2022 CVEs (page 79)
Page 79 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3427 | High | 8.8 | 2022-12-15 | The Corner Ad plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.56. This is due to missing or incorrect no… |
CVE-2022-32948 | High | 7.8 | 2022-12-15 | An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5. An app may be able to… |
CVE-2022-32945 | Medium | 4.3 | 2022-12-15 | An access issue was addressed with additional sandbox restrictions on third-party apps. This issue is fixed in macOS Ventura 13. An app may be able to record a… |
CVE-2022-32943 | Medium | 5.3 | 2022-12-15 | The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Shake-to-undo may allow a deleted pho… |
CVE-2022-32942 | High | 7.8 | 2022-12-15 | The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.6.2, macOS Ventura 13.1, macOS Big Sur 11.7.2. An app may be ab… |
CVE-2022-32916 | Medium | 5.5 | 2022-12-15 | An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed with improved input validation. This issue is fixed in iOS… |
CVE-2022-32860 | High | 7.8 | 2022-12-15 | An out-of-bounds write was addressed with improved input validation. This issue is fixed in iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, macOS Big Sur 11.6.8… |
CVE-2022-32833 | Medium | 5.3 | 2022-12-15 | An issue existed with the file paths used to store website data. The issue was resolved by improving how website data is stored. This issue is fixed in iOS 16… |
CVE-2022-32531 | Medium | 5.9 | 2022-12-15 | The Apache Bookkeeper Java Client (before 4.14.6 and also 4.15.0) does not close the connection to the bookkeeper server when TLS hostname verification fails… |
CVE-2022-2536 | Medium | 5.3 | 2022-12-15 | The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and includin… |
CVE-2022-23526 | Medium | 5.3 | 2022-12-15 | Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the_chartutil_ pac… |
CVE-2022-23525 | Medium | 5.3 | 2022-12-15 | Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package… |
CVE-2022-23524 | Medium | 5.3 | 2022-12-15 | Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting i… |
CVE-2022-23507 | Medium | 5.4 | 2022-12-15 | Tendermint is a high-performance blockchain consensus engine for Byzantine fault tolerant applications. Versions prior to 0.28.0 contain a potential attack via… |
CVE-2022-23474 | Medium | 6.1 | 2022-12-15 | Editor.js is a block-style editor with clean JSON output. Versions prior to 2.26.0 are vulnerable to Code Injection via pasted input. The processHTML method pa… |
CVE-2022-22063 | High | 8.4 | 2022-12-15 | Memory corruption in Core due to improper configuration in boot remapper. |
CVE-2022-32763 | Medium | 6.1 | 2022-12-15 | A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted… |
CVE-2022-32573 | Critical | 9.9 | 2022-12-15 | A directory traversal vulnerability exists in the AssetActions.aspx addDoc functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request ca… |
CVE-2022-29517 | Critical | 9.9 | 2022-12-15 | A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP r… |
CVE-2022-29511 | Medium | 6.5 | 2022-12-15 | A directory traversal vulnerability exists in the KnowledgebasePageActions.aspx ImportArticles functionality of Lansweeper lansweeper 10.1.1.0. A specially-cra… |
CVE-2022-28703 | Medium | 5.4 | 2022-12-15 | A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.1.1.0. A specially-… |
CVE-2022-27498 | Medium | 6.5 | 2022-12-15 | A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. A specially… |
CVE-2022-46768 | Medium | 5.9 | 2022-12-15 | Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation… |
CVE-2022-4506 | High | 8.8 | 2022-12-15 | Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4505 | High | 8.8 | 2022-12-15 | Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4504 | High | 7.5 | 2022-12-15 | Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4503 | Medium | 6.1 | 2022-12-15 | Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4502 | Medium | 6.1 | 2022-12-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4410 | Medium | 6.4 | 2022-12-14 | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output e… |
CVE-2022-3917 | Medium | 4.6 | 2022-12-14 | Improper access control of bootloader function was discovered in Motorola Mobility Motorola e20 prior to version RONS31.267-38-8 allows attacker with local acc… |
CVE-2022-4501 | High | 7.1 | 2022-12-14 | The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to… |
CVE-2022-4283 | High | 7.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bo… |
CVE-2022-47411 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-47410 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-47409 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-47408 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-47407 | Medium | 6.5 | 2022-12-14 | An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a… |
CVE-2022-47406 | Medium | 5.4 | 2022-12-14 | An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fa… |
CVE-2022-46344 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in… |
CVE-2022-46343 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has bee… |
CVE-2022-46342 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been f… |
CVE-2022-46341 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked wi… |
CVE-2022-46340 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the st… |
CVE-2022-3115 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc… |
CVE-2022-3114 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() an… |
CVE-2022-3113 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of th… |
CVE-2022-3112 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return… |
CVE-2022-3111 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY… |
CVE-2022-3110 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. _rtw_init_xmit_priv in drivers/staging/r8188eu/core/rtw_xmit.c lacks check of the return value of… |
CVE-2022-3108 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value… |
CVE-2022-3107 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kv… |
CVE-2022-3106 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kma… |
CVE-2022-3105 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array(). |
CVE-2022-3104 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and… |
CVE-2022-38488 | Critical | 9.8 | 2022-12-14 | logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter. |
CVE-2022-2601 | High | 8.6 | 2022-12-14 | A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, all… |
CVE-2022-31705 | High | 8.2 | 2022-12-14 | VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administra… |
CVE-2022-31703 | High | 7.5 | 2022-12-14 | The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an imp… |
CVE-2022-31702 | Critical | 9.8 | 2022-12-14 | vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network access to the vRNI REST… |
CVE-2022-31701 | Medium | 5.3 | 2022-12-14 | VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Mo… |
CVE-2022-31700 | High | 7.2 | 2022-12-14 | VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue… |
CVE-2022-23741 | High | 7.2 | 2022-12-14 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner… |
CVE-2022-46443 | High | 8.8 | 2022-12-14 | mesinkasir Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter. |
CVE-2022-46256 | High | 8.8 | 2022-12-14 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this… |
CVE-2022-46255 | Critical | 9.8 | 2022-12-14 | An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. A c… |
CVE-2022-46072 | Critical | 9.8 | 2022-12-14 | Helmet Store Showroom v1.0 vulnerable to unauthenticated SQL Injection. |
CVE-2022-46071 | Critical | 9.8 | 2022-12-14 | There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access. |
CVE-2022-44910 | High | 7.8 | 2022-12-14 | Binbloom 2.0 was discovered to contain a heap buffer overflow via the read_pointer function at /binbloom-master/src/helpers.c. |
CVE-2022-23527 | Medium | 4.7 | 2022-12-14 | mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to O… |
CVE-2022-23520 | Medium | 6.1 | 2022-12-14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with cer… |
CVE-2022-46127 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/classes/Master.php?f=delete_product. |
CVE-2022-46126 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/brands/manage_brand.php?id=. |
CVE-2022-46125 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=client/manage_client&id=. |
CVE-2022-46124 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=user/manage_user&id=. |
CVE-2022-46123 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/manage_category.php?id=. |
CVE-2022-46122 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/view_category.php?id=. |
CVE-2022-46121 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/manage_product&id=. |
CVE-2022-46120 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/view_product&id=. |
CVE-2022-46119 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=categories&c=. |
CVE-2022-46118 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=product_per_brand&bid=. |
CVE-2022-46117 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=view_product&id=. |
CVE-2022-46074 | High | 8.8 | 2022-12-14 | Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). An unauthenticated user can add an admin account due to missing CSRF protection. |
CVE-2022-46073 | Medium | 6.1 | 2022-12-14 | Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-23519 | High | 7.2 | 2022-12-14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain conf… |
CVE-2022-23518 | Medium | 6.1 | 2022-12-14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via… |
CVE-2022-23517 | High | 7.5 | 2022-12-14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an ineffici… |
CVE-2022-4495 | Low | 3.5 | 2022-12-14 | A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent up to 1.6. This issue affects the function renderCell of the… |
CVE-2022-46997 | Critical | 9.8 | 2022-12-14 | Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows… |
CVE-2022-46996 | Critical | 9.8 | 2022-12-14 | vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability… |
CVE-2022-46609 | Critical | 9.8 | 2022-12-14 | Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution back… |
CVE-2022-44898 | High | 7.8 | 2022-12-14 | The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, and 0x80102054, allow… |
CVE-2022-44832 | Critical | 9.8 | 2022-12-14 | D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function. |
CVE-2022-31358 | Critical | 9.0 | 2022-12-14 | A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or… |
CVE-2022-23516 | High | 7.5 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recurs… |
CVE-2022-23515 | Medium | 6.1 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerab… |
CVE-2022-23514 | High | 7.5 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficie… |
CVE-2022-23512 | High | 7.7 | 2022-12-14 | MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFi… |
CVE-2022-4494 | Medium | 6.3 | 2022-12-14 | A vulnerability, which was classified as critical, has been found in bspkrs MCPMappingViewer. Affected by this issue is the function extractZip of the file src… |
CVE-2022-4493 | Medium | 6.3 | 2022-12-14 | A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/… |
CVE-2022-3590 | Medium | 5.9 | 2022-12-14 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP r… |