2022 CVEs (page 69)
Page 69 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4796 | High | 8.1 | 2022-12-28 | Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-3922 | Medium | 4.8 | 2022-12-28 | The Broken Link Checker WordPress plugin before 1.11.20 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-46179 | Critical | 9.2 | 2022-12-28 | LiuOS is a small Python project meant to imitate the functions of a regular operating system. Version 0.1.0 and prior of LiuOS allow an attacker to set the GIT… |
CVE-2022-46174 | Medium | 4.2 | 2022-12-28 | efs-utils is a set of Utilities for Amazon Elastic File System (EFS). A potential race condition issue exists within the Amazon EFS mount helper in efs-utils v… |
CVE-2022-46173 | High | 7.2 | 2022-12-28 | Elrond-GO is a go implementation for the Elrond Network protocol. Versions prior to 1.3.50 are subject to a processing issue where nodes are affected when tryi… |
CVE-2022-46172 | Medium | 6.4 | 2022-12-28 | authentik is an open-source Identity provider focused on flexibility and versatility. In versions prior to 2022.10.4, and 2022.11.4, any authenticated user can… |
CVE-2022-3347 | High | 7.5 | 2022-12-28 | DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. Root… |
CVE-2022-3346 | Medium | 6.5 | 2022-12-28 | DNSSEC validation is not performed correctly. An attacker can cause this package to report successful validation for invalid, attacker-controlled records. The… |
CVE-2022-23555 | Critical | 9.4 | 2022-12-28 | authentik is an open-source Identity Provider focused on flexibility and versatility. Versions prior to 2022.11.4 and 2022.10.4 are vulnerable to Improper Auth… |
CVE-2022-4773 | Low | 2.5 | 2022-12-28 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the… |
CVE-2022-41967 | High | 7.0 | 2022-12-28 | Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (… |
CVE-2022-41966 | High | 8.2 | 2022-12-28 | XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow… |
CVE-2022-23544 | High | 7.2 | 2022-12-28 | MeterSphere is a one-stop open source continuous testing platform, covering test management, interface testing, UI testing and performance testing. Versions pr… |
CVE-2022-4772 | Medium | 4.5 | 2022-12-27 | A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.jav… |
CVE-2022-4768 | Medium | 6.3 | 2022-12-27 | A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of th… |
CVE-2022-46442 | Critical | 9.8 | 2022-12-27 | dedecms <=V5.7.102 is vulnerable to SQL Injection. In sys_ sql_ n query.php there are no restrictions on the sql query. |
CVE-2022-45963 | Critical | 9.8 | 2022-12-27 | h3c firewall <= 3.10 ESS6703 has a privilege bypass vulnerability. |
CVE-2022-45778 | Critical | 9.8 | 2022-12-27 | https://www.hillstonenet.com.cn/ Hillstone Firewall SG-6000 <= 5.0.4.0 is vulnerable to Incorrect Access Control. There is a permission bypass vulnerability in… |
CVE-2022-3064 | High | 7.5 | 2022-12-27 | Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory. |
CVE-2022-2584 | High | 7.5 | 2022-12-27 | The dag-pb codec can panic when decoding invalid blocks. |
CVE-2022-2583 | Low | 3.7 | 2022-12-27 | A race condition can cause incorrect HTTP request routing. |
CVE-2022-2582 | Medium | 4.3 | 2022-12-27 | The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plainte… |
CVE-2022-3156 | High | 7.8 | 2022-12-27 | A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software. Users are granted elevated permissions on certain prod… |
CVE-2022-47968 | Medium | 5.4 | 2022-12-27 | Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be trigg… |
CVE-2022-45434 | Medium | 5.9 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the firewall access contr… |
CVE-2022-45433 | Low | 3.7 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server. After bypassing the firewall access control policy… |
CVE-2022-45432 | Medium | 5.3 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall access control policy, by sending a speci… |
CVE-2022-45431 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sendi… |
CVE-2022-45430 | Low | 3.7 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access control policy, by sen… |
CVE-2022-45429 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL)… |
CVE-2022-45428 | Low | 2.7 | 2022-12-27 | Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by sending a specific cr… |
CVE-2022-45427 | High | 7.2 | 2022-12-27 | Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sending a specific craf… |
CVE-2022-45426 | Medium | 6.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific cr… |
CVE-2022-45425 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulner… |
CVE-2022-45424 | Medium | 5.3 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific… |
CVE-2022-45423 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending… |
CVE-2022-4767 | High | 7.5 | 2022-12-27 | Denial of Service in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4734 | High | 8.1 | 2022-12-27 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4733 | Medium | 4.8 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4732 | High | 7.2 | 2022-12-27 | Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-4730 | Low | 3.5 | 2022-12-27 | A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler… |
CVE-2022-4729 | Low | 3.5 | 2022-12-27 | A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The… |
CVE-2022-4728 | Low | 3.5 | 2022-12-27 | A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The mani… |
CVE-2022-4727 | Low | 3.5 | 2022-12-27 | A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of th… |
CVE-2022-4726 | Medium | 6.3 | 2022-12-27 | A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2022-4725 | Medium | 5.5 | 2022-12-27 | A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/mai… |
CVE-2022-4724 | Critical | 9.8 | 2022-12-27 | Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4723 | Medium | 6.5 | 2022-12-27 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4722 | High | 7.2 | 2022-12-27 | Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4721 | Medium | 5.4 | 2022-12-27 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4720 | Medium | 6.1 | 2022-12-27 | Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4719 | Critical | 9.8 | 2022-12-27 | Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4695 | Medium | 5.4 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4694 | Medium | 5.4 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4691 | Medium | 5.4 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4766 | Medium | 4.3 | 2022-12-27 | A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the compon… |
CVE-2022-4755 | Low | 3.5 | 2022-12-27 | A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.med… |
CVE-2022-4748 | Medium | 5.5 | 2022-12-27 | A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/… |
CVE-2022-46764 | Critical | 9.8 | 2022-12-27 | A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL com… |
CVE-2022-46763 | High | 8.8 | 2022-12-27 | A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database user to execute arbi… |
CVE-2022-36664 | Medium | 6.1 | 2022-12-26 | Password Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultURL parameter. |
CVE-2022-4268 | High | 7.2 | 2022-12-26 | The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploita… |
CVE-2022-4267 | Medium | 6.1 | 2022-12-26 | The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec… |
CVE-2022-4266 | Medium | 6.5 | 2022-12-26 | The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin… |
CVE-2022-4243 | Medium | 4.8 | 2022-12-26 | The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2022-4242 | Medium | 4.8 | 2022-12-26 | The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2022-4239 | Medium | 6.5 | 2022-12-26 | The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service… |
CVE-2022-4227 | Medium | 6.1 | 2022-12-26 | The Booster for WooCommerce WordPress plugin before 5.6.3, Booster Plus for WooCommerce WordPress plugin before 6.0.0, Booster Elite for WooCommerce WordPress… |
CVE-2022-4226 | Medium | 4.8 | 2022-12-26 | The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2022-4197 | Medium | 4.8 | 2022-12-26 | The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-4166 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before co… |
CVE-2022-4165 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before con… |
CVE-2022-4164 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_multiple_files_for_post POST pa… |
CVE-2022-4163 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_deactivate and cg_activate POST… |
CVE-2022-4162 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_row POST parameter before conca… |
CVE-2022-4161 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_start POST parameter befor… |
CVE-2022-4160 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_id POST parameter before c… |
CVE-2022-4159 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_id POST parameter before concat… |
CVE-2022-4158 | High | 7.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before co… |
CVE-2022-4157 | Medium | 4.9 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before… |
CVE-2022-4156 | High | 7.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before conc… |
CVE-2022-4155 | Medium | 4.9 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before co… |
CVE-2022-4154 | Medium | 4.9 | 2022-12-26 | The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-… |
CVE-2022-4153 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the upload[] POST parameter before con… |
CVE-2022-4152 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro WordPress plugin before 19.1.5 do not escape the option_id POST parameter before concat… |
CVE-2022-4151 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET parameter before con… |
CVE-2022-4150 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before co… |
CVE-2022-4120 | Critical | 9.8 | 2022-12-26 | The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP functio… |
CVE-2022-4117 | Critical | 9.8 | 2022-12-26 | The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated us… |
CVE-2022-4110 | Medium | 4.8 | 2022-12-26 | The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2022-4047 | Critical | 9.8 | 2022-12-26 | The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to… |
CVE-2022-4042 | Medium | 4.8 | 2022-12-26 | The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2022-3840 | Medium | 4.8 | 2022-12-26 | The Login for Google Apps WordPress plugin before 3.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-3835 | Medium | 4.8 | 2022-12-26 | The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2022-4742 | Medium | 6.3 | 2022-12-26 | A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js… |
CVE-2022-41767 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigne… |
CVE-2022-41765 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUserTextField exposes the existence of hidde… |
CVE-2022-30260 | High | 7.8 | 2022-12-26 | Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This a… |
CVE-2022-26969 | Critical | 9.8 | 2022-12-26 | In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. |
CVE-2022-26964 | High | 7.4 | 2022-12-26 | Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An err… |