2022 CVEs (page 82)
Page 82 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-45871 | Medium | 4.3 | 2022-12-13 | A Denial-of-Service (DoS) vulnerability was discovered in the fsicapd component used in WithSecure products whereby the service may crash while parsing ICAP re… |
CVE-2022-45693 | High | 7.5 | 2022-12-13 | Jettison before v1.5.2 was discovered to contain a stack overflow via the map parameter. This vulnerability allows attackers to cause a Denial of Service (DoS)… |
CVE-2022-45690 | High | 7.5 | 2022-12-13 | A stack overflow in the org.json.JSONTokener.nextValue::JSONTokener.java component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) v… |
CVE-2022-45689 | High | 7.5 | 2022-12-13 | hutool-json v5.8.10 was discovered to contain an out of memory error. |
CVE-2022-45688 | High | 7.5 | 2022-12-13 | A stack overflow in the XML.toJSONObject component of hutool-json v5.8.10 allows attackers to cause a Denial of Service (DoS) via crafted JSON or XML data. |
CVE-2022-45685 | High | 7.5 | 2022-12-13 | A stack overflow in Jettison before v1.5.2 allows attackers to cause a Denial of Service (DoS) via crafted JSON data. |
CVE-2022-44636 | Medium | 4.6 | 2022-12-13 | The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote… |
CVE-2022-44303 | Medium | 6.1 | 2022-12-13 | Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the "{schedule_job}" or "args" p… |
CVE-2022-29580 | High | 8.9 | 2022-12-13 | There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegment. A symbolic encod… |
CVE-2022-46061 | Medium | 6.1 | 2022-12-13 | AeroCMS v0.0.1 is vulnerable to ClickJacking. |
CVE-2022-46058 | Medium | 4.8 | 2022-12-13 | AeroCMS v0.0.1 was discovered to contain a cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary… |
CVE-2022-46047 | Medium | 4.9 | 2022-12-13 | AeroCMS v0.0.1 is vulnerable to SQL Injection via the delete parameter. |
CVE-2022-38124 | Medium | 5.7 | 2022-12-13 | Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner. |
CVE-2022-4446 | Critical | 9.8 | 2022-12-13 | PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0. |
CVE-2022-4444 | Low | 3.5 | 2022-12-13 | A vulnerability was found in ipti br.tag. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation lea… |
CVE-2022-4098 | High | 8.0 | 2022-12-13 | Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in to the WBM of the C… |
CVE-2022-23523 | Medium | 4.0 | 2022-12-13 | In versions prior to 0.8.1, the linux-loader crate uses the offsets and sizes provided in the ELF headers to determine the offsets to read from. If those offse… |
CVE-2022-23505 | Medium | 5.3 | 2022-12-13 | Passport-wsfed-saml2 is a ws-federation protocol and SAML2 tokens authentication provider for Passport. In versions prior to 4.6.3, a remote attacker may be ab… |
CVE-2022-46160 | Medium | 4.3 | 2022-12-13 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.104, project level authorizations… |
CVE-2022-41915 | Medium | 6.5 | 2022-12-13 | Netty project is an event-driven asynchronous network application framework. Starting in version 4.1.83.Final and prior to 4.1.86.Final, when calling `DefaultH… |
CVE-2022-23473 | Medium | 4.3 | 2022-12-13 | Tuleap is an Open Source Suite to improve management of software developments and collaboration. In versions prior to 14.2.99.148, Authorizations are not prope… |
CVE-2022-41275 | Medium | 6.1 | 2022-12-13 | In SAP Solution Manager (Enterprise Search) - versions 740, and 750, an unauthenticated attacker can generate a link that, if clicked by a logged-in user, can… |
CVE-2022-41274 | Medium | 6.5 | 2022-12-13 | SAP Disclosure Management - version 10.1, allows an authenticated attacker to exploit certain misconfigured application endpoints to read sensitive data. These… |
CVE-2022-41273 | Medium | 4.3 | 2022-12-13 | Due to improper input sanitization in SAP Sourcing and SAP Contract Lifecycle Management - version 1100, an attacker can redirect a user to a malicious website… |
CVE-2022-41272 | Critical | 9.9 | 2022-12-13 | An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Int… |
CVE-2022-41271 | Critical | 9.4 | 2022-12-13 | An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50… |
CVE-2022-41268 | High | 8.5 | 2022-12-13 | In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, … |
CVE-2022-41267 | Critical | 9.9 | 2022-12-13 | SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server… |
CVE-2022-41266 | High | 8.0 | 2022-12-13 | Due to a lack of proper input validation, SAP Commerce Webservices 2.0 (Swagger UI) - versions 1905, 2005, 2105, 2011, 2205, allows malicious inputs from untru… |
CVE-2022-41264 | High | 8.8 | 2022-12-13 | Due to the unrestricted scope of the RFC function module, SAP BASIS - versions 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 789, 790, 791, allows an authe… |
CVE-2022-45269 | High | 7.5 | 2022-12-12 | A directory traversal vulnerability in the component SCS.Web.Server.SPI/1.0 of Linx Sphere LINX 7.35.ST15 allows attackers to read arbitrary files. |
CVE-2022-41263 | Medium | 4.3 | 2022-12-12 | Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - versions 420, 430, allows an authenticated non-… |
CVE-2022-41262 | Medium | 6.1 | 2022-12-12 | Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthenticated attacker to inject a script into… |
CVE-2022-41261 | Medium | 6.0 | 2022-12-12 | SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a file containing sensitive data which can… |
CVE-2022-46906 | Medium | 5.4 | 2022-12-12 | Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the… |
CVE-2022-46905 | Medium | 6.1 | 2022-12-12 | Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an unauthenticated attacker to inject arbitrary HTML tags into the page processed by t… |
CVE-2022-46904 | Medium | 5.4 | 2022-12-12 | Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the… |
CVE-2022-46903 | Medium | 5.4 | 2022-12-12 | Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the… |
CVE-2022-45275 | High | 7.2 | 2022-12-12 | An arbitrary file upload vulnerability in /queuing/admin/ajax.php?action=save_settings of Dynamic Transaction Queuing System v1.0 allows attackers to execute a… |
CVE-2022-42716 | High | 8.8 | 2022-12-12 | An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processing operations to gain… |
CVE-2022-4314 | Critical | 9.8 | 2022-12-12 | Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2. |
CVE-2022-4312 | Medium | 5.5 | 2022-12-12 | A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the… |
CVE-2022-4311 | Medium | 4.7 | 2022-12-12 | An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log f… |
CVE-2022-4097 | Medium | 5.3 | 2022-12-12 | The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP block… |
CVE-2022-4016 | Medium | 6.5 | 2022-12-12 | The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress… |
CVE-2022-4010 | Medium | 4.8 | 2022-12-12 | The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2022-4005 | Medium | 5.4 | 2022-12-12 | The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to… |
CVE-2022-4004 | Medium | 4.3 | 2022-12-12 | The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX a… |
CVE-2022-4000 | Medium | 4.8 | 2022-12-12 | The WooCommerce Shipping WordPress plugin through 1.2.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admi… |
CVE-2022-41881 | Medium | 5.3 | 2022-12-12 | Netty project is an event-driven asynchronous network application framework. In versions prior to 4.1.86.Final, a StackOverflowError can be raised when parsing… |
CVE-2022-3999 | High | 8.1 | 2022-12-12 | The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such… |
CVE-2022-3989 | High | 8.8 | 2022-12-12 | The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attac… |
CVE-2022-3982 | Critical | 9.8 | 2022-12-12 | The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upl… |
CVE-2022-3981 | High | 8.8 | 2022-12-12 | The Icegram Express WordPress plugin before 5.5.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL inject… |
CVE-2022-3946 | Medium | 6.5 | 2022-12-12 | The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and… |
CVE-2022-3935 | Medium | 5.4 | 2022-12-12 | The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscribe… |
CVE-2022-3934 | Medium | 5.4 | 2022-12-12 | The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Sc… |
CVE-2022-3933 | Medium | 5.4 | 2022-12-12 | The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to p… |
CVE-2022-3930 | Medium | 6.5 | 2022-12-12 | The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users ins… |
CVE-2022-3925 | High | 7.2 | 2022-12-12 | The buddybadges WordPress plugin through 1.0.0 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploita… |
CVE-2022-3921 | Critical | 9.8 | 2022-12-12 | The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them… |
CVE-2022-3919 | Medium | 4.8 | 2022-12-12 | The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scri… |
CVE-2022-3915 | Critical | 9.8 | 2022-12-12 | The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploi… |
CVE-2022-3912 | High | 7.5 | 2022-12-12 | The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated… |
CVE-2022-3908 | Medium | 6.1 | 2022-12-12 | The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
CVE-2022-3906 | Medium | 4.8 | 2022-12-12 | The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to… |
CVE-2022-3900 | Critical | 9.8 | 2022-12-12 | The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore… |
CVE-2022-3883 | Medium | 6.5 | 2022-12-12 | The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in… |
CVE-2022-3882 | Medium | 6.5 | 2022-12-12 | The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in a… |
CVE-2022-3881 | Medium | 5.7 | 2022-12-12 | The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not… |
CVE-2022-3880 | Medium | 6.5 | 2022-12-12 | The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation… |
CVE-2022-3879 | Medium | 6.5 | 2022-12-12 | The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allo… |
CVE-2022-3862 | Medium | 4.8 | 2022-12-12 | The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such… |
CVE-2022-3853 | Medium | 5.4 | 2022-12-12 | Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including m… |
CVE-2022-3609 | Medium | 4.8 | 2022-12-12 | The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to… |
CVE-2022-3605 | High | 7.8 | 2022-12-12 | The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability. |
CVE-2022-3359 | High | 8.8 | 2022-12-12 | The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object i… |
CVE-2022-45997 | High | 7.2 | 2022-12-12 | Tenda W20E V16.01.0.6(3392) is vulnerable to Buffer Overflow. |
CVE-2022-45996 | High | 7.2 | 2022-12-12 | Tenda W20E V16.01.0.6(3392) is vulnerable to Command injection via cmd_get_ping_output. |
CVE-2022-45980 | High | 8.8 | 2022-12-12 | Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via /goform/SysToolRestoreSet . |
CVE-2022-45979 | High | 7.5 | 2022-12-12 | Tenda AX12 v22.03.01.21_CN was discovered to contain a stack overflow via the ssid parameter at /goform/fast_setting_wifi_set . |
CVE-2022-45977 | High | 8.8 | 2022-12-12 | Tenda AX12 V22.03.01.21_CN was found to have a command injection vulnerability via /goform/setMacFilterCfg function. |
CVE-2022-45957 | High | 7.5 | 2022-12-12 | ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow. |
CVE-2022-45956 | Medium | 5.3 | 2022-12-12 | Boa Web Server versions 0.94.13 through 0.94.14 fail to validate the correct security constraint on the HEAD HTTP method allowing everyone to bypass the Basic… |
CVE-2022-45043 | High | 8.8 | 2022-12-12 | Tenda AX12 V22.03.01.16_cn is vulnerable to command injection via goform/fast_setting_internet_set. |
CVE-2022-4421 | Low | 3.5 | 2022-12-12 | A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view… |
CVE-2022-45970 | Medium | 5.4 | 2022-12-12 | Alist v3.5.1 is vulnerable to Cross Site Scripting (XSS) via the bulletin board. |
CVE-2022-45968 | High | 8.8 | 2022-12-12 | Alist v3.4.0 is vulnerable to File Upload. A user with only file upload permission can upload any file to any folder (even a password protected one). |
CVE-2022-44654 | High | 7.5 | 2022-12-12 | Affected builds of Trend Micro Apex One and Apex One as a Service contain a monitor engine component that is complied without the /SAFESEH memory protection me… |
CVE-2022-44653 | High | 7.8 | 2022-12-12 | A security agent directory traversal vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on aff… |
CVE-2022-44652 | High | 7.8 | 2022-12-12 | An improper handling of exceptional conditions vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privile… |
CVE-2022-44651 | High | 7.0 | 2022-12-12 | A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on af… |
CVE-2022-44650 | High | 7.8 | 2022-12-12 | A memory corruption vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attacker… |
CVE-2022-44649 | High | 7.8 | 2022-12-12 | An out-of-bounds access vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attac… |
CVE-2022-44648 | Medium | 5.5 | 2022-12-12 | An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affecte… |
CVE-2022-44647 | Medium | 5.5 | 2022-12-12 | An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affecte… |
CVE-2022-44533 | High | 7.2 | 2022-12-12 | A vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run arbitrary commands on the underlying host… |
CVE-2022-44532 | Medium | 4.9 | 2022-12-12 | An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of this vulnerability… |
CVE-2022-43780 | High | 7.5 | 2022-12-12 | Certain HP ENVY, OfficeJet, and DeskJet printers may be vulnerable to a Denial of Service attack. |
CVE-2022-43542 | High | 7.2 | 2022-12-12 | Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A… |