2022 CVEs (page 94)
Page 94 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-40129 | High | 7.8 | 2022-11-21 | A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigg… |
CVE-2022-38148 | High | 8.8 | 2022-11-21 | Silverstripe silverstripe/framework through 4.11 allows SQL Injection. |
CVE-2022-38146 | Medium | 5.4 | 2022-11-21 | Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3). |
CVE-2022-38097 | High | 7.8 | 2022-11-21 | A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely destroying annotation objec… |
CVE-2022-37332 | High | 7.8 | 2022-11-21 | A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. A specially-crafted PDF document can trigg… |
CVE-2022-32774 | High | 7.8 | 2022-11-21 | A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely deleting objects associated… |
CVE-2022-4096 | Medium | 6.5 | 2022-11-21 | Server-Side Request Forgery (SSRF) in GitHub repository appsmithorg/appsmith prior to 1.8.2. |
CVE-2022-45017 | Medium | 4.8 | 2022-11-21 | A cross-site scripting (XSS) vulnerability in the Overview Page settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML vi… |
CVE-2022-45016 | Medium | 4.8 | 2022-11-21 | A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a cra… |
CVE-2022-45015 | Medium | 4.8 | 2022-11-21 | A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a cra… |
CVE-2022-45014 | Medium | 4.8 | 2022-11-21 | A cross-site scripting (XSS) vulnerability in the Search Settings module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a cra… |
CVE-2022-45013 | Medium | 4.8 | 2022-11-21 | A cross-site scripting (XSS) vulnerability in the Show Advanced Option module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via… |
CVE-2022-45012 | Medium | 4.8 | 2022-11-21 | A cross-site scripting (XSS) vulnerability in the Modify Page module of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted… |
CVE-2022-44169 | High | 7.5 | 2022-11-21 | Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer. |
CVE-2022-44168 | High | 7.5 | 2022-11-21 | Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic.. |
CVE-2022-44167 | High | 7.5 | 2022-11-21 | Tenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer. |
CVE-2022-3861 | High | 8.8 | 2022-11-21 | The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplie… |
CVE-2022-3763 | High | 8.1 | 2022-11-21 | The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress… |
CVE-2022-3762 | Medium | 6.5 | 2022-11-21 | The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress… |
CVE-2022-3753 | Medium | 4.8 | 2022-11-21 | The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform S… |
CVE-2022-3750 | Medium | 4.7 | 2022-11-21 | The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation. |
CVE-2022-3720 | High | 7.2 | 2022-11-21 | The Event Monster WordPress plugin before 1.2.0 does not validate and escape some parameters before using them in SQL statements, which could lead to SQL Injec… |
CVE-2022-3691 | High | 7.5 | 2022-11-21 | The DeepL Pro API translation plugin WordPress plugin before 1.7.5 discloses sensitive information (including the DeepL API key) in files that are publicly acc… |
CVE-2022-3690 | Medium | 4.8 | 2022-11-21 | The Popup Maker WordPress plugin before 1.16.11 does not sanitise and escape some of its Popup options, which could allow users with a role as low as Contribut… |
CVE-2022-3688 | High | 8.8 | 2022-11-21 | The WPQA Builder WordPress plugin before 5.9 does not have CSRF check when following and unfollowing users, which could allow attackers to make logged in users… |
CVE-2022-3634 | Critical | 9.8 | 2022-11-21 | The Contact Form 7 Database Addon WordPress plugin before 1.2.6.5 does not validate data when output it back in a CSV file, which could lead to CSV injection |
CVE-2022-3618 | Medium | 4.8 | 2022-11-21 | The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform St… |
CVE-2022-3600 | Critical | 9.8 | 2022-11-21 | The Easy Digital Downloads WordPress plugin before 3.1.0.2 does not validate data when its output in a CSV file, which could lead to CSV injection. |
CVE-2022-3336 | Medium | 4.3 | 2022-11-21 | The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arb… |
CVE-2022-1581 | Medium | 5.3 | 2022-11-21 | The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to byp… |
CVE-2022-1579 | High | 7.5 | 2022-11-21 | The function check_is_login_page() uses headers for the IP check, which can be easily spoofed. |
CVE-2022-1578 | High | 8.8 | 2022-11-21 | The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL… |
CVE-2022-0421 | Medium | 6.1 | 2022-11-21 | The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allo… |
CVE-2022-45146 | Medium | 5.5 | 2022-11-21 | An issue was discovered in the FIPS Java API of Bouncy Castle BC-FJA before 1.0.2.4. Changes to the JVM garbage collector in Java 13 and later trigger an issue… |
CVE-2022-3589 | High | 8.1 | 2022-11-21 | An API Endpoint used by Miele's "AppWash" MobileApp in all versions was vulnerable to an authorization bypass. A low privileged, remote attacker would have bee… |
CVE-2022-4087 | Low | 2.6 | 2022-11-21 | A vulnerability was found in iPXE. It has been declared as problematic. This vulnerability affects the function tls_new_ciphertext of the file src/net/tls.c of… |
CVE-2022-4093 | Critical | 9.8 | 2022-11-21 | SQL injection attacks can result in unauthorized access to sensitive data, such as passwords, credit card details, or personal user information. Many high-prof… |
CVE-2022-4070 | Critical | 9.8 | 2022-11-20 | Insufficient Session Expiration in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-4069 | Medium | 4.8 | 2022-11-20 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-4068 | Medium | 5.4 | 2022-11-20 | A user is able to enable their own account if it was disabled by an admin while the user still holds a valid session. Moreover, the username is not properly sa… |
CVE-2022-4067 | Medium | 5.4 | 2022-11-20 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3562 | Medium | 5.4 | 2022-11-20 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3561 | Medium | 6.1 | 2022-11-20 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3525 | High | 8.8 | 2022-11-20 | Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-3516 | Medium | 6.1 | 2022-11-20 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. |
CVE-2022-4066 | Low | 3.5 | 2022-11-19 | A vulnerability was found in davidmoreno onion. It has been rated as problematic. Affected by this issue is the function onion_response_flush of the file src/o… |
CVE-2022-4065 | Medium | 5.5 | 2022-11-19 | A vulnerability was found in cbeust testng 7.5.0/7.6.0/7.6.1/7.7.0. It has been declared as critical. Affected by this vulnerability is the function testngXmlE… |
CVE-2022-4064 | Low | 3.7 | 2022-11-19 | A vulnerability was found in Dalli up to 3.2.2. It has been classified as problematic. Affected is the function self.meta_set of the file lib/dalli/protocol/me… |
CVE-2022-41939 | Medium | 6.1 | 2022-11-19 | knative.dev/func is is a client library and CLI enabling the development and deployment of Kubernetes functions. Developers using a malicious or compromised th… |
CVE-2022-41938 | Critical | 9.0 | 2022-11-19 | Flarum is an open source discussion platform. Flarum's page title system allowed for page titles to be converted into HTML DOM nodes when pages were rendered… |
CVE-2022-4055 | High | 7.4 | 2022-11-19 | When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that sho… |
CVE-2022-41609 | Medium | 6.4 | 2022-11-19 | Auth. (subscriber+) Server-Side Request Forgery (SSRF) vulnerability in Better Messages plugin 1.9.10.68 on WordPress. |
CVE-2022-41155 | Medium | 5.3 | 2022-11-19 | Block BYPASS vulnerability in iQ Block Country plugin <= 1.2.18 on WordPress. |
CVE-2022-34667 | Medium | 4.4 | 2022-11-19 | NVIDIA CUDA Toolkit SDK contains a stack-based buffer overflow vulnerability in cuobjdump, where an unprivileged remote attacker could exploit this buffer over… |
CVE-2022-34665 | Medium | 6.5 | 2022-11-19 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-… |
CVE-2022-31617 | High | 7.8 | 2022-11-19 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabilities can cause an… |
CVE-2022-31616 | Medium | 6.1 | 2022-11-19 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic… |
CVE-2022-31615 | Medium | 5.5 | 2022-11-19 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dere… |
CVE-2022-31613 | High | 7.1 | 2022-11-19 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where any local user can cause a null-pointer dereference, which may l… |
CVE-2022-31612 | High | 7.1 | 2022-11-19 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic… |
CVE-2022-31610 | High | 7.8 | 2022-11-19 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabilities can cause an… |
CVE-2022-31608 | High | 7.8 | 2022-11-19 | NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabilities can impact pro… |
CVE-2022-31607 | High | 7.8 | 2022-11-19 | NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user with basic capabilities can cause imprope… |
CVE-2022-31606 | High | 7.8 | 2022-11-19 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a failure to properly v… |
CVE-2022-30256 | High | 7.5 | 2022-11-19 | An issue was discovered in MaraDNS Deadwood through 3.5.0021 that allows variant V1 of unintended domain name resolution. A revoked domain name can still be re… |
CVE-2022-45369 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Broken Access Control vulnerability in Plugin for Google Reviews plugin <= 2.2.2 on WordPress. |
CVE-2022-45163 | Medium | 5.3 | 2022-11-18 | An information-disclosure vulnerability exists on select NXP devices when configured in Serial Download Protocol (SDP) mode: i.MX RT 1010, i.MX RT 1015, i.MX R… |
CVE-2022-45132 | Critical | 9.8 | 2022-11-18 | In Linaro Automated Validation Architecture (LAVA) before 2022.11.1, remote code execution can be achieved through user-submitted Jinja2 template. The REST API… |
CVE-2022-45082 | Low | 3.4 | 2022-11-18 | Multiple Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerabilities in Accordions plugin <= 2.0.3 on WordPress via &addons-style-name and &accordions_or_… |
CVE-2022-45073 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in REST API Authentication plugin <= 2.4.0 on WordPress. |
CVE-2022-44740 | Medium | 5.4 | 2022-11-18 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress. |
CVE-2022-44634 | Medium | 4.9 | 2022-11-18 | Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress. |
CVE-2022-44584 | Critical | 9.1 | 2022-11-18 | Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress. |
CVE-2022-44583 | High | 7.5 | 2022-11-18 | Unauth. Arbitrary File Download vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress. |
CVE-2022-43492 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Insecure Direct Object References (IDOR) vulnerability in Comments – wpDiscuz plugin 7.4.2 on WordPress. |
CVE-2022-42883 | Medium | 5.3 | 2022-11-18 | Sensitive Information Disclosure vulnerability discovered by Quiz And Survey Master plugin <= 7.3.10 on WordPress. |
CVE-2022-42698 | Critical | 9.8 | 2022-11-18 | Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress. |
CVE-2022-42497 | Critical | 10.0 | 2022-11-18 | Arbitrary Code Execution vulnerability in Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress. |
CVE-2022-42459 | High | 7.2 | 2022-11-18 | Auth. WordPress Options Change vulnerability in Image Hover Effects Ultimate plugin <= 9.7.1 on WordPress. |
CVE-2022-41839 | Medium | 5.3 | 2022-11-18 | Broken Access Control vulnerability in WordPress LoginPress plugin <= 1.6.2 on WordPress leading to unauth. changing of Opt-In or Opt-Out tracking settings. |
CVE-2022-41788 | Medium | 5.4 | 2022-11-18 | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress. |
CVE-2022-41685 | Medium | 5.4 | 2022-11-18 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szá… |
CVE-2022-41655 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress. |
CVE-2022-41643 | Medium | 4.8 | 2022-11-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress. |
CVE-2022-41634 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress. |
CVE-2022-41618 | Low | 3.7 | 2022-11-18 | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. |
CVE-2022-41615 | Medium | 6.1 | 2022-11-18 | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress. |
CVE-2022-41135 | Medium | 6.5 | 2022-11-18 | Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress. |
CVE-2022-40963 | Medium | 4.8 | 2022-11-18 | Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress. |
CVE-2022-40698 | Medium | 5.4 | 2022-11-18 | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. |
CVE-2022-40695 | Medium | 5.4 | 2022-11-18 | Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress. |
CVE-2022-40216 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress. |
CVE-2022-40130 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress. |
CVE-2022-38871 | High | 7.5 | 2022-11-18 | In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages. |
CVE-2022-34827 | Critical | 9.9 | 2022-11-18 | Carel Boss Mini 1.5.0 has Improper Access Control. |
CVE-2022-31694 | High | 7.3 | 2022-11-18 | InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may… |
CVE-2022-41911 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's the underlying stor… |
CVE-2022-41909 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `… |
CVE-2022-41908 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`… |
CVE-2022-41907 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have pa… |