2022 CVEs (page 67)
Page 67 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4256 | Medium | 4.8 | 2023-01-02 | The All-in-One Addons for Elementor WordPress plugin before 2.4.4 does not sanitise and escape some of its settings, which could allow high privilege users suc… |
CVE-2022-4237 | High | 8.8 | 2023-01-02 | The Welcart e-Commerce WordPress plugin before 2.8.6 does not validate user input before using it in file_exist() functions via various AJAX actions available… |
CVE-2022-4236 | Medium | 6.5 | 2023-01-02 | The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file via an AJAX action available… |
CVE-2022-4200 | Medium | 4.8 | 2023-01-02 | The Login with Cognito WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin t… |
CVE-2022-4198 | Medium | 4.8 | 2023-01-02 | The WP Social Sharing WordPress plugin through 2.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2022-4142 | Medium | 4.8 | 2023-01-02 | The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before out… |
CVE-2022-4140 | High | 7.5 | 2023-01-02 | The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenti… |
CVE-2022-4119 | Medium | 4.8 | 2023-01-02 | The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users su… |
CVE-2022-4114 | Medium | 5.4 | 2023-01-02 | The Superio WordPress theme does not sanitise and escape some parameters, which could allow users with a role as low as a subscriber to perform Cross-Site Scri… |
CVE-2022-4109 | Low | 2.7 | 2023-01-02 | The Wholesale Market for WooCommerce WordPress plugin before 2.0.0 does not validate user input against path traversal attacks, allowing high privilege users s… |
CVE-2022-4099 | Critical | 9.8 | 2023-01-02 | The Joy Of Text Lite WordPress plugin before 2.3.1 does not properly sanitise and escape some parameters before using them in SQL statements accessible to unau… |
CVE-2022-4059 | Critical | 9.8 | 2023-01-02 | The Cryptocurrency Widgets Pack WordPress plugin before 2.0 does not sanitise and escape some parameter before using it in a SQL statement via an AJAX action a… |
CVE-2022-4057 | Medium | 5.3 | 2023-01-02 | The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs. |
CVE-2022-4049 | Critical | 9.8 | 2023-01-02 | The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection explo… |
CVE-2022-3994 | Medium | 4.3 | 2023-01-02 | The Authenticator WordPress plugin before 1.3.1 does not prevent subscribers from updating a site's feed access token, which may deny other users access to the… |
CVE-2022-3936 | Medium | 4.8 | 2023-01-02 | The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to pe… |
CVE-2022-3911 | High | 8.8 | 2023-01-02 | The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belon… |
CVE-2022-3860 | High | 8.8 | 2023-01-02 | The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, l… |
CVE-2022-3241 | Critical | 9.8 | 2023-01-02 | The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX acti… |
CVE-2022-48197 | Medium | 6.1 | 2023-01-02 | Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript l… |
CVE-2022-42475 | Critical | 9.8 | 2023-01-02 | A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.0 through 6.2.11, 6… |
CVE-2022-47634 | High | 8.1 | 2023-01-01 | M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access and manipulate archive data via certain H… |
CVE-2022-45213 | Medium | 5.3 | 2023-01-01 | perfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL. |
CVE-2022-45027 | Medium | 5.3 | 2023-01-01 | perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address. |
CVE-2022-40711 | Medium | 4.8 | 2023-01-01 | PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. A user with the RA Administrator role can inject an XSS payload to target higher-… |
CVE-2022-37787 | Medium | 6.1 | 2023-01-01 | An issue was discovered in WeCube platform 3.2.2. A DOM XSS vulnerability has been found on the plugin database execution page. |
CVE-2022-37786 | Medium | 6.3 | 2023-01-01 | An issue was discovered in WeCube Platform 3.2.2. There are multiple CSV injection issues: the [Home / Admin / Resources] page, the [Home / Admin / System Para… |
CVE-2022-37785 | High | 7.5 | 2023-01-01 | An issue was discovered in WeCube Platform 3.2.2. Cleartext passwords are displayed in the configuration for terminal plugins. |
CVE-2022-34324 | High | 8.8 | 2023-01-01 | Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment… |
CVE-2022-34323 | Medium | 5.4 | 2023-01-01 | Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context of other users' bro… |
CVE-2022-34322 | Critical | 9.0 | 2023-01-01 | Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the context of users' browse… |
CVE-2022-48198 | Critical | 9.8 | 2023-01-01 | The ntpd_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS) allows attackers, who control the source code of a different node… |
CVE-2022-47952 | Low | 3.3 | 2023-01-01 | lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree… |
CVE-2022-4868 | Medium | 4.3 | 2022-12-31 | Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-4867 | Medium | 4.3 | 2022-12-31 | Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-4866 | Critical | 9.0 | 2022-12-31 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4865 | Critical | 9.0 | 2022-12-31 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-48195 | Critical | 9.8 | 2022-12-31 | An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for chan… |
CVE-2022-4864 | Medium | 5.4 | 2022-12-30 | Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. |
CVE-2022-42270 | High | 7.8 | 2022-12-30 | NVIDIA distributions of Linux contain a vulnerability in nvdla_emu_task_submit, where unvalidated input may allow a local attacker to cause stack-based buffer… |
CVE-2022-42269 | High | 7.9 | 2022-12-30 | NVIDIA Trusted OS contains a vulnerability in an SMC call handler, where failure to validate untrusted input may allow a highly privileged local attacker to ca… |
CVE-2022-42267 | High | 7.0 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability where a regular user can cause an out-of-bounds read, which may lead to code execution, denial o… |
CVE-2022-42266 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where an unprivileged regular… |
CVE-2022-42265 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure… |
CVE-2022-42264 | High | 7.1 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause the use of an out-of-range… |
CVE-2022-42263 | High | 7.1 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an Integer overflow may lead to denial of service or infor… |
CVE-2022-42262 | High | 7.1 | 2022-12-30 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun… |
CVE-2022-42261 | High | 7.8 | 2022-12-30 | NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where an input index is not validated, which may lead to buffer overrun… |
CVE-2022-42260 | High | 7.8 | 2022-12-30 | NVIDIA vGPU Display Driver for Linux guest contains a vulnerability in a D-Bus configuration file, where an unauthorized user in the guest VM can impact protec… |
CVE-2022-42259 | Medium | 4.4 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service. |
CVE-2022-42258 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to denial of service, dat… |
CVE-2022-42257 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow may lead to information disclosure… |
CVE-2022-42256 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an integer overflow in index validation may lead to de… |
CVE-2022-42255 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of se… |
CVE-2022-42254 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of se… |
CVE-2022-34684 | Medium | 5.3 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an off-by-one error may lead to data tampering or info… |
CVE-2022-34683 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a null-pointer derefere… |
CVE-2022-34682 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a null-pointer dereference… |
CVE-2022-34681 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler, where improper input validation of a display-re… |
CVE-2022-34680 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an integer truncation can lead to an out-of-bounds read, w… |
CVE-2022-34679 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unhandled return value can lead to a null-pointer deref… |
CVE-2022-34678 | Medium | 6.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause a null-pointer derefere… |
CVE-2022-34677 | Medium | 5.5 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause an integer to be tr… |
CVE-2022-34676 | High | 7.1 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds read may lead to denial of service, infor… |
CVE-2022-34675 | Medium | 5.5 | 2022-12-30 | NVIDIA Display Driver for Linux contains a vulnerability in the Virtual GPU Manager, where it does not check the return value from a null-pointer dereference… |
CVE-2022-34674 | Medium | 6.8 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a helper function maps more physical pages than were reque… |
CVE-2022-34673 | Medium | 4.4 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of se… |
CVE-2022-34672 | High | 7.8 | 2022-12-30 | NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user can compromise the security of the softwar… |
CVE-2022-34671 | High | 8.5 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user-mode layer, where an unprivileged user can cause an out-of-bounds write, which may l… |
CVE-2022-34670 | High | 7.8 | 2022-12-30 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors w… |
CVE-2022-34669 | High | 8.8 | 2022-12-30 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or… |
CVE-2022-47128 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet. |
CVE-2022-47127 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd parameter at /goform/WifiBasicSet. |
CVE-2022-47126 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet. |
CVE-2022-47125 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasicSet. |
CVE-2022-47124 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey4 parameter at /goform/WifiBasicSet. |
CVE-2022-47123 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey3 parameter at /goform/WifiBasicSet. |
CVE-2022-47122 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd_5g parameter at /goform/WifiBasicSet. |
CVE-2022-47121 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey parameter at /goform/WifiBasicSet. |
CVE-2022-47120 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet. |
CVE-2022-47119 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet. |
CVE-2022-47118 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet. |
CVE-2022-47117 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security parameter at /goform/WifiBasicSet. |
CVE-2022-47116 | High | 7.5 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the SYSPS parameter at /goform/SysToolChangePwd. |
CVE-2022-47115 | Critical | 9.8 | 2022-12-30 | Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet. |
CVE-2022-46601 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setbg_num parameter in the icp_setbg_img (sub_41DD68) function. |
CVE-2022-46600 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin_24g function. |
CVE-2022-46599 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setlogo_num parameter in the icp_setlogo_img (sub_41DBF4) function. |
CVE-2022-46598 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin… |
CVE-2022-46597 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) fu… |
CVE-2022-46596 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the del_num parameter in the icp_delete_img (sub_41DEDC) function. |
CVE-2022-46594 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the update_file_name parameter in the auto_up_fw (sub_420A04) function. |
CVE-2022-46593 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the do_sta_enrollee_wifi function. |
CVE-2022-46592 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the set_sta_enrollee_pin_5g function. |
CVE-2022-46591 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reject_url parameter in the reject (sub_41BD60) function. |
CVE-2022-46590 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstat_rsname parameter in the tools_netstat (sub_41E730) function. |
CVE-2022-46589 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstat_option parameter in the tools_netstat (sub_41E730) function. |
CVE-2022-46588 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) function. |
CVE-2022-46586 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the qcawifi.wifi%d_vap%d.maclist parameter in the kick_ban_wifi_mac_allow (sub_415B00)… |
CVE-2022-46585 | Critical | 9.8 | 2022-12-30 | TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the REMOTE_USER parameter in the get_access (sub_45AC2C) function. |