2022 CVEs (page 80)
Page 80 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3073 | Medium | 6.1 | 2022-12-14 | Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote… |
CVE-2022-34271 | High | 8.8 | 2022-12-14 | A vulnerability in import module of Apache Atlas allows an authenticated user to write to web server filesystem. This issue affects Apache Atlas versions from… |
CVE-2022-23504 | Medium | 5.7 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. Versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are subject to Sensitive Information Di… |
CVE-2022-23503 | High | 7.5 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. Versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 are vulnerable to Code Injectio… |
CVE-2022-23502 | Medium | 5.4 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 10.4.33, 11.5.20, and 12.1.1, When users reset their password using the c… |
CVE-2022-23501 | Medium | 5.9 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 8.7.49, 9.5.38, 10.4.33, 11.5.20, and 12.1.1 TYPO3 is vulnerable to Impro… |
CVE-2022-23500 | Medium | 5.9 | 2022-12-14 | TYPO3 is an open source PHP based web content management system. In versions prior to 9.5.38, 10.4.33, 11.5.20, and 12.1.1, requesting invalid or non-existing… |
CVE-2022-4440 | High | 8.8 | 2022-12-14 | Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2022-4439 | High | 8.8 | 2022-12-14 | Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactio… |
CVE-2022-4438 | High | 8.8 | 2022-12-14 | Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions… |
CVE-2022-4437 | High | 8.8 | 2022-12-14 | Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (… |
CVE-2022-4436 | High | 8.8 | 2022-12-14 | Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… |
CVE-2022-24377 | High | 7.4 | 2022-12-14 | The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitiza… |
CVE-2022-42141 | Medium | 5.4 | 2022-12-14 | Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Cross Site Scripting (XSS) via lform/urlfilter. |
CVE-2022-42140 | High | 7.2 | 2022-12-14 | Delta Electronics DX-2100-L1-CN 2.42 is vulnerable to Command Injection via lform/net_diagnose. |
CVE-2022-42139 | High | 8.8 | 2022-12-14 | Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL. |
CVE-2022-40264 | Medium | 6.3 | 2022-12-14 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ICONICS/Mitsubishi Electric GENESIS64 versions 10.96 to 10.97.2… |
CVE-2022-37155 | High | 8.8 | 2022-12-14 | RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. |
CVE-2022-44874 | Medium | 5.5 | 2022-12-13 | wasm3 commit 7890a2097569fde845881e0b352d813573e371f9 was discovered to contain a segmentation fault via the component op_CallIndirect at /m3_exec.h. |
CVE-2022-46381 | Medium | 6.1 | 2022-12-13 | Certain Linear eMerge E3-Series devices are vulnerable to XSS via the type parameter (e.g., to the badging/badge_template_v0.php component). This affects 0.32-… |
CVE-2022-43996 | Medium | 5.4 | 2022-12-13 | The csaf_provider package before 0.8.2 allows XSS via a crafted CSAF document uploaded as text/html. The endpoint upload allows valid CSAF advisories (JSON for… |
CVE-2022-41653 | Critical | 9.8 | 2022-12-13 | Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to an attacker obtaining user login credentials and control the system. |
CVE-2022-38355 | High | 7.5 | 2022-12-13 | Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area network (LAN) to disclose… |
CVE-2022-2757 | Critical | 9.8 | 2022-12-13 | Due to the lack of adequately implemented access-control rules, all versions Kingspan TMS300 CS are vulnerable to an attacker viewing and modifying the appl… |
CVE-2022-2660 | Critical | 9.8 | 2022-12-13 | Delta Industrial Automation DIALink versions 1.4.0.0 and prior are vulnerable to the use of a hard-coded cryptographic key which could allow an attacker to dec… |
CVE-2022-4207 | Medium | 5.5 | 2022-12-13 | The Image Hover Effects Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several values that can be added to an Image Hover in ve… |
CVE-2022-4171 | Medium | 6.5 | 2022-12-13 | The demon image annotation plugin for WordPress is vulnerable to improper input validation in versions up to, and including 5.0. This is due to the plugin impr… |
CVE-2022-46404 | Critical | 9.8 | 2022-12-13 | A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before R2.22.18, 10 before 0.2… |
CVE-2022-38628 | Medium | 6.1 | 2022-12-13 | Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting (XSS)… |
CVE-2022-2951 | High | 7.8 | 2022-12-13 | Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to improper validation of array index vulnerability during processing of H3D files. A… |
CVE-2022-2950 | High | 7.8 | 2022-12-13 | Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of H3D files. A DWORD… |
CVE-2022-2949 | High | 7.8 | 2022-12-13 | Altair HyperView Player versions 2021.1.0.27 and prior are vulnerable to the use of uninitialized memory vulnerability during parsing of H3D files. A DWORD… |
CVE-2022-2947 | High | 7.8 | 2022-12-13 | Altair HyperView Player versions 2021.1.0.27 and prior perform operations on a memory buffer but can read from or write to a memory location outside of the… |
CVE-2022-23499 | Medium | 6.1 | 2022-12-13 | HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1… |
CVE-2022-47213 | High | 7.8 | 2022-12-13 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2022-47212 | High | 7.8 | 2022-12-13 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2022-47211 | High | 7.8 | 2022-12-13 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2022-45005 | Critical | 9.8 | 2022-12-13 | IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the cmd_get_ping_output function. |
CVE-2022-44713 | High | 7.5 | 2022-12-13 | Microsoft Outlook for Mac Spoofing Vulnerability |
CVE-2022-44710 | High | 7.8 | 2022-12-13 | DirectX Graphics Kernel Elevation of Privilege Vulnerability |
CVE-2022-44708 | High | 8.3 | 2022-12-13 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability |
CVE-2022-44707 | Medium | 6.5 | 2022-12-13 | Windows Kernel Denial of Service Vulnerability |
CVE-2022-44704 | High | 7.8 | 2022-12-13 | Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability |
CVE-2022-44702 | High | 7.8 | 2022-12-13 | Windows Terminal Remote Code Execution Vulnerability |
CVE-2022-44699 | Medium | 5.5 | 2022-12-13 | Azure Network Watcher Agent Security Feature Bypass Vulnerability |
CVE-2022-44698 | Medium | 5.4 | 2022-12-13 | Windows SmartScreen Security Feature Bypass Vulnerability |
CVE-2022-44697 | High | 7.8 | 2022-12-13 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2022-44696 | High | 7.8 | 2022-12-13 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-44695 | High | 7.8 | 2022-12-13 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-44694 | High | 7.8 | 2022-12-13 | Microsoft Office Visio Remote Code Execution Vulnerability |
CVE-2022-44693 | High | 8.8 | 2022-12-13 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2022-44692 | High | 7.8 | 2022-12-13 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2022-44691 | High | 7.8 | 2022-12-13 | Microsoft Office OneNote Remote Code Execution Vulnerability |
CVE-2022-44690 | High | 8.8 | 2022-12-13 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2022-44689 | High | 7.8 | 2022-12-13 | Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability |
CVE-2022-44688 | Medium | 4.3 | 2022-12-13 | Microsoft Edge (Chromium-based) Spoofing Vulnerability |
CVE-2022-44687 | High | 7.8 | 2022-12-13 | Raw Image Extension Remote Code Execution Vulnerability |
CVE-2022-44683 | High | 7.8 | 2022-12-13 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2022-44682 | Medium | 6.8 | 2022-12-13 | Windows Hyper-V Denial of Service Vulnerability |
CVE-2022-44681 | High | 7.8 | 2022-12-13 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-44680 | High | 7.8 | 2022-12-13 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2022-44679 | Medium | 6.5 | 2022-12-13 | Windows Graphics Component Information Disclosure Vulnerability |
CVE-2022-44678 | High | 7.8 | 2022-12-13 | Windows Print Spooler Elevation of Privilege Vulnerability |
CVE-2022-44677 | High | 7.8 | 2022-12-13 | Windows Projected File System Elevation of Privilege Vulnerability |
CVE-2022-44676 | High | 8.1 | 2022-12-13 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2022-44675 | High | 7.8 | 2022-12-13 | Windows Bluetooth Driver Elevation of Privilege Vulnerability |
CVE-2022-44674 | Medium | 5.5 | 2022-12-13 | Windows Bluetooth Driver Information Disclosure Vulnerability |
CVE-2022-44673 | High | 7.0 | 2022-12-13 | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability |
CVE-2022-44671 | High | 7.8 | 2022-12-13 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2022-44670 | High | 8.1 | 2022-12-13 | Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability |
CVE-2022-44669 | High | 7.0 | 2022-12-13 | Windows Error Reporting Elevation of Privilege Vulnerability |
CVE-2022-44668 | High | 7.8 | 2022-12-13 | Windows Media Remote Code Execution Vulnerability |
CVE-2022-44667 | High | 7.8 | 2022-12-13 | Windows Media Remote Code Execution Vulnerability |
CVE-2022-44666 | High | 7.8 | 2022-12-13 | Windows Contacts Remote Code Execution Vulnerability |
CVE-2022-41563 | Critical | 9.0 | 2022-12-13 | The Dashboard component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Developer Edition, TIBCO… |
CVE-2022-41562 | High | 8.4 | 2022-12-13 | The HTML escaping component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TI… |
CVE-2022-41561 | Critical | 9.1 | 2022-12-13 | The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition… |
CVE-2022-41127 | High | 8.5 | 2022-12-13 | Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability |
CVE-2022-41121 | High | 7.8 | 2022-12-13 | Windows Graphics Component Elevation of Privilege Vulnerability |
CVE-2022-41115 | Medium | 6.6 | 2022-12-13 | Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability |
CVE-2022-41094 | High | 7.8 | 2022-12-13 | Windows Hyper-V Elevation of Privilege Vulnerability |
CVE-2022-41089 | High | 7.8 | 2022-12-13 | .NET Framework Remote Code Execution Vulnerability |
CVE-2022-41077 | High | 7.8 | 2022-12-13 | Windows Fax Compose Form Elevation of Privilege Vulnerability |
CVE-2022-41076 | High | 8.5 | 2022-12-13 | PowerShell Remote Code Execution Vulnerability |
CVE-2022-41074 | Medium | 5.5 | 2022-12-13 | Windows Graphics Component Information Disclosure Vulnerability |
CVE-2022-26806 | High | 7.8 | 2022-12-13 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2022-26805 | High | 7.8 | 2022-12-13 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2022-26804 | High | 7.8 | 2022-12-13 | Microsoft Office Graphics Remote Code Execution Vulnerability |
CVE-2022-24480 | Medium | 6.3 | 2022-12-13 | Outlook for Android Elevation of Privilege Vulnerability |
CVE-2022-4456 | Low | 3.5 | 2022-12-13 | A vulnerability has been found in falling-fruit and classified as problematic. This vulnerability affects unknown code. The manipulation leads to cross site sc… |
CVE-2022-4455 | Low | 3.5 | 2022-12-13 | A vulnerability was identified in sproctor php-calendar up to 2.0.13. This impacts an unknown function of the file index.php. Such manipulation of the argument… |
CVE-2022-4454 | Medium | 5.5 | 2022-12-13 | A vulnerability, which was classified as critical, has been found in m0ver bible-online. Affected by this issue is the function query of the file src/main/java… |
CVE-2022-45028 | Medium | 6.1 | 2022-12-13 | A cross-site scripting (XSS) vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request sen… |
CVE-2022-46364 | Critical | 9.8 | 2022-12-13 | A SSRF vulnerability in parsing the href attribute of XOP:Include in MTOM requests in versions of Apache CXF before 3.5.5 and 3.4.10 allows an attacker to perf… |
CVE-2022-46062 | Medium | 4.5 | 2022-12-13 | Gym Management System v0.0.1 is vulnerable to Cross Site Request Forgery (CSRF). |
CVE-2022-27518 | Critical | 9.8 | 2022-12-13 | Unauthenticated remote arbitrary code execution |
CVE-2022-4223 | High | 8.8 | 2022-12-13 | The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg… |
CVE-2022-46834 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data… |
CVE-2022-46833 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data… |
CVE-2022-46832 | Medium | 6.5 | 2022-12-13 | Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data i… |