2022 CVEs (page 95)
Page 95 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-41901 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. An input `sparse_matrix` that is not a matrix with a shape with rank 0 will trigger a `CHECK` fail… |
CVE-2022-41900 | High | 7.1 | 2022-11-18 | TensorFlow is an open source platform for machine learning. The security vulnerability results in FractionalMax(AVG)Pool with illegal pooling_ratio. Attackers… |
CVE-2022-41899 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. Inputs `dense_features` or `example_state_data` not of rank 2 will trigger a `CHECK` fail in `SdcaO… |
CVE-2022-41898 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `SparseFillEmptyRowsGrad` is given empty inputs, TensorFlow will crash. We have patched the issu… |
CVE-2022-41897 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `FractionMaxPoolGrad` is given outsize inputs `row_pooling_sequence` and `col_pooling_sequence`… |
CVE-2022-41896 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `ThreadUnsafeUnigramCandidateSampler` is given input `filterbank_channel_count` greater than the… |
CVE-2022-41895 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `MirrorPadGrad` is given outsize input `paddings`, TensorFlow will give a heap OOB error. We hav… |
CVE-2022-41894 | High | 7.1 | 2022-11-18 | TensorFlow is an open source platform for machine learning. The reference kernel of the `CONV_3D_TRANSPOSE` TensorFlow Lite operator wrongly increments the dat… |
CVE-2022-41893 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListResize` is given a nonscalar value for input `size`, it results `CHECK` fa… |
CVE-2022-41891 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `tf.raw_ops.TensorListConcat` is given `element_shape=[]`, it results segmentation fault which c… |
CVE-2022-41890 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If `BCast::ToShape` is given input larger than an `int32`, it will crash, despite being supposed to… |
CVE-2022-41889 | Medium | 5.5 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If a list of quantized tensors is assigned to an attribute, the pywrap code fails to parse the tens… |
CVE-2022-41888 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When running on GPU, `tf.image.generate_bounding_box_proposals` receives a `scores` input that must… |
CVE-2022-41887 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. `tf.keras.losses.poisson` receives a `y_pred` and `y_true` that are passed through `functor::mul` i… |
CVE-2022-41886 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.ImageProjectiveTransformV2` is given a large output shape, it overflows. We have p… |
CVE-2022-41885 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When `tf.raw_ops.FusedResizeAndPadConv2D` is given a large tensor shape, it overflows. We have patc… |
CVE-2022-41884 | Medium | 4.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. If a numpy array is created with a shape such that one element is zero and the others sum to a larg… |
CVE-2022-41880 | Medium | 6.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When the `BaseCandidateSamplerOp` function receives a value in `true_classes` larger than `range_ma… |
CVE-2022-44641 | Medium | 6.5 | 2022-11-18 | In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML e… |
CVE-2022-42904 | High | 7.2 | 2022-11-18 | Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings. |
CVE-2022-41883 | Medium | 6.8 | 2022-11-18 | TensorFlow is an open source platform for machine learning. When ops that have specified input sizes receive a differing number of inputs, the executor will cr… |
CVE-2022-37197 | High | 7.8 | 2022-11-18 | IOBit IOTransfer V4 is vulnerable to Unquoted Service Path. |
CVE-2022-43673 | Medium | 4.7 | 2022-11-18 | Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved (for a limited period of time) from the AppD… |
CVE-2022-43482 | Medium | 4.3 | 2022-11-18 | Missing Authorization vulnerability in Appointment Booking Calendar plugin <= 1.3.69 on WordPress. |
CVE-2022-42461 | Medium | 5.4 | 2022-11-18 | Broken Access Control vulnerability in miniOrange's Google Authenticator plugin <= 5.6.1 on WordPress. |
CVE-2022-44820 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=transactions/manage_transaction&id=. |
CVE-2022-44415 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/view_mechanic.php?id=. |
CVE-2022-44414 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/services/manage_service.php?id=. |
CVE-2022-44413 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/manage_mechanic.php?id=. |
CVE-2022-43463 | Medium | 4.8 | 2022-11-18 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Custom Product Tabs for WooCommerce plugin <= 1.7.9 on WordPress. |
CVE-2022-41840 | High | 7.5 | 2022-11-18 | Unauth. Directory Traversal vulnerability in Welcart eCommerce plugin <= 2.7.7 on WordPress. |
CVE-2022-41805 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Booster for WooCommerce plugin <= 5.6.6 on WordPress. |
CVE-2022-41781 | Medium | 6.5 | 2022-11-18 | Broken Access Control vulnerability in Permalink Manager Lite plugin <= 2.2.20 on WordPress. |
CVE-2022-41692 | Medium | 4.3 | 2022-11-18 | Missing Authorization vulnerability in Appointment Hour Booking plugin <= 1.3.71 on WordPress. |
CVE-2022-41652 | Medium | 6.5 | 2022-11-18 | Bypass vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. |
CVE-2022-40687 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. |
CVE-2022-40686 | Medium | 5.4 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. |
CVE-2022-38974 | Medium | 4.3 | 2022-11-18 | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with subscriber or higher user roles to change… |
CVE-2022-38075 | Medium | 6.1 | 2022-11-18 | Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress. |
CVE-2022-45474 | Critical | 9.8 | 2022-11-18 | drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request. |
CVE-2022-45473 | Medium | 5.5 | 2022-11-18 | In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666. |
CVE-2022-44379 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_service. |
CVE-2022-44378 | High | 7.2 | 2022-11-18 | Automotive Shop Management System v1.0 is vulnerable to SQL via /asms/classes/Master.php?f=delete_mechanic. |
CVE-2022-44204 | Critical | 9.8 | 2022-11-18 | D-Link DIR3060 DIR3060A1_FW111B04.bin is vulnerable to Buffer Overflow. |
CVE-2022-45471 | Low | 3.5 | 2022-11-18 | In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address |
CVE-2022-24038 | Medium | 6.5 | 2022-11-18 | Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the a… |
CVE-2022-24037 | High | 8.2 | 2022-11-18 | Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical informatio… |
CVE-2022-43308 | High | 7.8 | 2022-11-18 | INTELBRAS SG 2404 MR 20180928-rel64938 allows authenticated attackers to arbitrarily create Administrator accounts via crafted user cookies. |
CVE-2022-24939 | Medium | 5.7 | 2022-11-18 | A malformed packet containing an invalid destination address, causes a stack overflow in the Ember ZNet stack. This causes an assert which leads to a reset… |
CVE-2022-45375 | Medium | 5.4 | 2022-11-17 | Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress. |
CVE-2022-45077 | Medium | 6.3 | 2022-11-17 | Auth. (subscriber+) PHP Object Injection vulnerability in Betheme theme <= 26.5.1.4 on WordPress. |
CVE-2022-45069 | Medium | 6.3 | 2022-11-17 | Auth. (contributor+) Privilege Escalation vulnerability in Crowdsignal Dashboard plugin <= 3.0.9 on WordPress. |
CVE-2022-45066 | Medium | 5.4 | 2022-11-17 | Auth. (subscriber+) Broken Access Control vulnerability in WooSwipe WooCommerce Gallery plugin <= 2.0.1 on WordPress. |
CVE-2022-44736 | Medium | 4.8 | 2022-11-17 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress. |
CVE-2022-44591 | Medium | 4.8 | 2022-11-17 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anthologize plugin <= 0.8.0 on WordPress. |
CVE-2022-43506 | High | 8.8 | 2022-11-17 | SQL Injection in HandlerTag_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network |
CVE-2022-43457 | High | 8.8 | 2022-11-17 | SQL Injection in HandlerPage_KID.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Ne… |
CVE-2022-43452 | High | 8.8 | 2022-11-17 | SQL Injection in FtyInfoSetting.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via N… |
CVE-2022-43447 | High | 8.8 | 2022-11-17 | SQL Injection in AM_EBillAnalysis.aspx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Net… |
CVE-2022-43332 | Medium | 6.1 | 2022-11-17 | A cross-site scripting (XSS) vulnerability in Wondercms v3.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into th… |
CVE-2022-43171 | Medium | 6.5 | 2022-11-17 | A heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind function of LIEF v0.12.1 allows attackers to cause a Denial of Service (Do… |
CVE-2022-43096 | Medium | 6.8 | 2022-11-17 | Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port. |
CVE-2022-42533 | High | 7.8 | 2022-11-17 | In shared_metadata_init of SharedMetadata.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privi… |
CVE-2022-41791 | Medium | 6.8 | 2022-11-17 | Auth. (subscriber+) CSV Injection vulnerability in ProfileGrid plugin <= 5.1.6 on WordPress. |
CVE-2022-41775 | High | 8.8 | 2022-11-17 | SQL Injection in Handler_CFG.ashx in Delta Electronics DIAEnergie versions prior to v1.9.02.001 allows an attacker to inject SQL queries via Network |
CVE-2022-41315 | Medium | 4.8 | 2022-11-17 | Auth. Stored Cross-Site Scripting (XSS) vulnerability in Ezoic plugin <= 2.8.8 on WordPress. |
CVE-2022-41132 | Medium | 6.1 | 2022-11-17 | Unauthenticated Plugin Settings Change Leading To Stored XSS Vulnerability in Ezoic plugin <= 2.8.8 on WordPress. |
CVE-2022-40694 | Medium | 4.8 | 2022-11-17 | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress. |
CVE-2022-40200 | Critical | 9.9 | 2022-11-17 | Auth. (subscriber+) Arbitrary File Upload vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. |
CVE-2022-40192 | High | 7.1 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in wpForo Forum plugin <= 2.0.9 on WordPress. |
CVE-2022-39181 | Medium | 6.1 | 2022-11-17 | GLPI - Reports plugin for GLPI Reflected Cross-Site-Scripting (RXSS). Type 1: Reflected XSS (or Non-Persistent) - The server reads data directly from the HTTP… |
CVE-2022-39180 | Critical | 9.8 | 2022-11-17 | College Management System v1.0 - SQL Injection (SQLi). By inserting SQL commands to the username and password fields in the login.php page |
CVE-2022-39179 | High | 7.2 | 2022-11-17 | College Management System v1.0 - Authenticated remote code execution. An admin user (the authentication can be bypassed using SQL Injection that mentioned in… |
CVE-2022-39178 | Medium | 5.3 | 2022-11-17 | Webvendome - webvendome Internal Server IP Disclosure. Send GET Request to the request which is shown in the picture. Internal Server IP and Full path disclos… |
CVE-2022-38165 | Critical | 9.8 | 2022-11-17 | Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on t… |
CVE-2022-36924 | High | 8.8 | 2022-11-17 | The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulner… |
CVE-2022-36787 | Critical | 9.8 | 2022-11-17 | webvendome - webvendome SQL Injection. SQL Injection in the Parameter " DocNumber" Request : Get Request : /webvendome/showfiles.aspx?jobnumber=nullDoc Number… |
CVE-2022-36786 | Critical | 9.9 | 2022-11-17 | DLINK - DSL-224 Post-auth RCE. DLINK router version 3.0.8 has an interface where you can configure NTP servers (Network Time Protocol) via jsonrpc API. It is p… |
CVE-2022-36785 | High | 7.5 | 2022-11-17 | D-Link – G integrated Access Device4 Information Disclosure & Authorization Bypass. *Information Disclosure – file contains a URL with private IP at line 15… |
CVE-2022-36784 | Critical | 9.8 | 2022-11-17 | Elsight – Elsight Halo Remote Code Execution (RCE) Elsight Halo web panel allows us to perform connection validation. through the POST request : /api/v1/nics… |
CVE-2022-36357 | Medium | 6.1 | 2022-11-17 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webpsilon ULTIMATE TABLES plugin <= 1.6.5 versions. |
CVE-2022-28768 | High | 8.8 | 2022-11-17 | The Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) before version 5.12.6 contains a local privilege escalation vulnerability. A local… |
CVE-2022-28766 | Low | 3.3 | 2022-11-17 | Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injecti… |
CVE-2022-23748 | High | 7.8 | 2022-11-17 | mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In… |
CVE-2022-20460 | Medium | 6.7 | 2022-11-17 | In (TBD) mprot_unmap? of (TBD), there is a possible way to corrupt the memory mapping due to improper input validation. This could lead to local escalation of… |
CVE-2022-20459 | Medium | 6.7 | 2022-11-17 | In (TBD) of (TBD), there is a possible way to redirect code execution due to improper input validation. This could lead to local escalation of privilege with S… |
CVE-2022-20428 | Medium | 6.7 | 2022-11-17 | In (TBD) of (TBD), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System executio… |
CVE-2022-20427 | Medium | 6.7 | 2022-11-17 | In (TBD) of (TBD), there is a possible way to corrupt memory due to improper input validation. This could lead to local escalation of privilege with System exe… |
CVE-2022-45072 | Medium | 4.3 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. |
CVE-2022-45071 | Medium | 5.4 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. |
CVE-2022-44725 | High | 7.8 | 2022-11-17 | OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a mal… |
CVE-2022-44001 | Critical | 9.8 | 2022-11-17 | An issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed. |
CVE-2022-43192 | Medium | 6.7 | 2022-11-17 | An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a craf… |
CVE-2022-42903 | Low | 3.3 | 2022-11-17 | Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list. |
CVE-2022-3090 | High | 7.5 | 2022-11-17 | Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable… |
CVE-2022-39389 | High | 8.2 | 2022-11-17 | Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a blo… |
CVE-2022-38461 | Medium | 5.4 | 2022-11-17 | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change… |
CVE-2022-43183 | High | 8.8 | 2022-11-17 | XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java. |
CVE-2022-43179 | High | 7.2 | 2022-11-17 | Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manage_user&id=. |
CVE-2022-43163 | High | 7.2 | 2022-11-17 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /clients/view_client.php. |