2022 CVEs (page 88)
Page 88 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-4212 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page in versions up to… |
CVE-2022-4211 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up… |
CVE-2022-4210 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to… |
CVE-2022-4209 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up… |
CVE-2022-4208 | Medium | 6.1 | 2022-12-02 | The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up t… |
CVE-2022-44962 | Medium | 5.4 | 2022-12-02 | webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php. This vulnerability allows att… |
CVE-2022-44961 | Medium | 5.4 | 2022-12-02 | webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php. This vulnerability allows attacker… |
CVE-2022-44960 | Medium | 5.4 | 2022-12-02 | webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /general/search.php?searchtype=simple. This vulnerability… |
CVE-2022-44959 | Medium | 5.4 | 2022-12-02 | webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. This vulnerability allows att… |
CVE-2022-44957 | Medium | 5.4 | 2022-12-02 | webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attac… |
CVE-2022-44956 | Medium | 5.4 | 2022-12-02 | webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /projects/listprojects.php. This vulnerability allows att… |
CVE-2022-44955 | Medium | 5.4 | 2022-12-02 | webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the Chat function. This vulnerability allows attackers to execute arbit… |
CVE-2022-44954 | Medium | 5.4 | 2022-12-02 | webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php. This vulnerability allows att… |
CVE-2022-44953 | Medium | 5.4 | 2022-12-02 | webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php. This vulnerability allows a… |
CVE-2022-44952 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerabili… |
CVE-2022-44951 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/f… |
CVE-2022-44950 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fiel… |
CVE-2022-44949 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fiel… |
CVE-2022-44948 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entit… |
CVE-2022-44947 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listi… |
CVE-2022-44946 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&e… |
CVE-2022-44945 | Critical | 9.8 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter. |
CVE-2022-44944 | Medium | 5.4 | 2022-12-02 | Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages… |
CVE-2022-44291 | Critical | 9.8 | 2022-12-02 | webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php. |
CVE-2022-44290 | Critical | 9.8 | 2022-12-02 | webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php. |
CVE-2022-3086 | High | 7.1 | 2022-12-02 | Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable to shell escape, which enables local attackers with non-superuser credentials to gain… |
CVE-2022-2642 | High | 7.5 | 2022-12-02 | Horner Automation’s RCC 972 firmware version 15.40 contains global variables. This could allow an attacker to read out sensitive values and variable keys from… |
CVE-2022-2641 | Critical | 9.8 | 2022-12-02 | Horner Automation’s RCC 972 with firmware version 15.40 has a static encryption key on the device. This could allow an attacker to perform unauthorized changes… |
CVE-2022-2640 | High | 7.5 | 2022-12-02 | The Config-files of Horner Automation’s RCC 972 with firmware version 15.40 are encrypted with weak XOR encryption vulnerable to reverse engineering. This coul… |
CVE-2022-46167 | High | 8.8 | 2022-12-02 | Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to version 0.1.3, a ServiceAccount deployed in a Tenant Namespace, when granted wit… |
CVE-2022-3520 | Critical | 9.8 | 2022-12-02 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765. |
CVE-2022-46145 | High | 8.1 | 2022-12-02 | authentik is an open-source identity provider. Versions prior to 2022.11.2 and 2022.10.2 are vulnerable to unauthorized user creation and potential account tak… |
CVE-2022-45672 | High | 7.5 | 2022-12-02 | Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the formWx3AuthorizeSet function. |
CVE-2022-45671 | High | 7.5 | 2022-12-02 | Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the appData parameter in the formSetAppFilterRule function. |
CVE-2022-45670 | High | 7.5 | 2022-12-02 | Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the ping1 parameter in the formSetAutoPing function. |
CVE-2022-45669 | High | 7.5 | 2022-12-02 | Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterGet function. |
CVE-2022-45668 | Medium | 6.5 | 2022-12-02 | Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. |
CVE-2022-45667 | Medium | 6.5 | 2022-12-02 | Tenda i22 V1.0.0.3(4687) is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet. |
CVE-2022-45664 | High | 7.5 | 2022-12-02 | Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the list parameter in the formwrlSSIDget function. |
CVE-2022-45663 | High | 7.5 | 2022-12-02 | Tenda i22 V1.0.0.3(4687) was discovered to contain a buffer overflow via the index parameter in the formWifiMacFilterSet function. |
CVE-2022-45661 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the setSmartPowerManagement function. |
CVE-2022-45660 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedStartTime parameter in the setSchedWifi function. |
CVE-2022-45659 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the wpapsk_crypto parameter in the fromSetWirelessRepeat function. |
CVE-2022-45658 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the schedEndTime parameter in the setSchedWifi function. |
CVE-2022-45657 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the fromSetIpMacBind function. |
CVE-2022-45656 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the time parameter in the fromSetSysTime function. |
CVE-2022-45655 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the timeZone parameter in the form_fast_setting_wifi_set function. |
CVE-2022-45654 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the ssid parameter in the form_fast_setting_wifi_set function. |
CVE-2022-45653 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the page parameter in the fromNatStaticSetting function. |
CVE-2022-45652 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the startIp parameter in the formSetPPTPServer function. |
CVE-2022-45651 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the list parameter in the formSetVirtualSer function. |
CVE-2022-45650 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the firewallEn parameter in the formSetFirewallCfg function. |
CVE-2022-45649 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the endIp parameter in the formSetPPTPServer function. |
CVE-2022-45648 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the devName parameter in the formSetDeviceName function. |
CVE-2022-45647 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeed parameter in the formSetClientState function. |
CVE-2022-45646 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the limitSpeedUp parameter in the formSetClientState function. |
CVE-2022-45645 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceMac parameter in the addWifiMacFilter function. |
CVE-2022-45644 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the formSetClientState function. |
CVE-2022-45643 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 was discovered to contain a buffer overflow via the deviceId parameter in the addWifiMacFilter function. |
CVE-2022-45641 | High | 7.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 is vulnerable to Buffer Overflow via formSetMacFilterCfg. |
CVE-2022-45674 | Medium | 6.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolReboot. |
CVE-2022-45673 | Medium | 6.5 | 2022-12-02 | Tenda AC6V1.0 V15.03.05.19 is vulnerable to Cross Site Request Forgery (CSRF) via function fromSysToolRestoreSet. |
CVE-2022-44367 | Critical | 9.8 | 2022-12-02 | Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setUplinkInfo. |
CVE-2022-44366 | Critical | 9.8 | 2022-12-02 | Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setDiagnoseInfo. |
CVE-2022-44365 | Critical | 9.8 | 2022-12-02 | Tenda i21 V1.0.0.14(4656) has a stack overflow vulnerability via /goform/setSysPwd. |
CVE-2022-44363 | Critical | 9.8 | 2022-12-02 | Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setSnmpInfo. |
CVE-2022-44362 | Critical | 9.8 | 2022-12-02 | Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/AddSysLogRule. |
CVE-2022-44348 | High | 7.2 | 2022-12-02 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=. |
CVE-2022-44347 | High | 7.2 | 2022-12-02 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=inquiries/view_inquiry&id=. |
CVE-2022-44345 | High | 7.2 | 2022-12-02 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=quotes/view_quote&id=. |
CVE-2022-44277 | High | 7.2 | 2022-12-02 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product. |
CVE-2022-3591 | High | 7.8 | 2022-12-02 | Use After Free in GitHub repository vim/vim prior to 9.0.0789. |
CVE-2022-4271 | Medium | 5.4 | 2022-12-02 | Cross-site Scripting (XSS) - Reflected in GitHub repository osticket/osticket prior to 1.16.4. |
CVE-2022-45483 | Medium | 5.9 | 2022-12-02 | Lazy Mouse allows an attacker (in a man in the middle position between the server and a connected device) to see all data (including keypresses) in cleartext… |
CVE-2022-45482 | Critical | 9.8 | 2022-12-02 | Lazy Mouse server enforces weak password requirements and doesn't implement rate limiting, allowing remote unauthenticated users to easily and quickly brute fo… |
CVE-2022-45480 | Medium | 5.9 | 2022-12-02 | PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypress… |
CVE-2022-43272 | High | 7.5 | 2022-12-02 | DCMTK v3.6.7 was discovered to contain a memory leak via the T_ASC_Association object. |
CVE-2022-46159 | Medium | 4.3 | 2022-12-02 | Discourse is an open-source discussion platform. In version 2.8.13 and prior on the `stable` branch and version 2.9.0.beta14 and prior on the `beta` and `tests… |
CVE-2022-45215 | Medium | 5.4 | 2022-12-02 | A cross-site scripting (XSS) vulnerability in Book Store Management System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted paylo… |
CVE-2022-46366 | Critical | 9.8 | 2022-12-02 | Apache Tapestry 3.x allows deserialization of untrusted data, leading to remote code execution. This issue is similar to but distinct from CVE-2020-17531, whic… |
CVE-2022-4270 | Low | 2.0 | 2022-12-02 | Incorrect privilege assignment issue in M-Files Web in M-Files Web versions before 22.5.11436.1 could have changed permissions accidentally. |
CVE-2022-2808 | High | 8.8 | 2022-12-02 | Authorization Bypass Through User-Controlled Key vulnerability in Algan Software Prens Student Information System allows Object Relational Mapping Injection. … |
CVE-2022-2807 | Critical | 9.8 | 2022-12-02 | SQL Injection vulnerability in Algan Software Prens Student Information System allows SQL Injection. This issue affects Prens Student Information System: befo… |
CVE-2022-45562 | High | 8.8 | 2022-12-02 | Insecure permissions in Telos Alliance Omnia MPX Node v1.0.0 to v1.4.9 allow attackers to manipulate and access system settings with backdoor account low privi… |
CVE-2022-44930 | Critical | 9.8 | 2022-12-02 | D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function. |
CVE-2022-44929 | Critical | 9.8 | 2022-12-02 | An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SIB profiles. |
CVE-2022-44928 | Critical | 9.8 | 2022-12-02 | D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function. |
CVE-2022-43325 | Critical | 9.8 | 2022-12-02 | An unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.* - 1.4.* allows attackers t… |
CVE-2022-44212 | Medium | 5.9 | 2022-12-01 | In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel. |
CVE-2022-44211 | High | 7.4 | 2022-12-01 | In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings. |
CVE-2022-43333 | Critical | 9.8 | 2022-12-01 | Telenia Software s.r.l TVox before v22.0.17 was discovered to contain a remote code execution (RCE) vulnerability in the component action_export_control.php. |
CVE-2022-35120 | High | 8.8 | 2022-12-01 | IXPdata EasyInstall 6.6.14725 contains an access control issue. |
CVE-2022-42718 | High | 7.8 | 2022-12-01 | Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to potentially enable esca… |
CVE-2022-41971 | Medium | 4.8 | 2022-12-01 | Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to recei… |
CVE-2022-41970 | Low | 2.6 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview im… |
CVE-2022-41969 | Low | 2.4 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user… |
CVE-2022-41968 | Low | 3.5 | 2022-12-01 | Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a dat… |
CVE-2022-23737 | Medium | 6.5 | 2022-12-01 | An improper privilege management vulnerability was identified in GitHub Enterprise Server that allowed users with improper privileges to create or delete pages… |
CVE-2022-43901 | Medium | 5.7 | 2022-12-01 | IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.3 could disclose sensitive information. An authenticated local attacker could exploit this vul… |
CVE-2022-43900 | Medium | 5.3 | 2022-12-01 | IBM WebSphere Automation for IBM Cloud Pak for Watson AIOps 1.4.2 could provide a weaker than expected security. A local attacker can create an outbound netwo… |