2022 CVEs (page 69)
Page 69 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-2583 | Low | 3.7 | 2022-12-27 | A race condition can cause incorrect HTTP request routing. |
CVE-2022-2582 | Medium | 4.3 | 2022-12-27 | The AWS S3 Crypto SDK sends an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. This hash can be used to brute force the plainte… |
CVE-2022-3156 | High | 7.8 | 2022-12-27 | A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software. Users are granted elevated permissions on certain prod… |
CVE-2022-47968 | Medium | 5.4 | 2022-12-27 | Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be trigg… |
CVE-2022-45434 | Medium | 5.9 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated un-throttled ICMP requests on remote DSS Server. After bypassing the firewall access contr… |
CVE-2022-45433 | Low | 3.7 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated traceroute host from remote DSS Server. After bypassing the firewall access control policy… |
CVE-2022-45432 | Medium | 5.3 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated search for devices. After bypassing the firewall access control policy, by sending a speci… |
CVE-2022-45431 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated restart of remote DSS Server. After bypassing the firewall access control policy, by sendi… |
CVE-2022-45430 | Low | 3.7 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated enable or disable SSHD service. After bypassing the firewall access control policy, by sen… |
CVE-2022-45429 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of server-side request forgery (SSRF). An Attacker can access internal resources by concatenating links (URL)… |
CVE-2022-45428 | Low | 2.7 | 2022-12-27 | Some Dahua software products have a vulnerability of sensitive information leakage. After obtaining the permissions of administrators, by sending a specific cr… |
CVE-2022-45427 | High | 7.2 | 2022-12-27 | Some Dahua software products have a vulnerability of unrestricted upload of file. After obtaining the permissions of administrators, by sending a specific craf… |
CVE-2022-45426 | Medium | 6.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unrestricted download of file. After obtaining the permissions of ordinary users, by sending a specific cr… |
CVE-2022-45425 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of using of hard-coded cryptographic key. An attacker can obtain the AES crypto key by exploiting this vulner… |
CVE-2022-45424 | Medium | 5.3 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated request of AES crypto key. An attacker can obtain the AES crypto key by sending a specific… |
CVE-2022-45423 | High | 7.5 | 2022-12-27 | Some Dahua software products have a vulnerability of unauthenticated request of MQTT credentials. An attacker can obtain encrypted MQTT credentials by sending… |
CVE-2022-4767 | High | 7.5 | 2022-12-27 | Denial of Service in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4734 | High | 8.1 | 2022-12-27 | Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1. |
CVE-2022-4733 | Medium | 4.8 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4732 | High | 7.2 | 2022-12-27 | Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2. |
CVE-2022-4730 | Low | 3.5 | 2022-12-27 | A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler… |
CVE-2022-4729 | Low | 3.5 | 2022-12-27 | A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The… |
CVE-2022-4728 | Low | 3.5 | 2022-12-27 | A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The mani… |
CVE-2022-4727 | Low | 3.5 | 2022-12-27 | A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of th… |
CVE-2022-4726 | Medium | 6.3 | 2022-12-27 | A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionali… |
CVE-2022-4725 | Medium | 5.5 | 2022-12-27 | A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/mai… |
CVE-2022-4724 | Critical | 9.8 | 2022-12-27 | Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4723 | Medium | 6.5 | 2022-12-27 | Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4722 | High | 7.2 | 2022-12-27 | Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4721 | Medium | 5.4 | 2022-12-27 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4720 | Medium | 6.1 | 2022-12-27 | Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4719 | Critical | 9.8 | 2022-12-27 | Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5. |
CVE-2022-4695 | Medium | 5.4 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4694 | Medium | 5.4 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4691 | Medium | 5.4 | 2022-12-27 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-4766 | Medium | 4.3 | 2022-12-27 | A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the compon… |
CVE-2022-4755 | Low | 3.5 | 2022-12-27 | A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.med… |
CVE-2022-4748 | Medium | 5.5 | 2022-12-27 | A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/… |
CVE-2022-46764 | Critical | 9.8 | 2022-12-27 | A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows remote unauthenticated attackers to execute arbitrary SQL com… |
CVE-2022-46763 | High | 8.8 | 2022-12-27 | A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 (fixed in 5.2.6.10025) allows a low-privileged database user to execute arbi… |
CVE-2022-36664 | Medium | 6.1 | 2022-12-26 | Password Manager for IIS 2.0 has a cross-site scripting (XSS) vulnerability via the /isapi/PasswordManager.dll ResultURL parameter. |
CVE-2022-4268 | High | 7.2 | 2022-12-26 | The Plugin Logic WordPress plugin before 1.0.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploita… |
CVE-2022-4267 | Medium | 6.1 | 2022-12-26 | The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflec… |
CVE-2022-4266 | Medium | 6.5 | 2022-12-26 | The Bulk Delete Users by Email WordPress plugin through 1.2 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin… |
CVE-2022-4243 | Medium | 4.8 | 2022-12-26 | The ImageInject WordPress plugin through 1.17 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perfor… |
CVE-2022-4242 | Medium | 4.8 | 2022-12-26 | The WP Google Review Slider WordPress plugin before 11.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2022-4239 | Medium | 6.5 | 2022-12-26 | The Workreap WordPress theme before 2.6.4 does not verify that an addon service belongs to the user issuing the request, or indeed that it is an addon service… |
CVE-2022-4227 | Medium | 6.1 | 2022-12-26 | The Booster for WooCommerce WordPress plugin before 5.6.3, Booster Plus for WooCommerce WordPress plugin before 6.0.0, Booster Elite for WooCommerce WordPress… |
CVE-2022-4226 | Medium | 4.8 | 2022-12-26 | The Simple Basic Contact Form WordPress plugin before 20221201 does not sanitise and escape some of its settings, which could allow high privilege users such a… |
CVE-2022-4197 | Medium | 4.8 | 2022-12-26 | The Sliderby10Web WordPress plugin before 1.2.53 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to per… |
CVE-2022-4166 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the addCountS POST parameter before co… |
CVE-2022-4165 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_order POST parameter before con… |
CVE-2022-4164 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_multiple_files_for_post POST pa… |
CVE-2022-4163 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_deactivate and cg_activate POST… |
CVE-2022-4162 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_row POST parameter before conca… |
CVE-2022-4161 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_start POST parameter befor… |
CVE-2022-4160 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_copy_id POST parameter before c… |
CVE-2022-4159 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_id POST parameter before concat… |
CVE-2022-4158 | High | 7.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_Fields POST parameter before co… |
CVE-2022-4157 | Medium | 4.9 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the cg_option_id POST parameter before… |
CVE-2022-4156 | High | 7.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the user_id POST parameter before conc… |
CVE-2022-4155 | Medium | 4.9 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the wp_user_id GET parameter before co… |
CVE-2022-4154 | Medium | 4.9 | 2022-12-26 | The Contest Gallery Pro WordPress plugin before 19.1.5 does not escape the wp_user_id GET parameter before concatenating it to an SQL query in management-show-… |
CVE-2022-4153 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the upload[] POST parameter before con… |
CVE-2022-4152 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5, Contest Gallery Pro WordPress plugin before 19.1.5 do not escape the option_id POST parameter before concat… |
CVE-2022-4151 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id GET parameter before con… |
CVE-2022-4150 | Medium | 6.5 | 2022-12-26 | The Contest Gallery WordPress plugin before 19.1.5.1, Contest Gallery Pro WordPress plugin before 19.1.5.1 do not escape the option_id POST parameter before co… |
CVE-2022-4120 | Critical | 9.8 | 2022-12-26 | The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP functio… |
CVE-2022-4117 | Critical | 9.8 | 2022-12-26 | The IWS WordPress plugin through 1.0 does not properly escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated us… |
CVE-2022-4110 | Medium | 4.8 | 2022-12-26 | The Eventify™ WordPress plugin through 2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform S… |
CVE-2022-4047 | Critical | 9.8 | 2022-12-26 | The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to… |
CVE-2022-4042 | Medium | 4.8 | 2022-12-26 | The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege… |
CVE-2022-3840 | Medium | 4.8 | 2022-12-26 | The Login for Google Apps WordPress plugin before 3.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-3835 | Medium | 4.8 | 2022-12-26 | The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2022-4742 | Medium | 6.3 | 2022-12-26 | A vulnerability, which was classified as critical, has been found in json-pointer up to 0.6.1. Affected by this issue is the function set of the file index.js… |
CVE-2022-41767 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigne… |
CVE-2022-41765 | Medium | 5.3 | 2022-12-26 | An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUserTextField exposes the existence of hidde… |
CVE-2022-30260 | High | 7.8 | 2022-12-26 | Emerson DeltaV Distributed Control System (DCS) has insufficient verification of firmware integrity (an inadequate checksum approach, and no signature). This a… |
CVE-2022-26969 | Critical | 9.8 | 2022-12-26 | In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. |
CVE-2022-26964 | High | 7.4 | 2022-12-26 | Weak password derivation for export in Devolutions Remote Desktop Manager before 2022.1 allows information disclosure via a password brute-force attack. An err… |
CVE-2022-24120 | Medium | 4.6 | 2022-12-26 | Certain General Electric Renewable Energy products store cleartext credentials in flash memory. This affects iNET and iNET II before 8.3.0. |
CVE-2022-24119 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products have a hidden feature for unauthenticated remote access to the device configuration shell. This affects iNET… |
CVE-2022-24118 | Critical | 9.1 | 2022-12-26 | Certain General Electric Renewable Energy products allow attackers to use a code to trigger a reboot into the factory default configuration. This affects iNET… |
CVE-2022-24117 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products download firmware without an integrity check. This affects iNET and iNET II before 8.3.0, SD before 6.4.7, T… |
CVE-2022-24116 | Critical | 9.8 | 2022-12-26 | Certain General Electric Renewable Energy products have inadequate encryption strength. This affects iNET and iNET II before 8.3.0. |
CVE-2022-37310 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via a malicious capability to the metrics or help module, as demonstrated by a /#!!&app=io.ox/files&cap= URI. |
CVE-2022-37309 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via script code within a contact that has an e-mail address but lacks a name. |
CVE-2022-29853 | Medium | 5.4 | 2022-12-26 | OX App Suite through 8.2 allows XSS via a certain complex hierarchy that forces use of Show Entire Message for a huge HTML e-mail message. |
CVE-2022-29852 | Medium | 5.4 | 2022-12-26 | OX App Suite through 8.2 allows XSS because BMFreehand10 and image/x-freehand are not blocked. |
CVE-2022-37308 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via HTML in text/plain e-mail messages. |
CVE-2022-37313 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 allows SSRF because the anti-SSRF protection mechanism only checks the first DNS AA or AAAA record. |
CVE-2022-37312 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large request body containing a redirect URL to the deferrer servlet. |
CVE-2022-37311 | Medium | 5.3 | 2022-12-26 | OX App Suite through 7.10.6 has Uncontrolled Resource Consumption via a large location request parameter to the redirect servlet. |
CVE-2022-37307 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via XHTML CDATA for a snippet, as demonstrated by the onerror attribute of an IMG element within an e-mail signature. |
CVE-2022-31469 | Medium | 6.1 | 2022-12-26 | OX App Suite through 7.10.6 allows XSS via a deep link, as demonstrated by class="deep-link-app" for a /#!!&app=%2e./ URI. |
CVE-2022-4741 | Medium | 4.3 | 2022-12-25 | A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/… |
CVE-2022-4740 | Low | 3.5 | 2022-12-25 | A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /p… |
CVE-2022-4739 | High | 7.3 | 2022-12-25 | A vulnerability classified as critical was found in SourceCodester School Dormitory Management System 1.0. Affected by this vulnerability is an unknown functio… |
CVE-2022-4738 | Medium | 4.3 | 2022-12-25 | A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index… |
CVE-2022-4737 | High | 7.3 | 2022-12-25 | A vulnerability was found in SourceCodester Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the… |