2022 CVEs (page 87)
Page 87 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-44039 | Critical | 9.8 | 2022-12-05 | Franklin Fueling System FFS Colibri 1.9.22.8925 is affected by: File system overwrite. The impact is: File system rewrite (remote). ¶¶ An attacker can overwrit… |
CVE-2022-42706 | Medium | 4.9 | 2022-12-05 | An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk… |
CVE-2022-42705 | Medium | 6.5 | 2022-12-05 | A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Aste… |
CVE-2022-37783 | High | 7.5 | 2022-12-05 | All Craft CMS versions between 3.0.0 and 3.7.32 disclose password hashes of users who authenticate using their E-Mail address or username in Anti-CSRF-Tokens… |
CVE-2022-37325 | High | 7.5 | 2022-12-05 | In Sangoma Asterisk through 16.28.0, 17.x and 18.x through 18.14.0, and 19.x through 19.6.0, an incoming Setup message to addons/ooh323c/src/ooq931.c with a ma… |
CVE-2022-45771 | High | 8.8 | 2022-12-05 | An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file. |
CVE-2022-43516 | Medium | 6.5 | 2022-12-05 | A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent in… |
CVE-2022-43097 | Medium | 5.4 | 2022-12-05 | Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the firstna… |
CVE-2022-23467 | Medium | 4.4 | 2022-12-05 | OpenRazer is an open source driver and user-space daemon to control Razer device lighting and other features on GNU/Linux. Using a modified USB device an attac… |
CVE-2022-4293 | Medium | 5.5 | 2022-12-05 | Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. |
CVE-2022-4292 | High | 7.8 | 2022-12-05 | Use After Free in GitHub repository vim/vim prior to 9.0.0882. |
CVE-2022-43515 | Medium | 5.3 | 2022-12-05 | Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addresses can access it. In this way, any us… |
CVE-2022-3926 | Medium | 6.5 | 2022-12-05 | The WP OAuth Server (OAuth Authentication) WordPress plugin before 3.4.2 does not have CSRF check when regenerating secrets, which could allow attackers to mak… |
CVE-2022-3909 | Medium | 4.8 | 2022-12-05 | The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2022-3907 | High | 7.5 | 2022-12-05 | The Clerk WordPress plugin before 4.0.0 is affected by time-based attacks in the validation function for all API requests due to the usage of comparison operat… |
CVE-2022-3892 | Medium | 4.8 | 2022-12-05 | The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such a… |
CVE-2022-3858 | High | 7.2 | 2022-12-05 | The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and… |
CVE-2022-3856 | High | 7.2 | 2022-12-05 | The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL in… |
CVE-2022-3846 | High | 7.5 | 2022-12-05 | The Workreap WordPress theme before 2.6.3 has a vulnerability with the notifications feature as it's possible to read any user's notification (employer or free… |
CVE-2022-3838 | Medium | 4.8 | 2022-12-05 | The WPUpper Share Buttons WordPress plugin through 3.42 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-3837 | Medium | 4.8 | 2022-12-05 | The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perf… |
CVE-2022-3830 | Medium | 4.8 | 2022-12-05 | The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to p… |
CVE-2022-3694 | High | 7.5 | 2022-12-05 | The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account. |
CVE-2022-3677 | Medium | 6.5 | 2022-12-05 | The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged… |
CVE-2022-3426 | Medium | 4.8 | 2022-12-05 | The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin… |
CVE-2022-3249 | High | 7.2 | 2022-12-05 | The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high pri… |
CVE-2022-1540 | High | 7.2 | 2022-12-05 | The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitra… |
CVE-2022-4269 | Medium | 5.5 | 2022-12-05 | A flaw was found in the Linux kernel Traffic Control (TC) subsystem. Using a specific networking configuration (redirecting egress packets to ingress using TC… |
CVE-2022-45478 | Medium | 5.9 | 2022-12-05 | Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses) in cleartext. CVS… |
CVE-2022-45477 | Critical | 9.8 | 2022-12-05 | Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization or authentication… |
CVE-2022-45315 | Medium | 6.4 | 2022-12-05 | Mikrotik RouterOs before stable v7.6 was discovered to contain an out-of-bounds read in the snmp process. This vulnerability allows authenticated attackers to… |
CVE-2022-45313 | High | 8.8 | 2022-12-05 | Mikrotik RouterOs before stable v7.5 was discovered to contain an out-of-bounds read in the hotspot process. This vulnerability allows attackers to execute arb… |
CVE-2022-32634 | Medium | 6.7 | 2022-12-05 | In ccci, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution privi… |
CVE-2022-32633 | Medium | 6.7 | 2022-12-05 | In Wi-Fi, there is a possible memory access violation due to a logic error. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2022-32632 | Medium | 6.7 | 2022-12-05 | In Wi-Fi, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2022-32631 | Medium | 6.7 | 2022-12-05 | In Wi-Fi, there is a possible out of bounds write due to improper input validation. This could lead to local escalation of privilege with System execution priv… |
CVE-2022-32630 | Medium | 6.7 | 2022-12-05 | In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with Sy… |
CVE-2022-32629 | Medium | 6.7 | 2022-12-05 | In isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-32628 | Medium | 6.7 | 2022-12-05 | In isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privilege… |
CVE-2022-32626 | Medium | 6.7 | 2022-12-05 | In display, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-32625 | Medium | 6.7 | 2022-12-05 | In display, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution pr… |
CVE-2022-32624 | Medium | 6.7 | 2022-12-05 | In throttling, there is a possible out of bounds write due to an incorrect calculation of buffer size. This could lead to local escalation of privilege with Sy… |
CVE-2022-32622 | Medium | 6.7 | 2022-12-05 | In gz, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges n… |
CVE-2022-32621 | Medium | 6.4 | 2022-12-05 | In isp, there is a possible out of bounds write due to a race condition. This could lead to local escalation of privilege with System execution privileges need… |
CVE-2022-32620 | Medium | 6.7 | 2022-12-05 | In mpu, there is a possible memory corruption due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. U… |
CVE-2022-32619 | Medium | 6.7 | 2022-12-05 | In keyinstall, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution… |
CVE-2022-32598 | Medium | 6.7 | 2022-12-05 | In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-32597 | Medium | 6.7 | 2022-12-05 | In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-32596 | Medium | 6.7 | 2022-12-05 | In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-32594 | Medium | 6.7 | 2022-12-05 | In widevine, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with System execution p… |
CVE-2022-45824 | Medium | 5.4 | 2022-12-05 | Cross-Site Request Forgery (CSRF) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress. |
CVE-2022-45822 | Critical | 10.0 | 2022-12-05 | Unauth. SQL Injection (SQLi) vulnerability in Advanced Booking Calendar plugin <= 1.7.1 on WordPress. |
CVE-2022-4282 | Medium | 4.7 | 2022-12-05 | A vulnerability was found in SpringBootCMS and classified as critical. Affected by this issue is some unknown functionality of the component Template Managemen… |
CVE-2022-4281 | Medium | 6.3 | 2022-12-05 | A vulnerability has been found in Facepay 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /face-recognit… |
CVE-2022-43504 | Medium | 5.3 | 2022-12-05 | Improper authentication vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to obtain the email address of the user who… |
CVE-2022-43500 | Medium | 6.1 | 2022-12-05 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer a… |
CVE-2022-43499 | Medium | 5.4 | 2022-12-05 | Stored cross-site scripting vulnerability in SHIRASAGI versions prior to v1.16.2 allows a remote authenticated attacker with an administrative privilege to inj… |
CVE-2022-43497 | Medium | 6.1 | 2022-12-05 | Cross-site scripting vulnerability in WordPress versions prior to 6.0.3 allows a remote unauthenticated attacker to inject an arbitrary script. The developer a… |
CVE-2022-43487 | Medium | 6.1 | 2022-12-05 | Cross-site scripting vulnerability in Salon booking system versions prior to 7.9 allows a remote unauthenticated attacker to inject an arbitrary script. |
CVE-2022-43484 | High | 7.8 | 2022-12-05 | TERASOLUNA Global Framework 1.0.0 (Public review version) and TERASOLUNA Server Framework for Java (Rich) 2.0.0.2 to 2.0.5.1 are vulnerable to a ClassLoader ma… |
CVE-2022-43479 | Medium | 6.1 | 2022-12-05 | Open redirect vulnerability in SHIRASAGI v1.14.4 to v1.15.0 allows a remote unauthenticated attacker to redirect users to an arbitrary web site and conduct a p… |
CVE-2022-43470 | High | 7.3 | 2022-12-05 | Cross-site request forgery (CSRF) vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and earlier, +F FS030W so… |
CVE-2022-43442 | Medium | 4.6 | 2022-12-05 | Plaintext storage of a password vulnerability exists in +F FS040U software versions v2.3.4 and earlier, which may allow an attacker to obtain the login passwor… |
CVE-2022-42496 | Critical | 9.8 | 2022-12-05 | OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to obtain appkey of th… |
CVE-2022-41830 | Medium | 4.8 | 2022-12-05 | Stored cross-site scripting vulnerability in Kyocera Document Solutions MFPs and printers allows a remote authenticated attacker with an administrative privile… |
CVE-2022-41807 | Medium | 6.5 | 2022-12-05 | Missing authorization vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to alter the product se… |
CVE-2022-41798 | Medium | 6.5 | 2022-12-05 | Session information easily guessable vulnerability exists in Kyocera Document Solutions MFPs and printers, which may allow a network-adjacent attacker to log i… |
CVE-2022-41777 | High | 7.5 | 2022-12-05 | Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote… |
CVE-2022-41642 | Critical | 9.8 | 2022-12-05 | OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS command when processing co… |
CVE-2022-40968 | Medium | 4.8 | 2022-12-04 | Reflected Cross-Site Scripting (XSS) vulnerability in 2kb Amazon Affiliates Store plugin <=2.1.5 on WordPress. |
CVE-2022-35730 | Medium | 4.3 | 2022-12-04 | Cross-Site Request Forgery (CSRF) vulnerability in Oceanwp sticky header plugin <= 1.0.8 on WordPress. |
CVE-2022-35508 | Critical | 9.8 | 2022-12-04 | Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) are vulnerable to SSRF when proxying HTTP requests between pve(pmg)proxy and pve(pmg)daemon. A… |
CVE-2022-35507 | High | 7.1 | 2022-12-04 | A response-header CRLF injection vulnerability in the Proxmox Virtual Environment (PVE) and Proxmox Mail Gateway (PMG) web interface allows a remote attacker t… |
CVE-2022-46414 | Critical | 9.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Unauthenticated remote command execution can occur vi… |
CVE-2022-46413 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Authenticated remote command execution can occur via… |
CVE-2022-46412 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0. A non-privileged user may escape a restricted shell and execute privileged commands. |
CVE-2022-46411 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. A default password is persisted after installation an… |
CVE-2022-46410 | High | 8.8 | 2022-12-04 | An issue was discovered in Veritas NetBackup Flex Scale through 3.0. An attacker with non-root privileges may escalate privileges to root by using specific com… |
CVE-2022-46405 | High | 7.5 | 2022-12-04 | Mastodon through 4.0.2 allows attackers to cause a denial of service (large Sidekiq pull queue) by creating bot accounts that follow attacker-controlled accoun… |
CVE-2022-46391 | Medium | 6.1 | 2022-12-04 | AWStats 7.x through 7.8 allows XSS in the hostinfo plugin due to printing a response from Net::XWhois without proper checks. |
CVE-2022-4280 | Medium | 4.3 | 2022-12-03 | A vulnerability, which was classified as problematic, has been found in Dot Tech Smart Campus System. Affected by this issue is some unknown functionality of t… |
CVE-2022-4279 | Low | 3.5 | 2022-12-03 | A vulnerability classified as problematic has been found in SourceCodester Human Resource Management System 1.0. Affected is an unknown function of the file /h… |
CVE-2022-4278 | Medium | 4.7 | 2022-12-03 | A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been rated as critical. This issue affects some unknown processing of… |
CVE-2022-4277 | Medium | 6.3 | 2022-12-03 | A vulnerability was found in Shaoxing Background Management System. It has been declared as critical. This vulnerability affects unknown code of the file /Defa… |
CVE-2022-4276 | Medium | 6.3 | 2022-12-03 | A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php… |
CVE-2022-4275 | Medium | 6.3 | 2022-12-03 | A vulnerability has been found in House Rental System and classified as critical. Affected by this vulnerability is an unknown functionality of the file search… |
CVE-2022-4274 | Medium | 6.3 | 2022-12-03 | A vulnerability, which was classified as critical, was found in House Rental System. Affected is an unknown function of the file /view-property.php. The manipu… |
CVE-2022-3491 | High | 7.8 | 2022-12-03 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742. |
CVE-2022-4273 | High | 7.3 | 2022-12-03 | A vulnerability, which was classified as critical, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown proce… |
CVE-2022-4272 | Medium | 6.3 | 2022-12-03 | A vulnerability, which was classified as critical, has been found in FeMiner wms. Affected by this issue is some unknown functionality of the file /product/sav… |
CVE-2022-23465 | High | 7.1 | 2022-12-02 | SwiftTerm is a Xterm/VT100 Terminal emulator. Prior to commit a94e6b24d24ce9680ad79884992e1dff8e150a31, an attacker could modify the window title via a certain… |
CVE-2022-4262 | High | 8.8 | 2022-12-02 | Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2022-4220 | Medium | 5.4 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce valid… |
CVE-2022-4219 | Medium | 5.4 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce valid… |
CVE-2022-4218 | Medium | 5.4 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce valid… |
CVE-2022-4217 | Medium | 5.5 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to… |
CVE-2022-4216 | Medium | 5.5 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2… |
CVE-2022-4215 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to… |
CVE-2022-4214 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ip' parameter on the 'chainedquiz_list' page in versions up to… |
CVE-2022-4213 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to… |