2022 CVEs (page 89)
Page 89 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41297 | Medium | 4.3 | 2022-12-01 | IBM Db2U 3.5, 4.0, and 4.5 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted… |
CVE-2022-3713 | High | 8.8 | 2022-12-01 | A code injection vulnerability allows adjacent attackers to execute code in the Wifi controller of Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-3711 | Medium | 4.3 | 2022-12-01 | A post-auth read-only SQL injection vulnerability allows users to read non-sensitive configuration database contents in the User Portal of Sophos Firewall rele… |
CVE-2022-3710 | Low | 2.7 | 2022-12-01 | A post-auth read-only SQL injection vulnerability allows API clients to read non-sensitive configuration database contents in the API controller of Sophos Fire… |
CVE-2022-3709 | Medium | 6.8 | 2022-12-01 | A stored XSS vulnerability allows admin to super-admin privilege escalation in the Webadmin import group wizard of Sophos Firewall releases older than version… |
CVE-2022-3696 | High | 7.2 | 2022-12-01 | A post-auth code injection vulnerability allows admins to execute code in Webadmin of Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-3226 | High | 7.2 | 2022-12-01 | An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA. |
CVE-2022-2969 | High | 8.1 | 2022-12-01 | Delta Industrial Automation DIALink versions prior to v1.5.0.0 Beta 4 uses an external input to construct a pathname intended to identify a file or directory l… |
CVE-2022-29837 | Medium | 4.7 | 2022-12-01 | A path traversal vulnerability was addressed in Western Digital My Cloud Home, My Cloud Home Duo and SanDisk ibi which could allow an attacker to initiate inst… |
CVE-2022-4257 | Medium | 6.3 | 2022-12-01 | A vulnerability was found in C-DATA Web Management System. It has been rated as critical. This issue affects some unknown processing of the file cgi-bin/jumpto… |
CVE-2022-37017 | High | 7.5 | 2022-12-01 | Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a typ… |
CVE-2022-37016 | Critical | 9.8 | 2022-12-01 | Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attem… |
CVE-2022-30528 | Critical | 9.8 | 2022-12-01 | SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via th… |
CVE-2022-28607 | High | 7.5 | 2022-12-01 | An issue was discovered in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to gain sensitive information via the ac… |
CVE-2022-3270 | Critical | 9.8 | 2022-12-01 | In multiple products by Festo a remote unauthenticated attacker could use functions of an undocumented protocol which could lead to a complete loss of confide… |
CVE-2022-1471 | High | 8.3 | 2022-12-01 | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by an attacker ca… |
CVE-2022-4221 | Critical | 9.8 | 2022-12-01 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Asus NAS-M25 allows an unauthenticated attacker to… |
CVE-2022-45050 | Medium | 6.1 | 2022-12-01 | A reflected XSS vulnerability has been found in Axiell Iguana CMS, allowing an attacker to execute code in a victim's browser. The title parameter on the twitt… |
CVE-2022-4253 | Low | 3.5 | 2022-12-01 | A vulnerability was found in SourceCodester Canteen Management System. It has been declared as problematic. This vulnerability affects the function builtin_ech… |
CVE-2022-4252 | Low | 3.5 | 2022-12-01 | A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function builtin_echo of the fil… |
CVE-2022-4251 | Low | 2.4 | 2022-12-01 | A vulnerability was found in Movie Ticket Booking System and classified as problematic. Affected by this issue is some unknown functionality of the file editBo… |
CVE-2022-4250 | Low | 3.5 | 2022-12-01 | A vulnerability has been found in Movie Ticket Booking System and classified as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-4249 | Low | 3.5 | 2022-12-01 | A vulnerability, which was classified as problematic, was found in Movie Ticket Booking System. Affected is an unknown function of the component POST Request H… |
CVE-2022-4248 | Medium | 5.0 | 2022-12-01 | A vulnerability, which was classified as critical, has been found in Movie Ticket Booking System. This issue affects some unknown processing of the file editBo… |
CVE-2022-4247 | Medium | 6.3 | 2022-12-01 | A vulnerability classified as critical was found in Movie Ticket Booking System. This vulnerability affects unknown code of the file booking.php. The manipulat… |
CVE-2022-4246 | Medium | 4.3 | 2022-12-01 | A vulnerability classified as problematic has been found in Kakao PotPlayer. This affects an unknown part of the component MID File Handler. The manipulation l… |
CVE-2022-36431 | Critical | 9.8 | 2022-12-01 | An arbitrary file upload vulnerability in Rocket TRUfusion Enterprise before 7.9.6.1 allows unauthenticated attackers to execute arbitrary code via a crafted J… |
CVE-2022-45640 | High | 7.5 | 2022-12-01 | Tenda Tenda AC6V1.0 V15.03.05.19 is affected by buffer overflow. Causes a denial of service (local). |
CVE-2022-45045 | High | 8.8 | 2022-12-01 | Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.00000, allow authentica… |
CVE-2022-44262 | Critical | 9.8 | 2022-12-01 | ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE). |
CVE-2022-40849 | Medium | 5.4 | 2022-12-01 | ThinkCMF version 6.0.7 is affected by Stored Cross-Site Scripting (XSS). An attacker who successfully exploited this vulnerability could inject a Persistent XS… |
CVE-2022-40489 | High | 8.8 | 2022-12-01 | ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrati… |
CVE-2022-40204 | Medium | 4.1 | 2022-12-01 | A cross-site scripting (XSS) vulnerability exists in all current versions of Digital Alert Systems DASDEC software via the Host Header in undisclosed pages aft… |
CVE-2022-46162 | High | 8.8 | 2022-11-30 | discourse-bbcode is the official BBCode plugin for Discourse. Prior to commit 91478f5, CSS injection can occur when rendering content generated with the discou… |
CVE-2022-46156 | High | 7.2 | 2022-11-30 | The Synthetic Monitoring Agent for Grafana's Synthetic Monitoring application provides probe functionality and executes network checks for monitoring remote ta… |
CVE-2022-23746 | High | 7.5 | 2022-11-30 | The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password… |
CVE-2022-44296 | High | 7.2 | 2022-11-30 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manage_remark.php?id=. |
CVE-2022-44295 | High | 7.2 | 2022-11-30 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=. |
CVE-2022-44294 | High | 7.2 | 2022-11-30 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manage_service&id=. |
CVE-2022-4234 | Low | 3.5 | 2022-11-30 | A vulnerability was found in SourceCodester Canteen Management System. It has been rated as problematic. This issue affects the function builtin_echo of the fi… |
CVE-2022-46149 | Medium | 5.4 | 2022-11-30 | Cap'n Proto is a data interchange format and remote procedure call (RPC) system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as vers… |
CVE-2022-44151 | Critical | 9.8 | 2022-11-30 | Simple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php. |
CVE-2022-44136 | Critical | 9.8 | 2022-11-30 | Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE). |
CVE-2022-1911 | Medium | 5.3 | 2022-11-30 | Error in parser function in M-Files Server versions before 22.6.11534.1 and before 22.6.11505.0 allowed unauthenticated access to some information of the under… |
CVE-2022-1606 | Low | 2.4 | 2022-11-30 | Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects. |
CVE-2022-38803 | Medium | 6.8 | 2022-11-30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local f… |
CVE-2022-38802 | Medium | 6.2 | 2022-11-30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holid… |
CVE-2022-38801 | Medium | 5.4 | 2022-11-30 | In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting. |
CVE-2022-45842 | Medium | 5.3 | 2022-11-30 | Unauth. Race Condition vulnerability in WP ULike Plugin <= 4.6.4 on WordPress allows attackers to increase/decrease rating scores. |
CVE-2022-26366 | Medium | 5.4 | 2022-11-30 | Cross-Site Request Forgery (CSRF) in AdRotate Banner Manager Plugin <= 5.9 on WordPress. |
CVE-2022-24441 | Medium | 5.8 | 2022-11-30 | The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can… |
CVE-2022-22984 | Medium | 5.0 | 2022-11-30 | The package snyk before 1.1064.0; the package snyk-mvn-plugin before 2.31.3; the package snyk-gradle-plugin before 3.24.5; the package @snyk/snyk-cocoapods-plu… |
CVE-2022-4233 | Low | 2.4 | 2022-11-30 | A vulnerability has been found in SourceCodester Event Registration System 1.0 and classified as problematic. Affected by this vulnerability is an unknown func… |
CVE-2022-4232 | Medium | 4.7 | 2022-11-30 | A vulnerability, which was classified as critical, was found in SourceCodester Event Registration System 1.0. Affected is an unknown function. The manipulation… |
CVE-2022-4231 | Medium | 4.2 | 2022-11-30 | A vulnerability, which was classified as problematic, has been found in Tribal Systems Zenario CMS 9.3.57595. This issue affects some unknown processing of the… |
CVE-2022-4229 | High | 7.3 | 2022-11-30 | A vulnerability classified as critical was found in SourceCodester Book Store Management System 1.0. This vulnerability affects unknown code of the file /bsms_… |
CVE-2022-4228 | Medium | 5.3 | 2022-11-30 | A vulnerability classified as problematic has been found in SourceCodester Book Store Management System 1.0. This affects an unknown part of the file /bsms_ci/… |
CVE-2022-3859 | Medium | 6.7 | 2022-11-30 | An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. This allows an attacker with admin access, whic… |
CVE-2022-4222 | Medium | 5.0 | 2022-11-30 | A vulnerability was found in SourceCodester Canteen Management System. It has been rated as critical. This issue affects the function query of the file ajax_in… |
CVE-2022-46338 | Medium | 6.5 | 2022-11-30 | g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowin… |
CVE-2022-45869 | Medium | 5.5 | 2022-11-30 | A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS memo… |
CVE-2022-44097 | Critical | 9.8 | 2022-11-30 | Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel. |
CVE-2022-44096 | Critical | 9.8 | 2022-11-30 | Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel. |
CVE-2022-41413 | Medium | 4.3 | 2022-11-30 | perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted input into the Searc… |
CVE-2022-41412 | High | 8.6 | 2022-11-30 | An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery (SSRF)… |
CVE-2022-45337 | High | 7.5 | 2022-11-30 | Tenda TX9 Pro v22.03.02.10 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind. |
CVE-2022-45332 | High | 7.8 | 2022-11-30 | LibreDWG v0.12.4.4643 was discovered to contain a heap buffer overflow via the function decode_preR13_section_hdr at decode_r11.c. |
CVE-2022-45328 | High | 7.2 | 2022-11-30 | Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_members.php. |
CVE-2022-40265 | High | 8.6 | 2022-11-30 | Improper Input Validation vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series RJ71EN71 Firmware version "65" and prior and Mitsubishi Electric… |
CVE-2022-4195 | Medium | 4.3 | 2022-11-30 | Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malic… |
CVE-2022-4194 | High | 8.8 | 2022-11-30 | Use after free in Accessibility in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pag… |
CVE-2022-4193 | High | 8.8 | 2022-11-30 | Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a c… |
CVE-2022-4192 | High | 8.8 | 2022-11-30 | Use after free in Live Caption in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to p… |
CVE-2022-4191 | High | 8.8 | 2022-11-30 | Use after free in Sign-In in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage in specific UI interaction to potent… |
CVE-2022-4190 | High | 8.8 | 2022-11-30 | Insufficient data validation in Directory in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HT… |
CVE-2022-4189 | Medium | 4.3 | 2022-11-30 | Insufficient policy enforcement in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension t… |
CVE-2022-4188 | Medium | 4.3 | 2022-11-30 | Insufficient validation of untrusted input in CORS in Google Chrome on Android prior to 108.0.5359.71 allowed a remote attacker to bypass same origin policy vi… |
CVE-2022-4187 | Medium | 6.5 | 2022-11-30 | Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via… |
CVE-2022-4186 | Medium | 4.3 | 2022-11-30 | Insufficient validation of untrusted input in Downloads in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious… |
CVE-2022-4185 | Medium | 4.3 | 2022-11-30 | Inappropriate implementation in Navigation in Google Chrome on iOS prior to 108.0.5359.71 allowed a remote attacker to spoof the contents of the modal dialogue… |
CVE-2022-4184 | Medium | 4.3 | 2022-11-30 | Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass autofill restrictions via a crafted HTM… |
CVE-2022-4183 | Medium | 4.3 | 2022-11-30 | Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions via a craf… |
CVE-2022-4182 | Medium | 4.3 | 2022-11-30 | Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass fenced frame restrictions via a craft… |
CVE-2022-4181 | High | 8.8 | 2022-11-30 | Use after free in Forms in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chro… |
CVE-2022-4180 | High | 8.8 | 2022-11-30 | Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit… |
CVE-2022-4179 | High | 8.8 | 2022-11-30 | Use after free in Audio in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploi… |
CVE-2022-4178 | High | 8.8 | 2022-11-30 | Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap c… |
CVE-2022-4177 | High | 8.8 | 2022-11-30 | Use after free in Extensions in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install an extension to potentially exploit he… |
CVE-2022-4176 | High | 8.8 | 2022-11-30 | Out of bounds write in Lacros Graphics in Google Chrome on Chrome OS and Lacros prior to 108.0.5359.71 allowed a remote attacker who convinced a user to engage… |
CVE-2022-4175 | High | 8.8 | 2022-11-30 | Use after free in Camera Capture in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML pa… |
CVE-2022-4174 | High | 8.8 | 2022-11-30 | Type confusion in V8 in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromiu… |
CVE-2022-46155 | High | 7.6 | 2022-11-29 | Airtable.js is the JavaScript client for Airtable. Prior to version 0.11.6, Airtable.js had a misconfigured build script in its source package. When the build… |
CVE-2022-4036 | Medium | 5.3 | 2022-11-29 | The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insuffici… |
CVE-2022-4035 | High | 7.2 | 2022-11-29 | The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and includin… |
CVE-2022-4034 | Medium | 5.8 | 2022-11-29 | The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthent… |
CVE-2022-4033 | Medium | 5.3 | 2022-11-29 | The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0… |
CVE-2022-4032 | High | 7.2 | 2022-11-29 | The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due… |
CVE-2022-4031 | Low | 3.8 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does n… |
CVE-2022-4030 | High | 8.1 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated d… |
CVE-2022-4029 | Medium | 4.7 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in versions… |