5.5 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. By using the embedded Google Chrome application, it is possible to install an unauthorized appl… |
CVE-2022-36441 | High | 7.1 | 2023-01-10 | An issue was discovered in Zebra Enterprise Home Screen 4.1.19. The Gboard used by different applications can be used to launch and use several other applicati… |
CVE-2022-35401 | High | 8.1 | 2023-01-10 | An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP re… |
CVE-2022-30332 | Medium | 5.3 | 2023-01-10 | In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depen… |
CVE-2022-4636 | High | 7.5 | 2023-01-10 | Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to path traversal, which… |
CVE-2022-4711 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to… |
CVE-2022-4710 | Medium | 6.1 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insuffi… |
CVE-2022-4709 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to… |
CVE-2022-4708 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up t… |
CVE-2022-4707 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing no… |
CVE-2022-4705 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, a… |
CVE-2022-4704 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, a… |
CVE-2022-4703 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to… |
CVE-2022-4702 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to… |
CVE-2022-4701 | Medium | 4.3 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up… |
CVE-2022-4700 | Medium | 5.4 | 2023-01-10 | The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to… |
CVE-2022-47083 | High | 8.8 | 2023-01-10 | A PHP Object Injection vulnerability in the unserialize() function Spitfire CMS v1.0.475 allows authenticated attackers to execute arbitrary code via sending c… |
CVE-2022-4422 | Critical | 9.8 | 2023-01-10 | Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in… |
CVE-2022-46610 | High | 8.8 | 2023-01-10 | 72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attackers to execute arbitr… |
CVE-2022-3792 | Critical | 9.8 | 2023-01-10 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in GullsEye GullsEye terminal operating system allows SQL In… |
CVE-2022-47967 | High | 7.8 | 2023-01-10 | A vulnerability has been identified in Solid Edge (All versions < V2023 MP1). The DOCMGMT.DLL contains a memory corruption vulnerability that could be triggere… |
CVE-2022-47935 | High | 7.8 | 2023-01-10 | A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt10… |
CVE-2022-46823 | Critical | 9.3 | 2023-01-10 | A vulnerability has been identified in Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.4), Mendix SAML (Mendix 9 compatible, New Track) (All v… |
CVE-2022-45094 | High | 8.4 | 2023-01-10 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (… |
CVE-2022-45093 | High | 8.5 | 2023-01-10 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (… |
CVE-2022-45092 | Critical | 9.9 | 2023-01-10 | A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (… |
CVE-2022-43514 | High | 7.7 | 2023-01-10 | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl… |
CVE-2022-43513 | High | 8.2 | 2023-01-10 | A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions < V6.0 SP9 Upd4), TeleControl… |
CVE-2022-38773 | Medium | 4.6 | 2023-01-10 | Affected devices do not contain an Immutable Root of Trust in Hardware. With this the integrity of the code executed on the device can not be validated during… |
CVE-2022-4429 | Medium | 5.3 | 2023-01-10 | Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issu… |
CVE-2022-4294 | High | 7.1 | 2023-01-10 | Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may… |
CVE-2022-48251 | High | 7.5 | 2023-01-10 | The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. NOTE: the vendor reportedly offe… |
CVE-2022-4497 | Medium | 5.4 | 2023-01-09 | The Jetpack CRM WordPress plugin before 5.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could… |
CVE-2022-4491 | Medium | 5.4 | 2023-01-09 | The WP-Table Reloaded WordPress plugin through 1.9.4 does not validate and escapes some of its shortcode attributes before outputting them back in the page, wh… |
CVE-2022-4479 | Medium | 5.4 | 2023-01-09 | The Table of Contents Plus WordPress plugin before 2212 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-4468 | Medium | 5.4 | 2023-01-09 | The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which… |
CVE-2022-4426 | Medium | 4.3 | 2023-01-09 | The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the optio… |
CVE-2022-4394 | Medium | 5.4 | 2023-01-09 | The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perfo… |
CVE-2022-4393 | Medium | 5.4 | 2023-01-09 | The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as… |
CVE-2022-4392 | Medium | 5.4 | 2023-01-09 | The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contr… |
CVE-2022-4391 | Medium | 5.4 | 2023-01-09 | The Vision Interactive For WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to pe… |
CVE-2022-4374 | Medium | 6.1 | 2023-01-09 | The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected… |
CVE-2022-4368 | Medium | 6.1 | 2023-01-09 | The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot h… |
CVE-2022-4325 | Medium | 6.1 | 2023-01-09 | The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle… |
CVE-2022-4310 | Medium | 6.1 | 2023-01-09 | The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to… |
CVE-2022-4301 | Medium | 6.1 | 2023-01-09 | The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2022-4196 | Medium | 4.8 | 2023-01-09 | The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to… |
CVE-2022-4103 | Medium | 4.3 | 2023-01-09 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the po… |
CVE-2022-4102 | Low | 3.1 | 2023-01-09 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the pos… |
CVE-2022-4043 | High | 7.2 | 2023-01-09 | The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as adm… |
CVE-2022-46603 | Medium | 6.1 | 2023-01-09 | An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file. |
CVE-2022-3923 | Medium | 4.3 | 2023-01-09 | The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which co… |
CVE-2022-3855 | Medium | 4.8 | 2023-01-09 | The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2022-3679 | High | 8.8 | 2023-01-09 | The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issue… |
CVE-2022-3417 | High | 8.8 | 2023-01-09 | The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user… |
CVE-2022-3416 | High | 7.2 | 2023-01-09 | The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary fi… |
CVE-2022-3343 | Low | 3.5 | 2023-01-09 | The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tries to validate tha… |
CVE-2022-43973 | High | 7.2 | 2023-01-09 | An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within t… |
CVE-2022-43972 | Medium | 6.5 | 2023-01-09 | A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A null pointer dereference in the… |
CVE-2022-43971 | High | 7.2 | 2023-01-09 | An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP functi… |
CVE-2022-43970 | High | 7.2 | 2023-01-09 | A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A stack-based buffer overflow in the Start_… |
CVE-2022-36930 | High | 8.8 | 2023-01-09 | Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vuln… |
CVE-2022-36929 | High | 7.8 | 2023-01-09 | The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulner… |
CVE-2022-36928 | Medium | 6.1 | 2023-01-09 | Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to… |