2022 CVEs (page 75)
Page 75 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43883 | Medium | 6.5 | 2022-12-19 | IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 could be vulnerable to a Log Injection attack by constructing URLs from user-controlled data. This could enabl… |
CVE-2022-39160 | Medium | 6.1 | 2022-12-19 | IBM Cognos Analytics 11.2.1, 11.2.0, and 11.1.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in t… |
CVE-2022-38708 | Medium | 6.5 | 2022-12-19 | IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-contro… |
CVE-2022-4615 | Medium | 6.1 | 2022-12-19 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4614 | Medium | 5.4 | 2022-12-19 | Cross-site Scripting (XSS) - Stored in GitHub repository alagrede/znote-app prior to 1.7.11. |
CVE-2022-44488 | Low | 3.5 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authe… |
CVE-2022-44474 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44471 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44470 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44467 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44466 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44465 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-44463 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42365 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42364 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42362 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42357 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42356 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42354 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42352 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42350 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42349 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42348 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42346 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42345 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-41418 | High | 7.2 | 2022-12-19 | An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via u… |
CVE-2022-40607 | Medium | 6.8 | 2022-12-19 | IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside… |
CVE-2022-3775 | High | 7.1 | 2022-12-19 | When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size… |
CVE-2022-35695 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-35693 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-30679 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-43289 | High | 7.8 | 2022-12-19 | Deark v.1.6.2 was discovered to contain a stack overflow via the do_prism_read_palette() function at /modules/atari-img.c. |
CVE-2022-40435 | Medium | 4.8 | 2022-12-19 | Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new entries under the De… |
CVE-2022-47512 | Medium | 5.5 | 2022-12-19 | Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Plat… |
CVE-2022-42947 | High | 7.8 | 2022-12-19 | A maliciously crafted X_B file when parsed through Autodesk Maya 2023 and 2022 can be used to write beyond the allocated buffer. This vulnerability can lead to… |
CVE-2022-42946 | High | 7.1 | 2022-12-19 | Parsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer. This vulnerability in conjunction with ot… |
CVE-2022-42945 | High | 7.8 | 2022-12-19 | DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code executi… |
CVE-2022-31683 | Medium | 5.4 | 2022-12-19 | Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team… |
CVE-2022-28173 | Critical | 9.1 | 2022-12-19 | The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker c… |
CVE-2022-4613 | Medium | 5.0 | 2022-12-19 | A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown… |
CVE-2022-4612 | Medium | 4.3 | 2022-12-19 | A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affe… |
CVE-2022-4611 | Medium | 4.3 | 2022-12-19 | A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unkn… |
CVE-2022-4610 | Low | 1.9 | 2022-12-19 | A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by thi… |
CVE-2022-4125 | Medium | 4.3 | 2022-12-19 | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well… |
CVE-2022-4124 | Medium | 4.3 | 2022-12-19 | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to d… |
CVE-2022-4112 | Medium | 4.8 | 2022-12-19 | The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2022-4108 | Medium | 4.9 | 2022-12-19 | The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users suc… |
CVE-2022-4107 | Medium | 6.5 | 2022-12-19 | The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be… |
CVE-2022-4106 | High | 7.5 | 2022-12-19 | The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate… |
CVE-2022-4063 | Critical | 9.8 | 2022-12-19 | The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusio… |
CVE-2022-4061 | High | 7.5 | 2022-12-19 | The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users… |
CVE-2022-4058 | Medium | 5.4 | 2022-12-19 | The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in ano… |
CVE-2022-4050 | Critical | 9.8 | 2022-12-19 | The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection ex… |
CVE-2022-4024 | Medium | 6.5 | 2022-12-19 | The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenti… |
CVE-2022-3987 | Medium | 5.4 | 2022-12-19 | The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-3986 | Medium | 5.4 | 2022-12-19 | The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-3985 | Medium | 5.4 | 2022-12-19 | The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-3984 | Medium | 5.4 | 2022-12-19 | The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-3983 | Medium | 5.4 | 2022-12-19 | The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-3961 | Medium | 6.5 | 2022-12-19 | The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information. |
CVE-2022-3937 | Medium | 5.4 | 2022-12-19 | The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor… |
CVE-2022-3832 | Medium | 4.8 | 2022-12-19 | The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2022-4609 | Medium | 5.4 | 2022-12-19 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-40743 | Medium | 6.1 | 2022-12-19 | Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache po… |
CVE-2022-47500 | Medium | 6.1 | 2022-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all r… |
CVE-2022-44755 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker… |
CVE-2022-44754 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-44753 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-44752 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attack… |
CVE-2022-44751 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker… |
CVE-2022-44750 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-42453 | Medium | 6.9 | 2022-12-19 | There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with… |
CVE-2022-3877 | Low | 3.5 | 2022-12-19 | A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected is an unkno… |
CVE-2022-3876 | Medium | 4.3 | 2022-12-19 | A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affe… |
CVE-2022-3875 | High | 7.3 | 2022-12-19 | A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown… |
CVE-2022-38662 | Medium | 6.1 | 2022-12-19 | In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites. |
CVE-2022-38659 | Medium | 6.0 | 2022-12-19 | In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent. |
CVE-2022-38653 | Low | 2.0 | 2022-12-19 | In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded. |
CVE-2022-37392 | Medium | 5.3 | 2022-12-19 | Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server… |
CVE-2022-32749 | High | 7.5 | 2022-12-19 | Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under cer… |
CVE-2022-4427 | Medium | 6.5 | 2022-12-19 | Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects… |
CVE-2022-47549 | Medium | 6.4 | 2022-12-19 | An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically prox… |
CVE-2022-47547 | Medium | 5.3 | 2022-12-19 | GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbe… |
CVE-2022-46288 | Medium | 6.1 | 2022-12-19 | Open redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web si… |
CVE-2022-46287 | Medium | 6.1 | 2022-12-19 | Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. |
CVE-2022-44456 | Critical | 9.8 | 2022-12-19 | CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is… |
CVE-2022-43486 | Medium | 6.8 | 2022-12-19 | Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functiona… |
CVE-2022-43466 | Medium | 6.8 | 2022-12-19 | OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS co… |
CVE-2022-43443 | High | 8.8 | 2022-12-19 | OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted req… |
CVE-2022-41993 | Medium | 6.1 | 2022-12-19 | Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. |
CVE-2022-4607 | Medium | 5.5 | 2022-12-18 | A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2022-4605 | Medium | 5.4 | 2022-12-18 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2022-4606 | Critical | 9.8 | 2022-12-18 | PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2022-4604 | Medium | 4.3 | 2022-12-18 | A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the function register_endpoint… |
CVE-2022-4603 | Medium | 4.3 | 2022-12-18 | A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The m… |
CVE-2022-4602 | Low | 3.5 | 2022-12-18 | A vulnerability was found in Shoplazza LifeStyle 1.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/api/theme… |
CVE-2022-4601 | Low | 3.5 | 2022-12-18 | A vulnerability was found in Shoplazza LifeStyle 1.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/api/theme… |
CVE-2022-4600 | Low | 3.5 | 2022-12-18 | A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of… |
CVE-2022-4599 | Low | 3.5 | 2022-12-18 | A vulnerability was found in Shoplazza LifeStyle 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/api… |
CVE-2022-4598 | Low | 3.5 | 2022-12-18 | A vulnerability has been found in Shoplazza LifeStyle 1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file… |