2022 CVEs (page 87)
Page 87 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-43548 | High | 8.1 | 2022-12-05 | A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easil… |
CVE-2022-40259 | High | 8.3 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-40242 | High | 7.5 | 2022-12-05 | MegaRAC Default Credentials Vulnerability |
CVE-2022-35260 | Medium | 6.5 | 2022-12-05 | curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould f… |
CVE-2022-35259 | High | 7.8 | 2022-12-05 | XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorized privileges. |
CVE-2022-35258 | High | 7.5 | 2022-12-05 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R1… |
CVE-2022-35256 | Medium | 6.5 | 2022-12-05 | The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request… |
CVE-2022-35255 | Critical | 9.1 | 2022-12-05 | A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/c… |
CVE-2022-35254 | High | 7.5 | 2022-12-05 | An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R1… |
CVE-2022-32224 | Critical | 9.8 | 2022-12-05 | A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could al… |
CVE-2022-32221 | Critical | 9.8 | 2022-12-05 | When doing HTTP(S) transfers, libcurl might erroneously use the read callback (`CURLOPT_READFUNCTION`) to ask for data to send, even when the `CURLOPT_POSTFIEL… |
CVE-2022-30123 | Critical | 10.0 | 2022-12-05 | A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger com… |
CVE-2022-30122 | High | 7.5 | 2022-12-05 | A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack. |
CVE-2022-2827 | High | 7.5 | 2022-12-05 | AMI MegaRAC User Enumeration Vulnerability |
CVE-2022-27773 | Critical | 9.8 | 2022-12-05 | A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elevated privileges. |
CVE-2022-23143 | Medium | 6.5 | 2022-12-05 | ZTE OTCP product is impacted by a permission and access control vulnerability. Due to improper permission settings, an attacker with high permissions could use… |
CVE-2022-46169 | Critical | 9.8 | 2022-12-05 | Cacti is an open source platform which provides a robust and extensible operational monitoring and fault management framework for users. In affected versions a… |
CVE-2022-46164 | Critical | 9.4 | 2022-12-05 | NodeBB is an open source Node.js based forum software. Due to a plain object with a prototype being used in socket.io message handling a specially crafted payl… |
CVE-2022-45481 | Critical | 9.8 | 2022-12-05 | The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with no prior authorizatio… |
CVE-2022-45479 | Critical | 9.8 | 2022-12-05 | PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authenticati… |
CVE-2022-44039 | Critical | 9.8 | 2022-12-05 | Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact is: File system rewrite (remote). ¶¶ An attacker can overwrit… |
CVE-2022-42706 | Medium | 4.9 | 2022-12-05 | An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk… |
CVE-2022-42705 | Medium | 6.5 | 2022-12-05 | A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Aste… |
CVE-2022-37783 | High | 7.5 | 2022-12-05 | All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens… |
CVE-2022-37325 | High | 7.5 | 2022-12-05 | In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a ma… |
CVE-2022-45771 | High | 8.8 | 2022-12-05 | An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file. |
CVE-2022-43516 | Medium | 6.5 | 2022-12-05 | A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent in… |
CVE-2022-43097 | Medium | 5.4 | 2022-12-05 | Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the firstna… |
CVE-2022-23467 | Medium | 4.4 | 2022-12-05 | OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified USB device an attac… |
CVE-2022-4293 | Medium | 5.5 | 2022-12-05 | Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. |
CVE-2022-4292 | High | 7.8 | 2022-12-05 | Use After Free in GitHub repository vim/vim prior to 9.0.0882. |
CVE-2022-43515 | Medium | 5.3 | 2022-12-05 | Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any us… |
CVE-2022-3926 | Medium | 6.5 | 2022-12-05 | The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to mak… |
CVE-2022-3909 | Medium | 4.8 | 2022-12-05 | The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2022-3907 | High | 7.5 | 2022-12-05 | The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operat… |
CVE-2022-3892 | Medium | 4.8 | 2022-12-05 | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such a… |
CVE-2022-3858 | High | 7.2 | 2022-12-05 | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and… |
CVE-2022-3856 | High | 7.2 | 2022-12-05 | The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL in… |
CVE-2022-3846 | High | 7.5 | 2022-12-05 | The Workreap WordPress theme before 2.6.3 has a vulnerability with the notifications feature as it's possible to read any user's notification (employer or free… |
CVE-2022-3838 | Medium | 4.8 | 2022-12-05 | The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-3837 | Medium | 4.8 | 2022-12-05 | The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2022-3830 | Medium | 4.8 | 2022-12-05 | The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2022-3694 | High | 7.5 | 2022-12-05 | The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account. |
CVE-2022-3677 | Medium | 6.5 | 2022-12-05 | The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged… |
CVE-2022-3426 | Medium | 4.8 | 2022-12-05 | The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-3249 | High | 7.2 | 2022-12-05 | The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high pri… |
CVE-2022-1540 | High | 7.2 | 2022-12-05 | The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitra… |
CVE-2022-4269 | Medium | 5.5 | 2022-12-05 | A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC… |
CVE-2022-45478 | Medium | 5.9 | 2022-12-05 | Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVS… |
CVE-2022-45477 | Critical | 9.8 | 2022-12-05 | Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authentication… |
CVE-2022-45315 | Medium | 6.4 | 2022-12-05 | Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to… |
CVE-2022-45313 | High | 8.8 | 2022-12-05 | Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arb… |
CVE-2022-32634 | Medium | 6.7 | 2022-12-05 | In ccci, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-32633 | Medium | 6.7 | 2022-12-05 | In Wi-Fi, there is a possible memory access violation due to a logic error. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2022-32632 | Medium | 6.7 | 2022-12-05 | In Wi-Fi, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2022-32631 | Medium | 6.7 | 2022-12-05 | In Wi-Fi, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2022-32630 | Medium | 6.7 | 2022-12-05 | In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with Sy… |
CVE-2022-32629 | Medium | 6.7 | 2022-12-05 | In isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-32628 | Medium | 6.7 | 2022-12-05 | In isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-32626 | Medium | 6.7 | 2022-12-05 | In display, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-32625 | Medium | 6.7 | 2022-12-05 | In display, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-32624 | Medium | 6.7 | 2022-12-05 | In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with Sy… |
CVE-2022-32622 | Medium | 6.7 | 2022-12-05 | In gz, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2022-32621 | Medium | 6.4 | 2022-12-05 | In isp, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges need… |
CVE-2022-32620 | Medium | 6.7 | 2022-12-05 | In mpu, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32619 | Medium | 6.7 | 2022-12-05 | In keyinstall, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2022-32598 | Medium | 6.7 | 2022-12-05 | In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-32597 | Medium | 6.7 | 2022-12-05 | In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-32596 | Medium | 6.7 | 2022-12-05 | In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-32594 | Medium | 6.7 | 2022-12-05 | In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-45824 | Medium | 5.4 | 2022-12-05 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress. |
CVE-2022-45822 | Critical | 10.0 | 2022-12-05 | Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress. |
CVE-2022-4282 | Medium | 4.7 | 2022-12-05 | A vulnerability was found in SpringBootCMS and classified as critical. Affected by this issue is some unknown functionality of the component Template Managemen… |
CVE-2022-4281 | Medium | 6.3 | 2022-12-05 | A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognit… |
CVE-2022-43504 | Medium | 5.3 | 2022-12-05 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who… |
CVE-2022-43500 | Medium | 6.1 | 2022-12-05 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer a… |
CVE-2022-43499 | Medium | 5.4 | 2022-12-05 | Stored cross-site scripting vulnerability in SHIRASAGI versions prior to v1.16.2 allows a remote authenticated attacker with an administrative privilege to inj… |
CVE-2022-43497 | Medium | 6.1 | 2022-12-05 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer a… |
CVE-2022-43487 | Medium | 6.1 | 2022-12-05 | Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitrary script. |
CVE-2022-43484 | High | 7.8 | 2022-12-05 | TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader ma… |
CVE-2022-43479 | Medium | 6.1 | 2022-12-05 | Open redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated attacker to redirect users to an arbitrary web site and conduct a p… |
CVE-2022-43470 | High | 7.3 | 2022-12-05 | Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and earlier, +F FS030W so… |
CVE-2022-43442 | Medium | 4.6 | 2022-12-05 | Plaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and earlier, which may allow an attacker to obtain the login passwor… |
CVE-2022-42496 | Critical | 9.8 | 2022-12-05 | OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of th… |
CVE-2022-41830 | Medium | 4.8 | 2022-12-05 | Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privile… |
CVE-2022-41807 | Medium | 6.5 | 2022-12-05 | Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product se… |
CVE-2022-41798 | Medium | 6.5 | 2022-12-05 | Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log i… |
CVE-2022-41777 | High | 7.5 | 2022-12-05 | Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote… |
CVE-2022-41642 | Critical | 9.8 | 2022-12-05 | OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS command when processing co… |
CVE-2022-40968 | Medium | 4.8 | 2022-12-04 | Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress. |
CVE-2022-35730 | Medium | 4.3 | 2022-12-04 | Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress. |
CVE-2022-35508 | Critical | 9.8 | 2022-12-04 | Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. A… |
CVE-2022-35507 | High | 7.1 | 2022-12-04 | A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker t… |
CVE-2022-46414 | Critical | 9.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command execution can occur vi… |
CVE-2022-46413 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Authenticated remote command execution can occur via… |
CVE-2022-46412 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0. A non-privileged user may escape a restricted shell and execute privileged commands. |
CVE-2022-46411 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after installation an… |
CVE-2022-46410 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0. An attacker with non-root privileges may escalate privileges to root by using specific com… |
CVE-2022-46405 | High | 7.5 | 2022-12-04 | Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accoun… |
CVE-2022-46391 | Medium | 6.1 | 2022-12-04 | AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks. |