2022 CVEs (page 79)
Page 79 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-28703 | Medium | 5.4 | 2022-12-15 | A stored cross-site scripting vulnerability exists in the HdConfigActions.aspx altertextlanguages functionality of Lansweeper lansweeper 10.1.1.0. A specially-… |
CVE-2022-27498 | Medium | 6.5 | 2022-12-15 | A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. A specially… |
CVE-2022-46768 | Medium | 5.9 | 2022-12-15 | Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation… |
CVE-2022-4506 | High | 8.8 | 2022-12-15 | Unrestricted Upload of File with Dangerous Type in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4505 | High | 8.8 | 2022-12-15 | Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4504 | High | 7.5 | 2022-12-15 | Improper Input Validation in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4503 | Medium | 6.1 | 2022-12-15 | Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4502 | Medium | 6.1 | 2022-12-15 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.2. |
CVE-2022-4410 | Medium | 6.4 | 2022-12-14 | The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output e… |
CVE-2022-3917 | Medium | 4.6 | 2022-12-14 | Improper access control of bootloader function was discovered in Motorola Mobility Motorola e20 prior to version RONS31.267-38-8 allows attacker with local acc… |
CVE-2022-4501 | High | 7.1 | 2022-12-14 | The Mega Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the vc_saving_data function in versions up to… |
CVE-2022-4283 | High | 7.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the XkbCopyNames function left a dangling pointer to freed memory, resulting in out-of-bo… |
CVE-2022-47411 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-47410 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-47409 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-47408 | Critical | 9.1 | 2022-12-14 | An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3… |
CVE-2022-47407 | Medium | 6.5 | 2022-12-14 | An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a… |
CVE-2022-47406 | Medium | 5.4 | 2022-12-14 | An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fa… |
CVE-2022-46344 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIChangeProperty request has a length-validation issues, resulting in… |
CVE-2022-46343 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the ScreenSaverSetAttributes request may write to memory after it has bee… |
CVE-2022-46342 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the XvdiSelectVideoNotify request may write to memory after it has been f… |
CVE-2022-46341 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs because the handler for the XIPassiveUngrab request accesses out-of-bounds memory when invoked wi… |
CVE-2022-46340 | High | 8.8 | 2022-12-14 | A vulnerability was found in X.Org. This security flaw occurs becuase the swap handler for the XTestFakeInput request of the XTest extension may corrupt the st… |
CVE-2022-3115 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. malidp_crtc_reset in drivers/gpu/drm/arm/malidp_crtc.c lacks check of the return value of kzalloc… |
CVE-2022-3114 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. imx_register_uart_clocks in drivers/clk/imx/clk.c lacks check of the return value of kcalloc() an… |
CVE-2022-3113 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. mtk_vcodec_fw_vpu_init in drivers/media/platform/mtk-vcodec/mtk_vcodec_fw_vpu.c lacks check of th… |
CVE-2022-3112 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. amvdec_set_canvases in drivers/staging/media/meson/vdec/vdec_helpers.c lacks check of the return… |
CVE-2022-3111 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. free_charger_irq() in drivers/power/supply/wm8350_power.c lacks free of WM8350_IRQ_CHG_FAST_RDY… |
CVE-2022-3110 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. _rtw_init_xmit_priv in drivers/staging/r8188eu/core/rtw_xmit.c lacks check of the return value of… |
CVE-2022-3108 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. kfd_parse_subtype_iolink in drivers/gpu/drm/amd/amdkfd/kfd_crat.c lacks check of the return value… |
CVE-2022-3107 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. netvsc_get_ethtool_stats in drivers/net/hyperv/netvsc_drv.c lacks check of the return value of kv… |
CVE-2022-3106 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. ef100_update_stats in drivers/net/ethernet/sfc/ef100_nic.c lacks check of the return value of kma… |
CVE-2022-3105 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. uapi_finalize in drivers/infiniband/core/uverbs_uapi.c lacks check of kmalloc_array(). |
CVE-2022-3104 | Medium | 5.5 | 2022-12-14 | An issue was discovered in the Linux kernel through 5.16-rc6. lkdtm_ARRAY_BOUNDS in drivers/misc/lkdtm/bugs.c lacks check of the return value of kmalloc() and… |
CVE-2022-38488 | Critical | 9.8 | 2022-12-14 | logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter. |
CVE-2022-2601 | High | 8.6 | 2022-12-14 | A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, all… |
CVE-2022-31705 | High | 8.2 | 2022-12-14 | VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administra… |
CVE-2022-31703 | High | 7.5 | 2022-12-14 | The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an imp… |
CVE-2022-31702 | Critical | 9.8 | 2022-12-14 | vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network access to the vRNI REST… |
CVE-2022-31701 | Medium | 5.3 | 2022-12-14 | VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Mo… |
CVE-2022-31700 | High | 7.2 | 2022-12-14 | VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue… |
CVE-2022-23741 | High | 7.2 | 2022-12-14 | An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner… |
CVE-2022-46443 | High | 8.8 | 2022-12-14 | mesinkasir Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter. |
CVE-2022-46256 | High | 8.8 | 2022-12-14 | A path traversal vulnerability was identified in GitHub Enterprise Server that allowed remote code execution when building a GitHub Pages site. To exploit this… |
CVE-2022-46255 | Critical | 9.8 | 2022-12-14 | An improper limitation of a pathname to a restricted directory vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. A c… |
CVE-2022-46072 | Critical | 9.8 | 2022-12-14 | Helmet Store Showroom v1.0 vulnerable to unauthenticated SQL Injection. |
CVE-2022-46071 | Critical | 9.8 | 2022-12-14 | There is SQL Injection vulnerability at Helmet Store Showroom v1.0 Login Page. This vulnerability can be exploited to bypass admin access. |
CVE-2022-44910 | High | 7.8 | 2022-12-14 | Binbloom 2.0 was discovered to contain a heap buffer overflow via the read_pointer function at /binbloom-master/src/helpers.c. |
CVE-2022-23527 | Medium | 4.7 | 2022-12-14 | mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to O… |
CVE-2022-23520 | Medium | 6.1 | 2022-12-14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with cer… |
CVE-2022-46127 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/classes/Master.php?f=delete_product. |
CVE-2022-46126 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/brands/manage_brand.php?id=. |
CVE-2022-46125 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=client/manage_client&id=. |
CVE-2022-46124 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=user/manage_user&id=. |
CVE-2022-46123 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/manage_category.php?id=. |
CVE-2022-46122 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/categories/view_category.php?id=. |
CVE-2022-46121 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/manage_product&id=. |
CVE-2022-46120 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/admin/?page=products/view_product&id=. |
CVE-2022-46119 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=categories&c=. |
CVE-2022-46118 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=product_per_brand&bid=. |
CVE-2022-46117 | High | 7.2 | 2022-12-14 | Helmet Store Showroom Site v1.0 is vulnerable to SQL Injection via /hss/?page=view_product&id=. |
CVE-2022-46074 | High | 8.8 | 2022-12-14 | Helmet Store Showroom 1.0 is vulnerable to Cross Site Request Forgery (CSRF). An unauthenticated user can add an admin account due to missing CSRF protection. |
CVE-2022-46073 | Medium | 6.1 | 2022-12-14 | Helmet Store Showroom 1.0 is vulnerable to Cross Site Scripting (XSS). |
CVE-2022-23519 | High | 7.2 | 2022-12-14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain conf… |
CVE-2022-23518 | Medium | 6.1 | 2022-12-14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via… |
CVE-2022-23517 | High | 7.5 | 2022-12-14 | rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an ineffici… |
CVE-2022-4495 | Low | 3.5 | 2022-12-14 | A vulnerability, which was classified as problematic, has been found in collective.dms.basecontent up to 1.6. This issue affects the function renderCell of the… |
CVE-2022-46997 | Critical | 9.8 | 2022-12-14 | Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows… |
CVE-2022-46996 | Critical | 9.8 | 2022-12-14 | vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability… |
CVE-2022-46609 | Critical | 9.8 | 2022-12-14 | Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution back… |
CVE-2022-44898 | High | 7.8 | 2022-12-14 | The MsIo64.sys component in Asus Aura Sync through v1.07.79 does not properly validate input to IOCTL 0x80102040, 0x80102044, 0x80102050, and 0x80102054, allow… |
CVE-2022-44832 | Critical | 9.8 | 2022-12-14 | D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function. |
CVE-2022-31358 | Critical | 9.0 | 2022-12-14 | A reflected cross-site scripting (XSS) vulnerability in Proxmox Virtual Environment prior to v7.2-3 allows remote attackers to execute arbitrary web scripts or… |
CVE-2022-23516 | High | 7.5 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recurs… |
CVE-2022-23515 | Medium | 6.1 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.1.0, < 2.19.1 is vulnerab… |
CVE-2022-23514 | High | 7.5 | 2022-12-14 | Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah < 2.19.1 contains an inefficie… |
CVE-2022-23512 | High | 7.7 | 2022-12-14 | MeterSphere is a one-stop open source continuous testing platform. Versions prior to 2.4.1 are vulnerable to Path Injection in ApiTestCaseService::deleteBodyFi… |
CVE-2022-4494 | Medium | 6.3 | 2022-12-14 | A vulnerability, which was classified as critical, has been found in bspkrs MCPMappingViewer. Affected by this issue is the function extractZip of the file src… |
CVE-2022-4493 | Medium | 6.3 | 2022-12-14 | A vulnerability classified as critical was found in scifio. Affected by this vulnerability is the function downloadAndUnpackResource of the file src/test/java/… |
CVE-2022-3590 | Medium | 5.9 | 2022-12-14 | WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP r… |
CVE-2022-3073 | Medium | 6.1 | 2022-12-14 | Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote… |
CVE-2022-34271 | High | 8.8 | 2022-12-14 | A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from… |
CVE-2022-23504 | Medium | 5.7 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Di… |
CVE-2022-23503 | High | 7.5 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injectio… |
CVE-2022-23502 | Medium | 5.4 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the c… |
CVE-2022-23501 | Medium | 5.9 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Impro… |
CVE-2022-23500 | Medium | 5.9 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing… |
CVE-2022-4440 | High | 8.8 | 2022-12-14 | Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2022-4439 | High | 8.8 | 2022-12-14 | Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactio… |
CVE-2022-4438 | High | 8.8 | 2022-12-14 | Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions… |
CVE-2022-4437 | High | 8.8 | 2022-12-14 | Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2022-4436 | High | 8.8 | 2022-12-14 | Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2022-24377 | High | 7.4 | 2022-12-14 | The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitiza… |
CVE-2022-42141 | Medium | 5.4 | 2022-12-14 | Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Cross Site Scripting (XSS) via lform/urlfilter. |
CVE-2022-42140 | High | 7.2 | 2022-12-14 | Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Command Injection via lform/net_diagnose. |
CVE-2022-42139 | High | 8.8 | 2022-12-14 | Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL. |
CVE-2022-40264 | Medium | 6.3 | 2022-12-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2… |
CVE-2022-37155 | High | 8.8 | 2022-12-14 | RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. |
CVE-2022-44874 | Medium | 5.5 | 2022-12-13 | wasm3 commit 7890a2097569fde845881e0b352d813573e371f9 was discovered to contain a segmentation fault via the component op_CallIndirect at /m3_exec.h. |
CVE-2022-46381 | Medium | 6.1 | 2022-12-13 | Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component). This affects 0.32-… |