2022 CVEs (page 66)
Page 66 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-39084 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39083 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39082 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-39081 | Medium | 6.7 | 2023-01-04 | In network service, there is a missing permission check. This could lead to local escalation of privilege with System execution privileges needed. |
CVE-2022-38684 | Medium | 5.5 | 2023-01-04 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privilege… |
CVE-2022-38683 | Medium | 5.5 | 2023-01-04 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privilege… |
CVE-2022-38682 | Medium | 5.5 | 2023-01-04 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privilege… |
CVE-2022-38678 | Medium | 5.5 | 2023-01-04 | In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privilege… |
CVE-2022-46081 | High | 7.5 | 2023-01-04 | In Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal information. NOTE: this… |
CVE-2022-42435 | Medium | 4.3 | 2023-01-04 | IBM Business Automation Workflow 18.0.0, 18.0.1, 18.0.2, 19.0.1, 19.0.2, 19.0.3, 20.0.1, 20.0.2, 20.0.3, 21.0.1, 21.0.2, 21.0.3, and 22.0.1 is vulnerable to c… |
CVE-2022-42710 | Medium | 5.4 | 2023-01-03 | Nice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are vulnerable to Stored Cross-… |
CVE-2022-38723 | High | 8.6 | 2023-01-03 | Gravitee API Management before 3.15.13 allows path traversal through HTML injection. |
CVE-2022-2967 | Medium | 6.5 | 2023-01-03 | Prosys OPC UA Simulation Server version prior to v5.3.0-64 and UA Modbus Server versions 1.4.18-5 and prior do not sufficiently protect credentials, which coul… |
CVE-2022-44036 | High | 7.2 | 2023-01-03 | In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for admins, leading to command execution. NOTE… |
CVE-2022-38627 | Critical | 9.8 | 2023-01-03 | Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerabilit… |
CVE-2022-36943 | High | 8.1 | 2023-01-03 | SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. SSZipArchive will… |
CVE-2022-32665 | Critical | 9.8 | 2023-01-03 | In Boa, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution… |
CVE-2022-32664 | High | 8.8 | 2023-01-03 | In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with User executio… |
CVE-2022-32659 | Medium | 6.7 | 2023-01-03 | In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution… |
CVE-2022-32658 | Medium | 6.7 | 2023-01-03 | In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution… |
CVE-2022-32657 | Medium | 6.7 | 2023-01-03 | In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution… |
CVE-2022-32653 | Medium | 6.7 | 2023-01-03 | In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32652 | Medium | 6.7 | 2023-01-03 | In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32651 | Medium | 6.7 | 2023-01-03 | In mtk-aie, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32650 | Medium | 6.7 | 2023-01-03 | In mtk-isp, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32649 | Medium | 6.7 | 2023-01-03 | In jpeg, there is a possible use after free due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. Use… |
CVE-2022-32648 | Medium | 6.4 | 2023-01-03 | In disp, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed… |
CVE-2022-32647 | Medium | 6.7 | 2023-01-03 | In ccu, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privil… |
CVE-2022-32646 | Medium | 6.7 | 2023-01-03 | In gpu drm, there is a possible stack overflow due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges… |
CVE-2022-32645 | Medium | 4.1 | 2023-01-03 | In vow, there is a possible information disclosure due to a race condition. This could lead to local information disclosure with System execution privileges ne… |
CVE-2022-32644 | Medium | 6.4 | 2023-01-03 | In vow, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32641 | Medium | 6.7 | 2023-01-03 | In meta wifi, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution priv… |
CVE-2022-32640 | Medium | 6.7 | 2023-01-03 | In meta wifi, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution pri… |
CVE-2022-32639 | Medium | 4.4 | 2023-01-03 | In watchdog, there is a possible out of bounds read due to a missing bounds check. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-32638 | Medium | 6.4 | 2023-01-03 | In isp, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges need… |
CVE-2022-32637 | Medium | 6.7 | 2023-01-03 | In hevc decoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2022-32636 | Medium | 6.7 | 2023-01-03 | In keyinstall, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-32635 | High | 7.8 | 2023-01-03 | In gps, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution pr… |
CVE-2022-32623 | Medium | 6.7 | 2023-01-03 | In mdp, there is a possible out of bounds write due to incorrect error handling. This could lead to local escalation of privilege with System execution privile… |
CVE-2022-23506 | Medium | 4.3 | 2023-01-03 | Spinnaker is an open source, multi-cloud continuous delivery platform for releasing software changes, and Spinnaker's Rosco microservice produces machine image… |
CVE-2022-45867 | High | 7.2 | 2023-01-03 | MyBB before 1.8.33 allows Directory Traversal. The Admin CP Languages module allows remote authenticated users, with high privileges, to achieve local file inc… |
CVE-2022-45143 | High | 7.5 | 2023-01-03 | The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 did not escape the type, message or description values. In some circ… |
CVE-2022-42471 | Medium | 5.4 | 2023-01-03 | An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 through 7.0.2, Forti… |
CVE-2022-41336 | Medium | 6.8 | 2023-01-03 | An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal versions 6.0.0 through 6.0.11 and all versions of 5.3, 5.2… |
CVE-2022-39947 | High | 8.8 | 2023-01-03 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.2, FortiADC version… |
CVE-2022-35845 | High | 7.8 | 2023-01-03 | Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiTester 7.1.0, 7.0 all vers… |
CVE-2022-38766 | High | 8.1 | 2023-01-03 | The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for… |
CVE-2022-4663 | Medium | 5.5 | 2023-01-03 | The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in versions up to, and… |
CVE-2022-4871 | Medium | 4.7 | 2023-01-03 | A vulnerability classified as problematic was found in ummmmm nflpick-em.com up to 2.2.x. This vulnerability affects the function _Load_Users of the file html/… |
CVE-2022-43931 | Critical | 10.0 | 2023-01-03 | Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote attackers to execu… |
CVE-2022-47908 | High | 7.8 | 2023-01-03 | Stack-based buffer overflow vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by… |
CVE-2022-47618 | Critical | 9.8 | 2023-01-03 | Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials. An unauthenticated remote attacker can use these credentials to log in adminis… |
CVE-2022-47317 | High | 7.8 | 2023-01-03 | Out-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a… |
CVE-2022-46360 | High | 7.8 | 2023-01-03 | Out-of-bounds read vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execut… |
CVE-2022-46309 | Medium | 6.5 | 2023-01-03 | Vitals ESP upload function has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to access arbitrary… |
CVE-2022-46306 | High | 8.8 | 2023-01-03 | ChangingTec ServiSign component has a path traversal vulnerability due to insufficient filtering for special characters in the DLL file path. An unauthenticate… |
CVE-2022-46305 | Medium | 6.5 | 2023-01-03 | ChangingTec ServiSign component has a path traversal vulnerability. An unauthenticated LAN attacker can exploit this vulnerability to bypass authentication and… |
CVE-2022-46304 | High | 8.8 | 2023-01-03 | ChangingTec ServiSign component has insufficient filtering for special characters in the connection response parameter. An unauthenticated remote attacker can… |
CVE-2022-43448 | High | 7.8 | 2023-01-03 | Out-of-bounds write vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execu… |
CVE-2022-43438 | High | 8.8 | 2023-01-03 | The Administrator function of EasyTest has an Incorrect Authorization vulnerability. A remote attacker authenticated as a general user can exploit this vulnera… |
CVE-2022-43437 | High | 8.8 | 2023-01-03 | The Download function’s parameter of EasyTest has insufficient validation for user input. A remote attacker authenticated as a general user can inject arbitrar… |
CVE-2022-43436 | High | 8.8 | 2023-01-03 | The File Upload function of EasyTest has insufficient filtering for special characters and file type. A remote attacker authenticated as a general user can upl… |
CVE-2022-41645 | High | 7.8 | 2023-01-03 | Out-of-bounds read vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a… |
CVE-2022-40740 | High | 7.2 | 2023-01-03 | Realtek GPON router has insufficient filtering for special characters. A remote attacker authenticated as an administrator can exploit this vulnerability to pe… |
CVE-2022-39042 | Critical | 9.8 | 2023-01-03 | aEnrich a+HRD has improper validation for login function. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and access… |
CVE-2022-39041 | Critical | 9.8 | 2023-01-03 | aEnrich a+HRD has insufficient user input validation for specific API parameter. An unauthenticated remote attacker can exploit this vulnerability to inject ar… |
CVE-2022-39040 | High | 7.5 | 2023-01-03 | aEnrich a+HRD log read function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication… |
CVE-2022-39039 | Critical | 9.8 | 2023-01-03 | aEnrich’s a+HRD has inadequate filtering for specific URL parameter. An unauthenticated remote attacker can exploit this vulnerability to send arbitrary HTTP(s… |
CVE-2022-3614 | Medium | 6.1 | 2023-01-03 | In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication checks and be redirec… |
CVE-2022-3460 | High | 7.5 | 2023-01-03 | In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. |
CVE-2022-4025 | Medium | 4.3 | 2023-01-02 | Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an iframe via a crafte… |
CVE-2022-3863 | Medium | 6.1 | 2023-01-02 | Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML p… |
CVE-2022-3842 | High | 7.5 | 2023-01-02 | Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to potentially exploit… |
CVE-2022-2743 | High | 8.8 | 2023-01-02 | Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in… |
CVE-2022-2742 | High | 8.8 | 2023-01-02 | Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specifi… |
CVE-2022-0801 | Medium | 6.1 | 2023-01-02 | Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via a crafted HTML page… |
CVE-2022-0337 | Medium | 6.5 | 2023-01-02 | Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive inf… |
CVE-2022-4417 | Medium | 5.3 | 2023-01-02 | The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is i… |
CVE-2022-4381 | Medium | 5.4 | 2023-01-02 | The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as cont… |
CVE-2022-4373 | High | 7.2 | 2023-01-02 | The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injecti… |
CVE-2022-4372 | High | 7.2 | 2023-01-02 | The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection… |
CVE-2022-4371 | High | 7.2 | 2023-01-02 | The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection… |
CVE-2022-4370 | High | 7.2 | 2023-01-02 | The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL inj… |
CVE-2022-4369 | Medium | 6.1 | 2023-01-02 | The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Refle… |
CVE-2022-4362 | Medium | 5.4 | 2023-01-02 | The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as cont… |
CVE-2022-4360 | High | 7.2 | 2023-01-02 | The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL in… |
CVE-2022-4359 | High | 7.2 | 2023-01-02 | The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL in… |
CVE-2022-4358 | High | 7.2 | 2023-01-02 | The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL in… |
CVE-2022-4357 | Critical | 9.8 | 2023-01-02 | The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available… |
CVE-2022-4356 | High | 7.2 | 2023-01-02 | The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection… |
CVE-2022-4355 | High | 7.2 | 2023-01-02 | The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection… |
CVE-2022-4352 | High | 7.2 | 2023-01-02 | The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injecti… |
CVE-2022-4351 | High | 7.2 | 2023-01-02 | The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injecti… |
CVE-2022-4340 | Medium | 5.3 | 2023-01-02 | The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visi… |
CVE-2022-4329 | Medium | 6.1 | 2023-01-02 | The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to… |
CVE-2022-4324 | High | 7.2 | 2023-01-02 | The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a h… |
CVE-2022-4302 | High | 7.2 | 2023-01-02 | The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perf… |
CVE-2022-4298 | Critical | 9.8 | 2023-01-02 | The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, all… |
CVE-2022-4297 | Critical | 9.8 | 2023-01-02 | The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to… |
CVE-2022-4260 | Medium | 4.8 | 2023-01-02 | The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |