2022 CVEs (page 78)
Page 78 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-20503 | High | 7.8 | 2022-12-16 | In onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration due to a missing permission check. This c… |
CVE-2022-20199 | Medium | 5.5 | 2022-12-16 | In multiple locations of NfcService.java, there is a possible disclosure of NFC tags due to a confused deputy. This could lead to local information disclosure… |
CVE-2022-47377 | Critical | 9.8 | 2022-12-16 | Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the… |
CVE-2022-3109 | High | 7.5 | 2022-12-16 | An issue was discovered in the FFmpeg package, where vp3_decode_frame in libavcodec/vp3.c lacks check of the return value of av_malloc() and will cause a null… |
CVE-2022-4555 | Medium | 6.5 | 2022-12-16 | The WP Shamsi plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the deactivate() function hooked via init() in ve… |
CVE-2022-41963 | Low | 2.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but… |
CVE-2022-36223 | Medium | 6.1 | 2022-12-16 | In Emby Server 4.6.7.0, the playlist name field is vulnerable to XSS stored where it is possible to steal the administrator access token and flip or steal the… |
CVE-2022-46870 | Medium | 5.4 | 2022-12-16 | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbi… |
CVE-2022-41962 | Low | 2.7 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status… |
CVE-2022-41961 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple… |
CVE-2022-41960 | Medium | 4.3 | 2022-12-16 | BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in D… |
CVE-2022-46393 | Critical | 9.8 | 2022-12-15 | An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. There is a potential heap-based buffer overflow and heap-based buffer over-read in DTLS… |
CVE-2022-46392 | Medium | 5.3 | 2022-12-15 | An issue was discovered in Mbed TLS before 2.28.2 and 3.x before 3.3.0. An adversary with access to precise enough information about memory accesses (typically… |
CVE-2022-45969 | Critical | 9.8 | 2022-12-15 | Alist v3.4.0 is vulnerable to Directory Traversal, |
CVE-2022-45338 | High | 7.8 | 2022-12-15 | An arbitrary file upload vulnerability in the profile picture upload function of Exact Synergy Enterprise 267 before 267SP13 and Exact Synergy Enterprise 500 b… |
CVE-2022-40004 | Critical | 9.6 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in Things Board 3.4.1 allows remote attackers to escalate privilege via crafted URL to the Audit Log. |
CVE-2022-46634 | Critical | 9.8 | 2022-12-15 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiWpsCfg f… |
CVE-2022-46631 | Critical | 9.8 | 2022-12-15 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiSignalCf… |
CVE-2022-4527 | Low | 3.5 | 2022-12-15 | A vulnerability was found in collective.task up to 3.0.8. It has been classified as problematic. This affects the function renderCell/AssignedGroupColumn of th… |
CVE-2022-4526 | Low | 3.5 | 2022-12-15 | A vulnerability was found in django-photologue up to 3.15.1 and classified as problematic. Affected by this issue is some unknown functionality of the file pho… |
CVE-2022-4525 | Low | 3.5 | 2022-12-15 | A vulnerability has been found in National Sleep Research Resource sleepdata.org up to 58.x and classified as problematic. Affected by this vulnerability is an… |
CVE-2022-4524 | Low | 3.5 | 2022-12-15 | A vulnerability, which was classified as problematic, was found in Roots soil Plugin up to 4.0.x. Affected is the function language_attributes of the file src/… |
CVE-2022-4523 | Low | 3.5 | 2022-12-15 | A vulnerability, which was classified as problematic, has been found in vexim2. This issue affects some unknown processing. The manipulation leads to cross sit… |
CVE-2022-4522 | Low | 3.5 | 2022-12-15 | A vulnerability classified as problematic was found in CalendarXP up to 10.0.1. This vulnerability affects unknown code. The manipulation leads to cross site s… |
CVE-2022-4521 | Low | 3.5 | 2022-12-15 | A vulnerability classified as problematic has been found in WSO2 carbon-registry up to 4.8.6. This affects an unknown part of the component Request Parameter H… |
CVE-2022-4520 | Low | 3.5 | 2022-12-15 | A vulnerability was found in WSO2 carbon-registry up to 4.8.11. It has been rated as problematic. Affected by this issue is some unknown functionality of the f… |
CVE-2022-4519 | Medium | 5.5 | 2022-12-15 | The WP User plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 7.0 due to insuffic… |
CVE-2022-4514 | Low | 3.5 | 2022-12-15 | A vulnerability, which was classified as problematic, was found in Opencaching Deutschland oc-server3. Affected is an unknown function of the file htdocs/lang/… |
CVE-2022-4513 | Low | 3.5 | 2022-12-15 | A vulnerability, which was classified as problematic, has been found in European Environment Agency eionet.contreg. This issue affects some unknown processing… |
CVE-2022-4511 | Medium | 5.3 | 2022-12-15 | A vulnerability has been found in RainyGao DocSys and classified as critical. Affected by this vulnerability is an unknown functionality of the component com.D… |
CVE-2022-46702 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to disclose kernel memory. |
CVE-2022-46701 | High | 7.8 | 2022-12-15 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious… |
CVE-2022-46700 | High | 8.8 | 2022-12-15 | A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadO… |
CVE-2022-46699 | High | 8.8 | 2022-12-15 | A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS… |
CVE-2022-46698 | Medium | 6.5 | 2022-12-15 | A logic issue was addressed with improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2 and iPad… |
CVE-2022-46697 | High | 7.8 | 2022-12-15 | An out-of-bounds access issue was addressed with improved bounds checking. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary c… |
CVE-2022-46696 | High | 8.8 | 2022-12-15 | A memory corruption issue was addressed with improved input validation. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS… |
CVE-2022-46695 | Medium | 6.5 | 2022-12-15 | A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, macOS Ventura 13.1… |
CVE-2022-46694 | High | 7.8 | 2022-12-15 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS… |
CVE-2022-46693 | High | 7.8 | 2022-12-15 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 1… |
CVE-2022-46692 | Medium | 5.5 | 2022-12-15 | A logic issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, iOS 15.7.2 and iPadOS 15.7… |
CVE-2022-46691 | High | 8.8 | 2022-12-15 | A memory consumption issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadO… |
CVE-2022-46690 | High | 7.8 | 2022-12-15 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watc… |
CVE-2022-46689 | High | 7.0 | 2022-12-15 | A race condition was addressed with additional validation. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, i… |
CVE-2022-45033 | Medium | 5.4 | 2022-12-15 | A cross-site scripting (XSS) vulnerability in Expense Tracker 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into… |
CVE-2022-44588 | Critical | 9.9 | 2022-12-15 | Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress. |
CVE-2022-44236 | Critical | 9.8 | 2022-12-15 | Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability. |
CVE-2022-44235 | Medium | 6.1 | 2022-12-15 | Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-42867 | High | 8.8 | 2022-12-15 | A use after free issue was addressed with improved memory management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16… |
CVE-2022-42866 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved handling of caches. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app m… |
CVE-2022-42865 | Medium | 5.5 | 2022-12-15 | This issue was addressed by enabling hardened runtime. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. An app may… |
CVE-2022-42864 | High | 7.0 | 2022-12-15 | A race condition was addressed with improved state handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2… |
CVE-2022-42863 | High | 8.8 | 2022-12-15 | A memory corruption issue was addressed with improved state management. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 16.2 and iPadOS… |
CVE-2022-42862 | Medium | 5.5 | 2022-12-15 | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to bypass Pri… |
CVE-2022-42861 | High | 8.8 | 2022-12-15 | This issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadO… |
CVE-2022-42859 | Medium | 5.5 | 2022-12-15 | Multiple issues were addressed by removing the vulnerable code. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, watchOS 9.2. An app may be… |
CVE-2022-42856 | High | 8.8 | 2022-12-15 | A type confusion issue was addressed with improved state handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15… |
CVE-2022-42855 | High | 7.1 | 2022-12-15 | A logic issue was addressed with improved state management. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS… |
CVE-2022-42854 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1. An app may be able to disclose kernel… |
CVE-2022-42853 | Medium | 5.5 | 2022-12-15 | An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13.1. An app may be able to modify protected parts of the… |
CVE-2022-42852 | Medium | 6.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in Safari 16.2, tvOS 16.2, macOS Ventura 13.1, iOS 15.7.2 and iPadOS 15.7.2, iOS 16… |
CVE-2022-42851 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS 16.2. Parsing a maliciously crafted TIFF file may… |
CVE-2022-42850 | High | 7.8 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to execute arbitrary code with kerne… |
CVE-2022-42849 | High | 7.8 | 2022-12-15 | An access issue existed with privileged API calls. This issue was addressed with additional restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2, tvOS… |
CVE-2022-42848 | High | 7.8 | 2022-12-15 | A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2, tvOS 16.2. An app may be able… |
CVE-2022-42847 | High | 7.8 | 2022-12-15 | An out-of-bounds write issue was addressed with improved input validation. This issue is fixed in macOS Ventura 13.1. An app may be able to execute arbitrary c… |
CVE-2022-42846 | Medium | 5.5 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2, iOS 15.7.2 and iPadOS 15.7.2. Parsing a maliciously cra… |
CVE-2022-42845 | High | 7.2 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 1… |
CVE-2022-42844 | High | 8.6 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to break out of its sandbox. |
CVE-2022-42843 | Medium | 5.5 | 2022-12-15 | This issue was addressed with improved data protection. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2, watchOS 9.2. A user may… |
CVE-2022-42842 | Critical | 9.8 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in tvOS 16.2, macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 1… |
CVE-2022-42841 | High | 7.8 | 2022-12-15 | A type confusion issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2. Processing a… |
CVE-2022-42840 | High | 7.8 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, iOS 15.7.2 and i… |
CVE-2022-42837 | Critical | 9.8 | 2022-12-15 | An issue existed in the parsing of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventur… |
CVE-2022-42821 | Medium | 5.5 | 2022-12-15 | A logic issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.2, macOS Big Sur 11.7.2, macOS Ventura 13. An app may bypass Gatek… |
CVE-2022-42805 | High | 7.8 | 2022-12-15 | An integer overflow was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to e… |
CVE-2022-40373 | Medium | 5.4 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file. |
CVE-2022-40002 | Medium | 5.4 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbirtary code via the callback parameter to /cms/notify. |
CVE-2022-40001 | Medium | 5.4 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the title field of the create article page. |
CVE-2022-40000 | Medium | 5.4 | 2022-12-15 | Cross Site Scripting (XSS) vulnerability in FeehiCMS-2.1.1 allows remote attackers to run arbitrary code via the username field of the admin log in page. |
CVE-2022-3427 | High | 8.8 | 2022-12-15 | The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect no… |
CVE-2022-32948 | High | 7.8 | 2022-12-15 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to… |
CVE-2022-32945 | Medium | 4.3 | 2022-12-15 | An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ventura 13. An app may be able to record a… |
CVE-2022-32943 | Medium | 5.3 | 2022-12-15 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Shake-to-undo may allow a deleted pho… |
CVE-2022-32942 | High | 7.8 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2. An app may be ab… |
CVE-2022-32916 | Medium | 5.5 | 2022-12-15 | An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS… |
CVE-2022-32860 | High | 7.8 | 2022-12-15 | An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, macOS Big Sur 11.6.8… |
CVE-2022-32833 | Medium | 5.3 | 2022-12-15 | An issue existed with the file paths used to store website data. The issue was resolved by improving how website data is stored. This issue is fixed in iOS 16… |
CVE-2022-32531 | Medium | 5.9 | 2022-12-15 | The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails… |
CVE-2022-2536 | Medium | 5.3 | 2022-12-15 | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and includin… |
CVE-2022-23526 | Medium | 5.3 | 2022-12-15 | Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the_chartutil_ pac… |
CVE-2022-23525 | Medium | 5.3 | 2022-12-15 | Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package… |
CVE-2022-23524 | Medium | 5.3 | 2022-12-15 | Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting i… |
CVE-2022-23507 | Medium | 5.4 | 2022-12-15 | Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via… |
CVE-2022-23474 | Medium | 6.1 | 2022-12-15 | Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method pa… |
CVE-2022-22063 | High | 8.4 | 2022-12-15 | Memory corruption in Core due to improper configuration in boot remapper. |
CVE-2022-32763 | Medium | 6.1 | 2022-12-15 | A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted… |
CVE-2022-32573 | Critical | 9.9 | 2022-12-15 | A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request ca… |
CVE-2022-29517 | Critical | 9.9 | 2022-12-15 | A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP r… |
CVE-2022-29511 | Medium | 6.5 | 2022-12-15 | A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lansweeper lansweeper 10.1.1.0. A specially-cra… |