2022 CVEs (page 75)
Page 75 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-42350 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42349 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42348 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42346 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-42345 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-41418 | High | 7.2 | 2022-12-19 | An issue in the component BlogEngine/BlogEngine.NET/AppCode/Api/UploadController.cs of BlogEngine.NET v3.3.8.0 allows attackers to execute arbitrary code via u… |
CVE-2022-40607 | Medium | 6.8 | 2022-12-19 | IBM Spectrum Scale 5.1 could allow users with permissions to create pod, persistent volume and persistent volume claim to access files and directories outside… |
CVE-2022-3775 | High | 7.1 | 2022-12-19 | When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size… |
CVE-2022-35695 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-35693 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-30679 | Medium | 5.4 | 2022-12-19 | Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able… |
CVE-2022-43289 | High | 7.8 | 2022-12-19 | Deark v.1.6.2 was discovered to contain a stack overflow via the do_prism_read_palette() function at /modules/atari-img.c. |
CVE-2022-40435 | Medium | 4.8 | 2022-12-19 | Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new entries under the De… |
CVE-2022-47512 | Medium | 5.5 | 2022-12-19 | Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Plat… |
CVE-2022-42947 | High | 7.8 | 2022-12-19 | A maliciously crafted X_B file when parsed through Autodesk Maya 2023 and 2022 can be used to write beyond the allocated buffer. This vulnerability can lead to… |
CVE-2022-42946 | High | 7.1 | 2022-12-19 | Parsing a maliciously crafted X_B and PRT file can force Autodesk Maya 2023 and 2022 to read beyond allocated buffer. This vulnerability in conjunction with ot… |
CVE-2022-42945 | High | 7.8 | 2022-12-19 | DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code executi… |
CVE-2022-31683 | Medium | 5.4 | 2022-12-19 | Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team… |
CVE-2022-28173 | Critical | 9.1 | 2022-12-19 | The web server of some Hikvision wireless bridge products have an access control vulnerability which can be used to obtain the admin permission. The attacker c… |
CVE-2022-4613 | Medium | 5.0 | 2022-12-19 | A vulnerability was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as critical. This issue affects some unknown… |
CVE-2022-4612 | Medium | 4.3 | 2022-12-19 | A vulnerability has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome and classified as problematic. This vulnerability affe… |
CVE-2022-4611 | Medium | 4.3 | 2022-12-19 | A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This affects an unkn… |
CVE-2022-4610 | Low | 1.9 | 2022-12-19 | A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected by thi… |
CVE-2022-4125 | Medium | 4.3 | 2022-12-19 | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well… |
CVE-2022-4124 | Medium | 4.3 | 2022-12-19 | The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to d… |
CVE-2022-4112 | Medium | 4.8 | 2022-12-19 | The Quizlord WordPress plugin through 2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform St… |
CVE-2022-4108 | Medium | 4.9 | 2022-12-19 | The Wholesale Market for WooCommerce WordPress plugin before 1.0.8 does not validate user input used to generate system path, allowing high privilege users suc… |
CVE-2022-4107 | Medium | 6.5 | 2022-12-19 | The SMSA Shipping for WooCommerce WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks, as well as does not validate the file to be… |
CVE-2022-4106 | High | 7.5 | 2022-12-19 | The Wholesale Market for WooCommerce WordPress plugin before 1.0.7 does not have authorisation check, as well as does not validate user input used to generate… |
CVE-2022-4063 | Critical | 9.8 | 2022-12-19 | The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusio… |
CVE-2022-4061 | High | 7.5 | 2022-12-19 | The JobBoardWP WordPress plugin before 1.2.2 does not properly validate file names and types in its file upload functionalities, allowing unauthenticated users… |
CVE-2022-4058 | Medium | 5.4 | 2022-12-19 | The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in ano… |
CVE-2022-4050 | Critical | 9.8 | 2022-12-19 | The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection ex… |
CVE-2022-4024 | Medium | 6.5 | 2022-12-19 | The Registration Forms WordPress plugin before 3.8.1.3 does not have authorisation and CSRF when deleting users via an init action handler, allowing unauthenti… |
CVE-2022-3987 | Medium | 5.4 | 2022-12-19 | The Responsive Lightbox2 WordPress plugin before 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-3986 | Medium | 5.4 | 2022-12-19 | The WP Stripe Checkout WordPress plugin before 1.2.2.21 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-3985 | Medium | 5.4 | 2022-12-19 | The Videojs HTML5 Player WordPress plugin before 1.1.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-3984 | Medium | 5.4 | 2022-12-19 | The Flowplayer Video Player WordPress plugin before 1.0.5 does not validate and escape some of its shortcode attributes before outputting them back in the page… |
CVE-2022-3983 | Medium | 5.4 | 2022-12-19 | The Checkout for PayPal WordPress plugin before 1.0.14 does not validate and escape some of its shortcode attributes before outputting them back in the page, w… |
CVE-2022-3961 | Medium | 6.5 | 2022-12-19 | The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information. |
CVE-2022-3937 | Medium | 5.4 | 2022-12-19 | The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor… |
CVE-2022-3832 | Medium | 4.8 | 2022-12-19 | The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to pe… |
CVE-2022-4609 | Medium | 5.4 | 2022-12-19 | Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0. |
CVE-2022-40743 | Medium | 6.1 | 2022-12-19 | Improper Input Validation vulnerability for the xdebug plugin in Apache Software Foundation Apache Traffic Server can lead to cross site scripting and cache po… |
CVE-2022-47500 | Medium | 6.1 | 2022-12-19 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all r… |
CVE-2022-44755 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker… |
CVE-2022-44754 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-44753 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-44752 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attack… |
CVE-2022-44751 | Critical | 9.8 | 2022-12-19 | HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacker… |
CVE-2022-44750 | Critical | 9.8 | 2022-12-19 | HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView. This could allow a remote unauthenticated attacke… |
CVE-2022-42453 | Medium | 6.9 | 2022-12-19 | There are insufficient warnings when a Fixlet is imported by a user. The warning message currently assumes the owner of the script is the logged in user, with… |
CVE-2022-3877 | Low | 3.5 | 2022-12-19 | A vulnerability, which was classified as problematic, was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. Affected is an unkno… |
CVE-2022-3876 | Medium | 4.3 | 2022-12-19 | A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affe… |
CVE-2022-3875 | High | 7.3 | 2022-12-19 | A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown… |
CVE-2022-38662 | Medium | 6.1 | 2022-12-19 | In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites. |
CVE-2022-38659 | Medium | 6.0 | 2022-12-19 | In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent. |
CVE-2022-38653 | Low | 2.0 | 2022-12-19 | In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded. |
CVE-2022-37392 | Medium | 5.3 | 2022-12-19 | Improper Check for Unusual or Exceptional Conditions vulnerability in handling the requests to Apache Traffic Server. This issue affects Apache Traffic Server… |
CVE-2022-32749 | High | 7.5 | 2022-12-19 | Improper Check for Unusual or Exceptional Conditions vulnerability handling requests in Apache Traffic Server allows an attacker to crash the server under cer… |
CVE-2022-4427 | Medium | 6.5 | 2022-12-19 | Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects… |
CVE-2022-47549 | Medium | 6.4 | 2022-12-19 | An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically prox… |
CVE-2022-47547 | Medium | 5.3 | 2022-12-19 | GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbe… |
CVE-2022-46288 | Medium | 6.1 | 2022-12-19 | Open redirect vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web si… |
CVE-2022-46287 | Medium | 6.1 | 2022-12-19 | Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. |
CVE-2022-44456 | Critical | 9.8 | 2022-12-19 | CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is… |
CVE-2022-43486 | Medium | 6.8 | 2022-12-19 | Hidden functionality vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to enable the debug functiona… |
CVE-2022-43466 | Medium | 6.8 | 2022-12-19 | OS command injection vulnerability in Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS co… |
CVE-2022-43443 | High | 8.8 | 2022-12-19 | OS command injection vulnerability in Buffalo network devices allows an network-adjacent attacker to execute an arbitrary OS command if a specially crafted req… |
CVE-2022-41993 | Medium | 6.1 | 2022-12-19 | Cross-site scripting vulnerability in DENSHI NYUSATSU CORE SYSTEM v6 R4 and earlier allows a remote unauthenticated attacker to inject an arbitrary script. |
CVE-2022-4607 | Medium | 5.5 | 2022-12-18 | A vulnerability was found in 3D City Database OGC Web Feature Service up to 5.2.0. It has been rated as problematic. This issue affects some unknown processing… |
CVE-2022-4605 | Medium | 5.4 | 2022-12-18 | Cross-site Scripting (XSS) - Stored in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2022-4606 | Critical | 9.8 | 2022-12-18 | PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3. |
CVE-2022-4604 | Medium | 4.3 | 2022-12-18 | A vulnerability classified as problematic was found in wp-english-wp-admin Plugin up to 1.5.1. Affected by this vulnerability is the function register_endpoint… |
CVE-2022-4603 | Medium | 4.3 | 2022-12-18 | A vulnerability classified as problematic has been found in ppp. Affected is the function dumpppp of the file pppdump/pppdump.c of the component pppdump. The m… |
CVE-2022-4602 | Low | 3.5 | 2022-12-18 | A vulnerability was found in Shoplazza LifeStyle 1.1. It has been rated as problematic. This issue affects some unknown processing of the file /admin/api/theme… |
CVE-2022-4601 | Low | 3.5 | 2022-12-18 | A vulnerability was found in Shoplazza LifeStyle 1.1. It has been declared as problematic. This vulnerability affects unknown code of the file /admin/api/theme… |
CVE-2022-4600 | Low | 3.5 | 2022-12-18 | A vulnerability was found in Shoplazza LifeStyle 1.1. It has been classified as problematic. This affects an unknown part of the file /admin/api/theme-edit/ of… |
CVE-2022-4599 | Low | 3.5 | 2022-12-18 | A vulnerability was found in Shoplazza LifeStyle 1.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /admin/api… |
CVE-2022-4598 | Low | 3.5 | 2022-12-18 | A vulnerability has been found in Shoplazza LifeStyle 1.1 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file… |
CVE-2022-4597 | Low | 3.5 | 2022-12-18 | A vulnerability, which was classified as problematic, was found in Shoplazza LifeStyle 1.1. Affected is an unknown function of the file /admin/api/admin/v2_pro… |
CVE-2022-4596 | Low | 3.5 | 2022-12-18 | A vulnerability, which was classified as problematic, has been found in Shoplazza 1.1. This issue affects some unknown processing of the file /admin/api/admin/… |
CVE-2022-4595 | Low | 3.5 | 2022-12-18 | A vulnerability classified as problematic has been found in django-openipam. This affects an unknown part of the file openipam/report/templates/report/exposed_… |
CVE-2022-4594 | Medium | 6.3 | 2022-12-18 | A vulnerability was found in drogatkin TJWS2. It has been declared as critical. Affected by this vulnerability is the function deployWar of the file 1.x/src/ro… |
CVE-2022-4593 | Low | 3.5 | 2022-12-18 | A vulnerability was found in retra-system. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripti… |
CVE-2022-4592 | Medium | 6.3 | 2022-12-18 | A vulnerability was found in luckyshot CRMx and classified as critical. This issue affects the function get/save/delete/comment/commentdelete of the file index… |
CVE-2022-47521 | High | 7.8 | 2022-12-18 | An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg… |
CVE-2022-47520 | High | 7.1 | 2022-12-18 | An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless… |
CVE-2022-47519 | High | 7.8 | 2022-12-18 | An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg… |
CVE-2022-47518 | High | 7.8 | 2022-12-18 | An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c i… |
CVE-2022-47517 | High | 7.5 | 2022-12-18 | An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a… |
CVE-2022-47516 | High | 7.5 | 2022-12-18 | An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a… |
CVE-2022-47515 | High | 7.5 | 2022-12-18 | An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP re… |
CVE-2022-47514 | High | 8.8 | 2022-12-18 | An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF… |
CVE-2022-4591 | Low | 3.5 | 2022-12-17 | A vulnerability was found in mschaef toto up to 1.4.20. It has been declared as problematic. This vulnerability affects unknown code of the component Email Par… |
CVE-2022-4590 | Low | 3.5 | 2022-12-17 | A vulnerability was found in mschaef toto up to 1.4.20. It has been classified as problematic. This affects an unknown part of the component Todo List Handler… |
CVE-2022-4589 | Medium | 5.5 | 2022-12-17 | A vulnerability has been found in cyface Terms and Conditions Module up to 2.0.9 and classified as problematic. Affected by this vulnerability is the function… |
CVE-2022-4588 | Low | 2.4 | 2022-12-17 | A vulnerability, which was classified as problematic, was found in Boston Sleep slice up to 84.1.x. Affected is an unknown function of the component Layout Han… |
CVE-2022-4587 | Medium | 4.3 | 2022-12-17 | A vulnerability, which was classified as problematic, has been found in Opencaching Deutschland oc-server3. This issue affects some unknown processing of the f… |
CVE-2022-4586 | Low | 3.5 | 2022-12-17 | A vulnerability classified as problematic was found in Opencaching Deutschland oc-server3. This vulnerability affects unknown code of the file htdocs/templates… |