2022 CVEs (page 95)
Page 95 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41788 | Medium | 5.4 | 2022-11-18 | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Soledad premium theme <= 8.2.5 on WordPress. |
CVE-2022-41685 | Medium | 5.4 | 2022-11-18 | Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Viszt Péter's Integration for Szamlazz.hu & WooCommerce plugin <= 5.6.3.2 and Csomagpontok és szá… |
CVE-2022-41655 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Sensitive Data Exposure vulnerability in Phone Orders for WooCommerce plugin <= 3.7.1 on WordPress. |
CVE-2022-41643 | Medium | 4.8 | 2022-11-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Accessibility plugin <= 1.0.3 on WordPress. |
CVE-2022-41634 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Media Library Folders plugin <= 7.1.1 on WordPress. |
CVE-2022-41618 | Low | 3.7 | 2022-11-18 | Unauthenticated Error Log Disclosure vulnerability in Media Library Assistant plugin <= 3.00 on WordPress. |
CVE-2022-41615 | Medium | 6.1 | 2022-11-18 | Cross-Site Scripting (XSS) via Cross-Site Request Forgery (CSRF) vulnerability in Store Locator plugin <= 1.4.5 on WordPress. |
CVE-2022-41135 | Medium | 6.5 | 2022-11-18 | Unauth. Plugin Settings Change vulnerability in Modula plugin <= 2.6.9 on WordPress. |
CVE-2022-40963 | Medium | 4.8 | 2022-11-18 | Multiple Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerabilities in WP Page Builder plugin <= 1.2.6 on WordPress. |
CVE-2022-40698 | Medium | 5.4 | 2022-11-18 | Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. |
CVE-2022-40695 | Medium | 5.4 | 2022-11-18 | Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress. |
CVE-2022-40216 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Messaging Block Bypass vulnerability in Better Messages plugin <= 1.9.10.69 on WordPress. |
CVE-2022-40130 | Medium | 4.3 | 2022-11-18 | Auth. (subscriber+) Race Condition vulnerability in WP-Polls plugin <= 2.76.0 on WordPress. |
CVE-2022-38871 | High | 7.5 | 2022-11-18 | In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages. |
CVE-2022-34827 | Critical | 9.9 | 2022-11-18 | Carel Boss Mini 1.5.0 has Improper Access Control. |
CVE-2022-31694 | High | 7.3 | 2022-11-18 | InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may… |
CVE-2022-41911 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When printing a tensor, we get it's data as a `const char*` array (since that's the underlying stor… |
CVE-2022-41909 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `encoded` that is not a valid `CompositeTensorVariant` tensor will trigger a segfault in `… |
CVE-2022-41908 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `token` that is not a UTF-8 bytestring will trigger a `CHECK` fail in `tf.raw_ops.PyFunc`… |
CVE-2022-41907 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ResizeNearestNeighborGrad` is given a large `size` input, it overflows. We have pa… |
CVE-2022-41901 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail… |
CVE-2022-41900 | High | 7.1 | 2022-11-18 | TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers… |
CVE-2022-41899 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaO… |
CVE-2022-41898 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `SparseFillEmptyRowsGrad` is given empty inputs, TensorFlow will crash. We have patched the issu… |
CVE-2022-41897 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `FractionMaxPoolGrad` is given outsize inputs `row_pooling_sequence` and `col_pooling_sequence`… |
CVE-2022-41896 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the… |
CVE-2022-41895 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `MirrorPadGrad` is given outsize input `paddings`, TensorFlow will give a heap OOB error. We hav… |
CVE-2022-41894 | High | 7.1 | 2022-11-18 | TensorFlow is an open source platform for machine learning. The reference kernel of the `CONV_3D_TRANSPOSE` TensorFlow Lite operator wrongly increments the dat… |
CVE-2022-41893 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is given a nonscalar value for input `size`, it results `CHECK` fa… |
CVE-2022-41891 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is given `element_shape=[]`, it results segmentation fault which c… |
CVE-2022-41890 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `BCast::ToShape` is given input larger than an `int32`, it will crash, despite being supposed to… |
CVE-2022-41889 | Medium | 5.5 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tens… |
CVE-2022-41888 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When running on GPU, `tf.image.generate_bounding_box_proposals` receives a `scores` input that must… |
CVE-2022-41887 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` i… |
CVE-2022-41886 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have p… |
CVE-2022-41885 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patc… |
CVE-2022-41884 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If a numpy array is created with a shape such that one element is zero and the others sum to a larg… |
CVE-2022-41880 | Medium | 6.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When the `BaseCandidateSamplerOp` function receives a value in `true_classes` larger than `range_ma… |
CVE-2022-44641 | Medium | 6.5 | 2022-11-18 | In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML e… |
CVE-2022-42904 | High | 7.2 | 2022-11-18 | Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings. |
CVE-2022-41883 | Medium | 6.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When ops that have specified input sizes receive a differing number of inputs, the executor will cr… |
CVE-2022-37197 | High | 7.8 | 2022-11-18 | IOBit IOTransfer V4 is vulnerable to Unquoted Service Path. |
CVE-2022-43673 | Medium | 4.7 | 2022-11-18 | Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for a limited period of time) from the AppD… |
CVE-2022-43482 | Medium | 4.3 | 2022-11-18 | Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress. |
CVE-2022-42461 | Medium | 5.4 | 2022-11-18 | Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress. |
CVE-2022-44820 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=transactions/manage_transaction&id=. |
CVE-2022-44415 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/view_mechanic.php?id=. |
CVE-2022-44414 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/services/manage_service.php?id=. |
CVE-2022-44413 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/manage_mechanic.php?id=. |
CVE-2022-43463 | Medium | 4.8 | 2022-11-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress. |
CVE-2022-41840 | High | 7.5 | 2022-11-18 | Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress. |
CVE-2022-41805 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress. |
CVE-2022-41781 | Medium | 6.5 | 2022-11-18 | Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress. |
CVE-2022-41692 | Medium | 4.3 | 2022-11-18 | Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. |
CVE-2022-41652 | Medium | 6.5 | 2022-11-18 | Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. |
CVE-2022-40687 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. |
CVE-2022-40686 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. |
CVE-2022-38974 | Medium | 4.3 | 2022-11-18 | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change… |
CVE-2022-38075 | Medium | 6.1 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress. |
CVE-2022-45474 | Critical | 9.8 | 2022-11-18 | drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request. |
CVE-2022-45473 | Medium | 5.5 | 2022-11-18 | In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666. |
CVE-2022-44379 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_service. |
CVE-2022-44378 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL via /asms/classes/Master.php?f=delete_mechanic. |
CVE-2022-44204 | Critical | 9.8 | 2022-11-18 | D-Link DIR3060 DIR3060A1_FW111B04.bin is vulnerable to Buffer Overflow. |
CVE-2022-45471 | Low | 3.5 | 2022-11-18 | In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address |
CVE-2022-24038 | Medium | 6.5 | 2022-11-18 | Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the a… |
CVE-2022-24037 | High | 8.2 | 2022-11-18 | Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical informatio… |
CVE-2022-43308 | High | 7.8 | 2022-11-18 | INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitrarily create Administrator accounts via crafted user cookies. |
CVE-2022-24939 | Medium | 5.7 | 2022-11-18 | A malformed packet containing an invalid destination address, causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset… |
CVE-2022-45375 | Medium | 5.4 | 2022-11-17 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress. |
CVE-2022-45077 | Medium | 6.3 | 2022-11-17 | Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress. |
CVE-2022-45069 | Medium | 6.3 | 2022-11-17 | Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress. |
CVE-2022-45066 | Medium | 5.4 | 2022-11-17 | Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress. |
CVE-2022-44736 | Medium | 4.8 | 2022-11-17 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress. |
CVE-2022-44591 | Medium | 4.8 | 2022-11-17 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anthologize plugin <= 0.8.0 on WordPress. |
CVE-2022-43506 | High | 8.8 | 2022-11-17 | SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network |
CVE-2022-43457 | High | 8.8 | 2022-11-17 | SQL Injection in HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Ne… |
CVE-2022-43452 | High | 8.8 | 2022-11-17 | SQL Injection in FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via N… |
CVE-2022-43447 | High | 8.8 | 2022-11-17 | SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Net… |
CVE-2022-43332 | Medium | 6.1 | 2022-11-17 | A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into th… |
CVE-2022-43171 | Medium | 6.5 | 2022-11-17 | A heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind function of LIEF v0.12.1 allows attackers to cause a Denial of Service (Do… |
CVE-2022-43096 | Medium | 6.8 | 2022-11-17 | Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port. |
CVE-2022-42533 | High | 7.8 | 2022-11-17 | In shared_metadata_init of SharedMetadata.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privi… |
CVE-2022-41791 | Medium | 6.8 | 2022-11-17 | Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress. |
CVE-2022-41775 | High | 8.8 | 2022-11-17 | SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network |
CVE-2022-41315 | Medium | 4.8 | 2022-11-17 | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic plugin <= 2.8.8 on WordPress. |
CVE-2022-41132 | Medium | 6.1 | 2022-11-17 | Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. |
CVE-2022-40694 | Medium | 4.8 | 2022-11-17 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress. |
CVE-2022-40200 | Critical | 9.9 | 2022-11-17 | Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. |
CVE-2022-40192 | High | 7.1 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. |
CVE-2022-39181 | Medium | 6.1 | 2022-11-17 | GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS). Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP… |
CVE-2022-39180 | Critical | 9.8 | 2022-11-17 | College Management System v1.0 - SQL Injection (SQLi). By inserting SQL commands to the username and password fields in the login.php page |
CVE-2022-39179 | High | 7.2 | 2022-11-17 | College Management System v1.0 - Authenticated remote code execution. An admin user (the authentication can be bypassed using SQL Injection that mentioned in… |
CVE-2022-39178 | Medium | 5.3 | 2022-11-17 | Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and Full path disclos… |
CVE-2022-38165 | Critical | 9.8 | 2022-11-17 | Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on t… |
CVE-2022-36924 | High | 8.8 | 2022-11-17 | The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulner… |
CVE-2022-36787 | Critical | 9.8 | 2022-11-17 | webvendome - webvendome SQL Injection. SQL Injection in the Parameter " DocNumber" Request : Get Request : /webvendome/showfiles.aspx?jobnumber=nullDoc Number… |
CVE-2022-36786 | Critical | 9.9 | 2022-11-17 | DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is p… |
CVE-2022-36785 | High | 7.5 | 2022-11-17 | D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. *Information Disclosure – file contains a URL with private IP at line 15… |
CVE-2022-36784 | Critical | 9.8 | 2022-11-17 | Elsight – Elsight Halo Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics… |