2022 CVEs (page 91)
Page 91 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-3768 | High | 8.8 | 2022-11-28 | The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL inje… |
CVE-2022-3689 | High | 7.2 | 2022-11-28 | The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection expl… |
CVE-2022-3610 | Medium | 4.8 | 2022-11-28 | The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as ad… |
CVE-2022-3603 | Critical | 9.8 | 2022-11-28 | The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outpu… |
CVE-2022-3601 | Medium | 4.8 | 2022-11-28 | The Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as adm… |
CVE-2022-3511 | Medium | 6.5 | 2022-11-28 | The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, al… |
CVE-2022-3490 | High | 7.2 | 2022-11-28 | The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow… |
CVE-2022-2983 | Medium | 4.8 | 2022-11-28 | The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users such as admin to perform Cross-Site Scr… |
CVE-2022-2311 | Medium | 6.1 | 2022-11-28 | The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user… |
CVE-2022-4020 | High | 8.1 | 2022-11-28 | Vulnerability in the HQSwSmiDxe DXE driver on some consumer Acer Notebook devices may allow an attacker with elevated privileges to modify UEFI Secure Boot set… |
CVE-2022-38900 | High | 7.5 | 2022-11-28 | decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. |
CVE-2022-36193 | Critical | 9.8 | 2022-11-28 | SQL injection in School Management System 1.0 allows remote attackers to modify or delete data, causing persistent changes to the application's content or beha… |
CVE-2022-43590 | Medium | 5.5 | 2022-11-28 | A null pointer dereference vulnerability exists in the handle_ioctl_0x830a0_systembuffer functionality of Callback technologies CBFS Filter 20.0.8317. A specia… |
CVE-2022-43589 | Medium | 5.5 | 2022-11-28 | A null pointer dereference vulnerability exists in the handle_ioctl_8314C functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O… |
CVE-2022-43588 | Medium | 5.5 | 2022-11-28 | A null pointer dereference vulnerability exists in the handle_ioctl_83150 functionality of Callback technologies CBFS Filter 20.0.8317. A specially crafted I/O… |
CVE-2022-45939 | High | 7.8 | 2022-11-28 | GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system… |
CVE-2022-45934 | High | 7.8 | 2022-11-27 | An issue was discovered in the Linux kernel through 6.0.10. l2cap_config_req in net/bluetooth/l2cap_core.c has an integer wraparound via L2CAP_CONF_REQ packets. |
CVE-2022-43705 | Critical | 9.1 | 2022-11-27 | In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 20… |
CVE-2022-45933 | Critical | 9.8 | 2022-11-27 | KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieve… |
CVE-2022-45932 | High | 7.5 | 2022-11-27 | A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/RoleStore… |
CVE-2022-45931 | High | 7.5 | 2022-11-27 | A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/UserStore… |
CVE-2022-45930 | High | 7.5 | 2022-11-27 | A SQL injection issue was discovered in AAA in OpenDaylight (ODL) before 0.16.5. The aaa-idm-store-h2/src/main/java/org/opendaylight/aaa/datastore/h2/DomainSto… |
CVE-2022-45919 | High | 7.0 | 2022-11-27 | An issue was discovered in the Linux kernel through 6.0.10. In drivers/media/dvb-core/dvb_ca_en50221.c, a use-after-free can occur is there is a disconnect aft… |
CVE-2022-45914 | Medium | 6.5 | 2022-11-27 | The ESL (Electronic Shelf Label) protocol, as implemented by (for example) the OV80e934802 RF transceiver on the ETAG-2130-V4.3 20190629 board, does not use au… |
CVE-2022-24999 | High | 7.5 | 2022-11-26 | qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ p… |
CVE-2022-45909 | Critical | 9.1 | 2022-11-26 | drachtio-server before 0.8.19 has a heap-based buffer over-read via a long Request-URI in an INVITE request. |
CVE-2022-45908 | Critical | 9.8 | 2022-11-26 | In PaddlePaddle before 2.4, paddle.audio.functional.get_window is vulnerable to code injection because it calls eval on a user-supplied winstr. This may lead t… |
CVE-2022-45907 | Critical | 9.8 | 2022-11-26 | In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely. |
CVE-2022-45225 | Medium | 6.1 | 2022-11-25 | Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book. This vulnerability allows at… |
CVE-2022-44844 | Critical | 9.8 | 2022-11-25 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/setOpenVpnCfg function. |
CVE-2022-44843 | Critical | 9.8 | 2022-11-25 | TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/setOpenVpnClientCfg fu… |
CVE-2022-39333 | Medium | 4.6 | 2022-11-25 | Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application. It i… |
CVE-2022-39332 | Medium | 4.6 | 2022-11-25 | Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application via u… |
CVE-2022-39325 | Medium | 4.6 | 2022-11-25 | BaserCMS is a content management system with a japanese language focus. In affected versions there is a cross-site scripting vulnerability on the management sy… |
CVE-2022-45152 | Critical | 9.1 | 2022-11-25 | A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI pro… |
CVE-2022-41954 | Low | 3.3 | 2022-11-25 | MPXJ is an open source library to read and write project plans from a variety of file formats and databases. On Unix-like operating systems (not Windows or mac… |
CVE-2022-41926 | Low | 3.3 | 2022-11-25 | Nextcould talk android is the android OS implementation of the nextcloud talk chat system. In affected versions the receiver is not protected by broadcastPermi… |
CVE-2022-41158 | High | 7.2 | 2022-11-25 | Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vuln… |
CVE-2022-41157 | High | 8.1 | 2022-11-25 | A specific file on the sERP server if Kyungrinara(ERP solution) has a fixed password with the SYSTEM authority. This vulnerability could allow attackers to lea… |
CVE-2022-41156 | High | 7.8 | 2022-11-25 | Remote code execution vulnerability due to insufficient verification of URLs, etc. in OndiskPlayerAgent. A remote attacker could exploit the vulnerability to c… |
CVE-2022-39346 | Low | 3.5 | 2022-11-25 | Nextcloud server is an open source personal cloud server. Affected versions of nextcloud server did not properly limit user display names which could allow a m… |
CVE-2022-39339 | Medium | 4.3 | 2022-11-25 | user_oidc is an OpenID Connect user backend for Nextcloud. In versions prior to 1.2.1 sensitive information such as the OIDC client credentials and tokens are… |
CVE-2022-39338 | Low | 3.5 | 2022-11-25 | user_oidc is an OpenID Connect user backend for Nextcloud. Versions prior to 1.2.1 did not properly validate discovery urls which may lead to a stored cross si… |
CVE-2022-39334 | Low | 3.9 | 2022-11-25 | Nextcloud also ships a CLI utility called nextcloudcmd which is sometimes used for automated scripting and headless servers. Versions of nextcloudcmd prior to… |
CVE-2022-39331 | Medium | 4.6 | 2022-11-25 | Nexcloud desktop is the Desktop sync client for Nextcloud. An attacker can inject arbitrary HyperText Markup Language into the Desktop Client application in th… |
CVE-2022-45476 | Critical | 9.8 | 2022-11-25 | Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download. This is possible… |
CVE-2022-45475 | Medium | 6.5 | 2022-11-25 | Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible because the application… |
CVE-2022-44860 | High | 7.2 | 2022-11-25 | Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/transactions/update_status.php. |
CVE-2022-44859 | High | 7.2 | 2022-11-25 | Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/admin/products/manage_product.php. |
CVE-2022-44858 | High | 7.2 | 2022-11-25 | Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /asms/products/view_product.php. |
CVE-2022-41958 | High | 7.3 | 2022-11-25 | super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker… |
CVE-2022-41712 | Medium | 6.5 | 2022-11-25 | Frappe version 14.10.0 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not correctly valida… |
CVE-2022-41706 | High | 8.2 | 2022-11-25 | Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate the… |
CVE-2022-41705 | Critical | 9.8 | 2022-11-25 | Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does… |
CVE-2022-0698 | Medium | 6.1 | 2022-11-25 | Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter. |
CVE-2022-45218 | Medium | 6.1 | 2022-11-25 | Human Resource Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability. This vulnerability is triggered via a crafted pay… |
CVE-2022-45210 | Medium | 4.3 | 2022-11-25 | Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/deleteRecycleBin. |
CVE-2022-45208 | Medium | 4.3 | 2022-11-25 | Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/user/putRecycleBin. |
CVE-2022-45207 | Critical | 9.8 | 2022-11-25 | Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component updateNullByEmptyString. |
CVE-2022-45206 | Critical | 9.8 | 2022-11-25 | Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/duplicate/check. |
CVE-2022-45205 | Medium | 5.3 | 2022-11-25 | Jeecg-boot v3.4.3 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData. |
CVE-2022-43984 | High | 8.2 | 2022-11-25 | Browsershot version 3.57.3 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate tha… |
CVE-2022-43983 | High | 8.2 | 2022-11-25 | Browsershot version 3.57.2 allows an external attacker to remotely obtain arbitrary local files. This is possible because the application does not validate tha… |
CVE-2022-38813 | High | 8.1 | 2022-11-25 | PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, dele… |
CVE-2022-37721 | Critical | 9.0 | 2022-11-25 | PyroCMS 3.9 is vulnerable to a stored Cross Site Scripting (XSS_ when a low privileged user such as an author, injects a crafted html and javascript payload in… |
CVE-2022-23044 | High | 8.8 | 2022-11-25 | Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application. This is possi… |
CVE-2022-45040 | Medium | 5.4 | 2022-11-25 | A cross-site scripting (XSS) vulnerability in /admin/pages/sections_save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a… |
CVE-2022-45039 | High | 7.2 | 2022-11-25 | An arbitrary file upload vulnerability in the Server Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-45038 | Medium | 5.4 | 2022-11-25 | A cross-site scripting (XSS) vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a craft… |
CVE-2022-45037 | Medium | 5.4 | 2022-11-25 | A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted… |
CVE-2022-45036 | Medium | 5.4 | 2022-11-25 | A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a cra… |
CVE-2022-44411 | High | 7.5 | 2022-11-25 | Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' passwords via a brutefo… |
CVE-2022-38377 | Medium | 4.3 | 2022-11-25 | An improper access control vulnerability [CWE-284] in FortiManager 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.0 through 6.2.9, 6.0.0 through 6.0.11 a… |
CVE-2022-37720 | Critical | 9.0 | 2022-11-25 | Orchardproject Orchard CMS 1.10.3 is vulnerable to Cross Site Scripting (XSS). When a low privileged user such as an author or publisher, injects a crafted htm… |
CVE-2022-38767 | High | 7.5 | 2022-11-25 | An issue was discovered in Wind River VxWorks 6.9 and 7, that allows a specifically crafted packet sent by a Radius server, may cause Denial of Service during… |
CVE-2022-38166 | High | 7.5 | 2022-11-25 | In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler crashes. This can le… |
CVE-2022-4141 | High | 7.8 | 2022-11-25 | Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command. |
CVE-2022-4091 | Low | 3.5 | 2022-11-25 | A vulnerability was found in SourceCodester Canteen Management System. It has been classified as problematic. This affects the function query of the file food… |
CVE-2022-36133 | Critical | 9.1 | 2022-11-25 | The WebConfig functionality of Epson TM-C3500 and TM-C7500 devices with firmware version WAM31500 allows authentication bypass. |
CVE-2022-40282 | High | 8.8 | 2022-11-25 | The web server of Hirschmann BAT-C2 before 09.13.01.00R04 allows authenticated command injection. This allows an authenticated attacker to pass commands to the… |
CVE-2022-2721 | High | 7.5 | 2022-11-25 | In affected versions of Octopus Server it is possible for target discovery to print certain values marked as sensitive to log files in plaint-text in when verb… |
CVE-2022-45888 | Medium | 6.4 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/char/xillybus/xillyusb.c has a race condition and use-after-free during physical removal of… |
CVE-2022-45887 | Medium | 4.7 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/media/usb/ttusb-dec/ttusb_dec.c has a memory leak because of the lack of a dvb_frontend_deta… |
CVE-2022-45886 | High | 7.0 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_net.c has a .disconnect versus dvb_device_open race condition that leads… |
CVE-2022-45885 | High | 7.0 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvb_frontend.c has a race condition that can cause a use-after-free when a de… |
CVE-2022-45884 | High | 7.0 | 2022-11-25 | An issue was discovered in the Linux kernel through 6.0.9. drivers/media/dvb-core/dvbdev.c has a use-after-free, related to dvb_register_device dynamically all… |
CVE-2022-4135 | Critical | 9.6 | 2022-11-25 | Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform… |
CVE-2022-29833 | Medium | 6.8 | 2022-11-25 | Insufficiently Protected Credentials vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later allows a remote unauthenticated attac… |
CVE-2022-29832 | Low | 3.7 | 2022-11-25 | Cleartext Storage of Sensitive Information in Memory vulnerability in Mitsubishi Electric Corporation GX Works3 versions 1.015R and later, GX Works2 all versio… |
CVE-2022-29831 | High | 7.5 | 2022-11-25 | Use of Hard-coded Password vulnerability in Mitsubishi Electric Corporation GX Works3 versions from 1.015R to 1.095Z allows a remote unauthenticated attacker t… |
CVE-2022-29830 | Critical | 9.1 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z, and Motion Control Setting(GX Works3 related… |
CVE-2022-29829 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions fro… |
CVE-2022-29828 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-29827 | Medium | 6.8 | 2022-11-25 | Use of Hard-coded Cryptographic Key vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A and later allows a remote unauthenticated attacker to d… |
CVE-2022-29826 | Medium | 6.8 | 2022-11-25 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.087R and Motion Control Setting(GX Works3 r… |
CVE-2022-29825 | Medium | 5.6 | 2022-11-25 | Use of Hard-coded Password vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.090U, GT Designer3 Version1 (GOT2000) versions from 1.122C… |
CVE-2022-25164 | High | 8.6 | 2022-11-25 | Cleartext Storage of Sensitive Information vulnerability in Mitsubishi Electric GX Works3 versions from 1.000A to 1.095Z and Mitsubishi Electric MX OPC UA Modu… |
CVE-2022-2650 | Critical | 9.8 | 2022-11-24 | Improper Restriction of Excessive Authentication Attempts in GitHub repository wger-project/wger prior to 2.2. |
CVE-2022-26885 | High | 7.5 | 2022-11-24 | When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher. |
CVE-2022-4090 | Medium | 4.3 | 2022-11-24 | A vulnerability was found in rickxy Stock Management System and classified as problematic. This issue affects some unknown processing of the file us_transac.ph… |