2022 CVEs (page 67)
Page 67 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4372 | High | 7.2 | 2023-01-02 | The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection… |
CVE-2022-4371 | High | 7.2 | 2023-01-02 | The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection… |
CVE-2022-4370 | High | 7.2 | 2023-01-02 | The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL inj… |
CVE-2022-4369 | Medium | 6.1 | 2023-01-02 | The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Refle… |
CVE-2022-4362 | Medium | 5.4 | 2023-01-02 | The Popup Maker WordPress plugin before 1.16.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as cont… |
CVE-2022-4360 | High | 7.2 | 2023-01-02 | The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL in… |
CVE-2022-4359 | High | 7.2 | 2023-01-02 | The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL in… |
CVE-2022-4358 | High | 7.2 | 2023-01-02 | The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL in… |
CVE-2022-4357 | Critical | 9.8 | 2023-01-02 | The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available… |
CVE-2022-4356 | High | 7.2 | 2023-01-02 | The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection… |
CVE-2022-4355 | High | 7.2 | 2023-01-02 | The LetsRecover WordPress plugin before 1.2.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection… |
CVE-2022-4352 | High | 7.2 | 2023-01-02 | The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injecti… |
CVE-2022-4351 | High | 7.2 | 2023-01-02 | The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injecti… |
CVE-2022-4340 | Medium | 5.3 | 2023-01-02 | The BookingPress WordPress plugin before 1.0.31 suffers from an Insecure Direct Object Reference (IDOR) vulnerability in it's thank you page, allowing any visi… |
CVE-2022-4329 | Medium | 6.1 | 2023-01-02 | The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to… |
CVE-2022-4324 | High | 7.2 | 2023-01-02 | The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a h… |
CVE-2022-4302 | High | 7.2 | 2023-01-02 | The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perf… |
CVE-2022-4298 | Critical | 9.8 | 2023-01-02 | The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, all… |
CVE-2022-4297 | Critical | 9.8 | 2023-01-02 | The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to… |
CVE-2022-4260 | Medium | 4.8 | 2023-01-02 | The WP-Ban WordPress plugin before 1.69.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2022-4256 | Medium | 4.8 | 2023-01-02 | The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2022-4237 | High | 8.8 | 2023-01-02 | The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available… |
CVE-2022-4236 | Medium | 6.5 | 2023-01-02 | The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available… |
CVE-2022-4200 | Medium | 4.8 | 2023-01-02 | The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2022-4198 | Medium | 4.8 | 2023-01-02 | The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2022-4142 | Medium | 4.8 | 2023-01-02 | The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before out… |
CVE-2022-4140 | High | 7.5 | 2023-01-02 | The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenti… |
CVE-2022-4119 | Medium | 4.8 | 2023-01-02 | The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users su… |
CVE-2022-4114 | Medium | 5.4 | 2023-01-02 | The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scri… |
CVE-2022-4109 | Low | 2.7 | 2023-01-02 | The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users s… |
CVE-2022-4099 | Critical | 9.8 | 2023-01-02 | The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unau… |
CVE-2022-4059 | Critical | 9.8 | 2023-01-02 | The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action a… |
CVE-2022-4057 | Medium | 5.3 | 2023-01-02 | The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs. |
CVE-2022-4049 | Critical | 9.8 | 2023-01-02 | The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection explo… |
CVE-2022-3994 | Medium | 4.3 | 2023-01-02 | The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other users access to the… |
CVE-2022-3936 | Medium | 4.8 | 2023-01-02 | The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to pe… |
CVE-2022-3911 | High | 8.8 | 2023-01-02 | The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belon… |
CVE-2022-3860 | High | 8.8 | 2023-01-02 | The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, l… |
CVE-2022-3241 | Critical | 9.8 | 2023-01-02 | The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX acti… |
CVE-2022-48197 | Medium | 6.1 | 2023-01-02 | Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript l… |
CVE-2022-42475 | Critical | 9.8 | 2023-01-02 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6… |
CVE-2022-47634 | High | 8.1 | 2023-01-01 | M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access and manipulate archive data via certain H… |
CVE-2022-45213 | Medium | 5.3 | 2023-01-01 | perfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL. |
CVE-2022-45027 | Medium | 5.3 | 2023-01-01 | perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address. |
CVE-2022-40711 | Medium | 4.8 | 2023-01-01 | PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-… |
CVE-2022-37787 | Medium | 6.1 | 2023-01-01 | An issue was discovered in WeCube platform 3.2.2. A DOM XSS vulnerability has been found on the plugin database execution page. |
CVE-2022-37786 | Medium | 6.3 | 2023-01-01 | An issue was discovered in WeCube Platform 3.2.2. There are multiple CSV injection issues: the [Home / Admin / Resources] page, the [Home / Admin / System Para… |
CVE-2022-37785 | High | 7.5 | 2023-01-01 | An issue was discovered in WeCube Platform 3.2.2. Cleartext passwords are displayed in the configuration for terminal plugins. |
CVE-2022-34324 | High | 8.8 | 2023-01-01 | Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment… |
CVE-2022-34323 | Medium | 5.4 | 2023-01-01 | Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other users' bro… |
CVE-2022-34322 | Critical | 9.0 | 2023-01-01 | Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the context of users' browse… |
CVE-2022-48198 | Critical | 9.8 | 2023-01-01 | The ntpd_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS) allows attackers, who control the source code of a different node… |
CVE-2022-47952 | Low | 3.3 | 2023-01-01 | lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree… |
CVE-2022-4868 | Medium | 4.3 | 2022-12-31 | Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-4867 | Medium | 4.3 | 2022-12-31 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-4866 | Critical | 9.0 | 2022-12-31 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4865 | Critical | 9.0 | 2022-12-31 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-48195 | Critical | 9.8 | 2022-12-31 | An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for chan… |
CVE-2022-4864 | Medium | 5.4 | 2022-12-30 | Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-42270 | High | 7.8 | 2022-12-30 | NVIDIA distributions of Linux contain a vulnerability in nvdla_emu_task_submit, where unvalidated input may allow a local attacker to cause stack-based buffer… |
CVE-2022-42269 | High | 7.9 | 2022-12-30 | NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate untrusted input may allow a highly privileged local attacker to ca… |
CVE-2022-42267 | High | 7.0 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability where a regular user can cause an out-of-bounds read, which may lead to code execution, denial o… |
CVE-2022-42266 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivileged regular… |
CVE-2022-42265 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure… |
CVE-2022-42264 | High | 7.1 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause the use of an out-of-range… |
CVE-2022-42263 | High | 7.1 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an Integer overflow may lead to denial of service or infor… |
CVE-2022-42262 | High | 7.1 | 2022-12-30 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun… |
CVE-2022-42261 | High | 7.8 | 2022-12-30 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun… |
CVE-2022-42260 | High | 7.8 | 2022-12-30 | NVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VM can impact protec… |
CVE-2022-42259 | Medium | 4.4 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service. |
CVE-2022-42258 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service, dat… |
CVE-2022-42257 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure… |
CVE-2022-42256 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow in index validation may lead to de… |
CVE-2022-42255 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of se… |
CVE-2022-42254 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of se… |
CVE-2022-34684 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an off-by-one error may lead to data tampering or info… |
CVE-2022-34683 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a null-pointer derefere… |
CVE-2022-34682 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a null-pointer dereference… |
CVE-2022-34681 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler, where improper input validation of a display-re… |
CVE-2022-34680 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an integer truncation can lead to an out-of-bounds read, w… |
CVE-2022-34679 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unhandled return value can lead to a null-pointer deref… |
CVE-2022-34678 | Medium | 6.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause a null-pointer derefere… |
CVE-2022-34677 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause an integer to be tr… |
CVE-2022-34676 | High | 7.1 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds read may lead to denial of service, infor… |
CVE-2022-34675 | Medium | 5.5 | 2022-12-30 | NVIDIA Display Driver for Linux contains a vulnerability in the Virtual GPU Manager, where it does not check the return value from a null-pointer dereference… |
CVE-2022-34674 | Medium | 6.8 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a helper function maps more physical pages than were reque… |
CVE-2022-34673 | Medium | 4.4 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of se… |
CVE-2022-34672 | High | 7.8 | 2022-12-30 | NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user can compromise the security of the softwar… |
CVE-2022-34671 | High | 8.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user-mode layer, where an unprivileged user can cause an out-of-bounds write, which may l… |
CVE-2022-34670 | High | 7.8 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors w… |
CVE-2022-34669 | High | 8.8 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or… |
CVE-2022-47128 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet. |
CVE-2022-47127 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd parameter at /goform/WifiBasicSet. |
CVE-2022-47126 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet. |
CVE-2022-47125 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasicSet. |
CVE-2022-47124 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey4 parameter at /goform/WifiBasicSet. |
CVE-2022-47123 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey3 parameter at /goform/WifiBasicSet. |
CVE-2022-47122 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd_5g parameter at /goform/WifiBasicSet. |
CVE-2022-47121 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey parameter at /goform/WifiBasicSet. |
CVE-2022-47120 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet. |