2022 CVEs (page 64)
Page 64 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4310 | Medium | 6.1 | 2023-01-09 | The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to… |
CVE-2022-4301 | Medium | 6.1 | 2023-01-09 | The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected C… |
CVE-2022-4196 | Medium | 4.8 | 2023-01-09 | The Multi Step Form WordPress plugin before 1.7.8 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to… |
CVE-2022-4103 | Medium | 4.3 | 2023-01-09 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the po… |
CVE-2022-4102 | Low | 3.1 | 2023-01-09 | The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the pos… |
CVE-2022-4043 | High | 7.2 | 2023-01-09 | The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as adm… |
CVE-2022-46603 | Medium | 6.1 | 2023-01-09 | An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file. |
CVE-2022-3923 | Medium | 4.3 | 2023-01-09 | The ActiveCampaign for WooCommerce WordPress plugin before 1.9.8 does not have authorisation check when cleaning up its error logs via an AJAX action, which co… |
CVE-2022-3855 | Medium | 4.8 | 2023-01-09 | The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2022-3679 | High | 8.8 | 2023-01-09 | The Starter Templates by Kadence WP WordPress plugin before 1.2.17 unserialises the content of an imported file, which could lead to PHP object injection issue… |
CVE-2022-3417 | High | 8.8 | 2023-01-09 | The WPtouch WordPress plugin before 4.3.45 unserialises the content of an imported settings file, which could lead to PHP object injections issues when an user… |
CVE-2022-3416 | High | 7.2 | 2023-01-09 | The WPtouch WordPress plugin before 4.3.45 does not properly validate images to be uploaded, allowing high privilege users such as admin to upload arbitrary fi… |
CVE-2022-3343 | Low | 3.5 | 2023-01-09 | The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tries to validate tha… |
CVE-2022-43973 | High | 7.2 | 2023-01-09 | An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within t… |
CVE-2022-43972 | Medium | 6.5 | 2023-01-09 | A null pointer dereference vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A null pointer dereference in the… |
CVE-2022-43971 | High | 7.2 | 2023-01-09 | An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP functi… |
CVE-2022-43970 | High | 7.2 | 2023-01-09 | A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A stack-based buffer overflow in the Start_… |
CVE-2022-36930 | High | 8.8 | 2023-01-09 | Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vuln… |
CVE-2022-36929 | High | 7.8 | 2023-01-09 | The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulner… |
CVE-2022-36928 | Medium | 6.1 | 2023-01-09 | Zoom for Android clients before version 5.13.0 contain a path traversal vulnerability. A third party app could exploit this vulnerability to read and write to… |
CVE-2022-36927 | High | 8.8 | 2023-01-09 | Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerabi… |
CVE-2022-36926 | High | 8.8 | 2023-01-09 | Zoom Rooms for macOS clients before version 5.11.3 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vulnerabi… |
CVE-2022-36925 | Medium | 4.4 | 2023-01-09 | Zoom Rooms for macOS clients before version 5.11.4 contain an insecure key generation mechanism. The encryption key used for IPC between the Zoom Rooms daemon… |
CVE-2022-4884 | Low | 3.5 | 2023-01-09 | Path-Traversal in MKP storing in Tribe29 Checkmk <=2.0.0p32 and <= 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious m… |
CVE-2022-47790 | Critical | 9.8 | 2023-01-09 | Sourcecodester Dynamic Transaction Queuing System v1.0 is vulnerable to SQL Injection via /queuing/index.php?page=display&id=. |
CVE-2022-46258 | Medium | 6.5 | 2023-01-09 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository-scoped token with read/write access to modify Act… |
CVE-2022-23509 | High | 7.3 | 2023-01-09 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. GitOps run has a l… |
CVE-2022-23508 | High | 8.8 | 2023-01-09 | Weave GitOps is a simple open source developer platform for people who want cloud native applications, without needing Kubernetes expertise. A vulnerability i… |
CVE-2022-46769 | Medium | 5.4 | 2023-01-09 | An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may all… |
CVE-2022-2196 | Medium | 5.8 | 2023-01-09 | A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 th… |
CVE-2022-4882 | Low | 2.6 | 2023-01-09 | A vulnerability was found in kaltura mwEmbed up to 2.91. It has been rated as problematic. Affected by this issue is some unknown functionality of the file mod… |
CVE-2022-43974 | High | 8.1 | 2023-01-09 | MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13. A remote attacker might be able to send a crafted TLS Message to cause a buffer… |
CVE-2022-40520 | High | 8.4 | 2023-01-09 | Memory corruption due to stack-based buffer overflow in Core |
CVE-2022-40519 | Medium | 6.8 | 2023-01-09 | Information disclosure due to buffer overread in Core |
CVE-2022-40518 | Medium | 6.8 | 2023-01-09 | Information disclosure due to buffer overread in Core |
CVE-2022-40517 | High | 8.4 | 2023-01-09 | Memory corruption in core due to stack-based buffer overflow |
CVE-2022-40516 | High | 8.4 | 2023-01-09 | Memory corruption in Core due to stack-based buffer overflow. |
CVE-2022-35281 | Medium | 5.5 | 2023-01-09 | IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV inje… |
CVE-2022-33300 | High | 8.4 | 2023-01-09 | Memory corruption in Automotive Android OS due to improper input validation. |
CVE-2022-33299 | High | 7.5 | 2023-01-09 | Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data. |
CVE-2022-33290 | High | 7.5 | 2023-01-09 | Transient DOS in Bluetooth HOST due to null pointer dereference when a mismatched argument is passed. |
CVE-2022-33286 | High | 7.5 | 2023-01-09 | Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames. |
CVE-2022-33285 | High | 7.5 | 2023-01-09 | Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames. |
CVE-2022-33284 | High | 8.2 | 2023-01-09 | Information disclosure due to buffer over-read in WLAN while parsing BTM action frame. |
CVE-2022-33283 | High | 8.2 | 2023-01-09 | Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check. |
CVE-2022-33276 | High | 8.4 | 2023-01-09 | Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command. |
CVE-2022-33274 | High | 8.4 | 2023-01-09 | Memory corruption in android core due to improper validation of array index while returning feature ids after license authentication. |
CVE-2022-33266 | Medium | 5.9 | 2023-01-09 | Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content. |
CVE-2022-33265 | High | 7.3 | 2023-01-09 | Memory corruption due to information exposure in Powerline Communication Firmware while sending different MMEs from a single, unassociated device. |
CVE-2022-33255 | High | 8.2 | 2023-01-09 | Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device. |
CVE-2022-33253 | High | 7.5 | 2023-01-09 | Transient DOS due to buffer over-read in WLAN while parsing corrupted NAN frames. |
CVE-2022-33252 | High | 8.2 | 2023-01-09 | Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame. |
CVE-2022-33219 | Critical | 9.3 | 2023-01-09 | Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer. |
CVE-2022-33218 | High | 8.2 | 2023-01-09 | Memory corruption in Automotive due to improper input validation. |
CVE-2022-25746 | High | 8.1 | 2023-01-09 | Memory corruption in kernel due to missing checks when updating the access rights of a memextent mapping. |
CVE-2022-25725 | Medium | 6.2 | 2023-01-09 | Denial of service in MODEM due to improper pointer handling |
CVE-2022-25722 | Medium | 6.0 | 2023-01-09 | Information exposure in DSP services due to improper handling of freeing memory |
CVE-2022-25721 | Medium | 6.7 | 2023-01-09 | Memory corruption in video driver due to type confusion error during video playback |
CVE-2022-25717 | Medium | 6.7 | 2023-01-09 | Memory corruption in display due to double free while allocating frame buffer memory |
CVE-2022-25716 | Medium | 6.7 | 2023-01-09 | Memory corruption in Multimedia Framework due to unsafe access to the data members |
CVE-2022-25715 | Medium | 6.7 | 2023-01-09 | Memory corruption in display driver due to incorrect type casting while accessing the fence structure fields |
CVE-2022-22470 | Medium | 4.1 | 2023-01-09 | IBM Security Verify Governance 10.0 stores user credentials in plain clear text which can be read by a local user. IBM X-Force ID: 225232. |
CVE-2022-22088 | Critical | 9.8 | 2023-01-09 | Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote |
CVE-2022-22079 | Medium | 4.6 | 2023-01-09 | Denial of service while processing fastboot flash command on mmc due to buffer over read |
CVE-2022-25890 | High | 7.4 | 2023-01-09 | All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization. |
CVE-2022-45126 | Medium | 4.0 | 2023-01-09 | Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime. 4 bytes p… |
CVE-2022-43662 | Medium | 4.0 | 2023-01-09 | Kernel subsystem within OpenHarmony-v3.1.4 and prior versions in kernel_liteos_a has a kernel stack overflow vulnerability when call SysTimerGettime. 4 bytes p… |
CVE-2022-0668 | Medium | 5.3 | 2023-01-08 | JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by a… |
CVE-2022-4881 | Medium | 4.3 | 2023-01-08 | A vulnerability was found in CapsAdmin PAC3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lua/pac3/core/s… |
CVE-2022-2666 | Medium | 6.3 | 2023-01-07 | A vulnerability has been found in SourceCodester Loan Management System and classified as critical. This vulnerability affects unknown code of the file login.p… |
CVE-2022-1102 | Medium | 4.3 | 2023-01-07 | A vulnerability classified as problematic has been found in SourceCodester Royale Event Management System 1.0. Affected is an unknown function of the file /roy… |
CVE-2022-1101 | High | 7.3 | 2023-01-07 | A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unknown processing of th… |
CVE-2022-4880 | Medium | 5.5 | 2023-01-07 | A vulnerability was found in stakira OpenUtau. It has been classified as critical. This affects the function VoicebankInstaller of the file OpenUtau.Core/Class… |
CVE-2022-45913 | Medium | 6.1 | 2023-01-06 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur via one of attributes in webmail URLs to execute arbitrary JavaScript code, leading to… |
CVE-2022-45911 | Medium | 6.1 | 2023-01-06 | An issue was discovered in Zimbra Collaboration (ZCS) 9.0. XSS can occur on the Classic UI login page by injecting arbitrary JavaScript code in the username fi… |
CVE-2022-44939 | High | 7.8 | 2023-01-06 | Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows… |
CVE-2022-41613 | High | 7.8 | 2023-01-06 | Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to an Out-of-Bounds Read when when parsing DGN files, which may allow an a… |
CVE-2022-40201 | High | 7.8 | 2023-01-06 | Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to a Stack-Based Buffer Overflow when a malformed design (DGN) file is par… |
CVE-2022-2484 | High | 8.4 | 2023-01-06 | The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firmware. This could r… |
CVE-2022-2483 | High | 8.4 | 2023-01-06 | The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification signature. If an at… |
CVE-2022-2482 | High | 8.4 | 2023-01-06 | A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place a script on the fil… |
CVE-2022-47976 | High | 7.5 | 2023-01-06 | The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may… |
CVE-2022-47975 | High | 7.5 | 2023-01-06 | The DUBAI module has a double free vulnerability. Successful exploitation of this vulnerability may affect system availability. |
CVE-2022-47974 | Medium | 6.5 | 2023-01-06 | The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the Bluetooth process to re… |
CVE-2022-46762 | High | 7.5 | 2023-01-06 | The memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect data confidentiality. |
CVE-2022-46761 | High | 7.5 | 2023-01-06 | The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may cause malicious hidin… |
CVE-2022-39073 | Critical | 9.8 | 2023-01-06 | There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to ex… |
CVE-2022-39072 | Medium | 5.4 | 2023-01-06 | There is a SQL injection vulnerability in Some ZTE Mobile Internet products. Due to insufficient validation of the input parameters of the SNTP interface, an a… |
CVE-2022-44149 | High | 8.8 | 2023-01-06 | The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host fiel… |
CVE-2022-4879 | Medium | 4.6 | 2023-01-06 | A vulnerability was found in Forged Alliance Forever up to 3746. It has been declared as critical. Affected by this vulnerability is an unknown functionality o… |
CVE-2022-4878 | Medium | 5.5 | 2023-01-06 | A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of th… |
CVE-2022-45935 | Medium | 5.5 | 2023-01-06 | Usage of temporary files with insecure permissions by the Apache James server allows an attacker with local access to access private user data in transit. Vu… |
CVE-2022-45787 | Medium | 5.5 | 2023-01-06 | Unproper laxist permissions on the temporary files used by MIME4J TempFileStorageProvider may lead to information disclosure to other local users. This issue a… |
CVE-2022-25923 | High | 7.4 | 2023-01-06 | Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper user-input sanitizat… |
CVE-2022-42979 | High | 8.8 | 2023-01-06 | Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take over an account via a… |
CVE-2022-44870 | Medium | 6.1 | 2023-01-06 | A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2022-40049 | High | 7.5 | 2023-01-06 | SQL injection vulnerability in sourcecodester Theme Park Ticketing System 1.0 allows remote attackers to view sensitive information via the id parameter to the… |
CVE-2022-44877 | Critical | 9.8 | 2023-01-05 | login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metac… |
CVE-2022-3929 | High | 8.3 | 2023-01-05 | Communication between the client and the server application of the affected products is partially done using CORBA (Common Object Request Broker Architecture)… |
CVE-2022-3928 | High | 7.1 | 2023-01-05 | Hardcoded credential is found in affected products' message queue. An attacker that manages to exploit this vulnerability will be able to access data to the i… |