2022 CVEs (page 96)
Page 96 of 265 — CVEs published in 2022, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36357 | Medium | 6.1 | 2022-11-17 | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Webpsilon ULTIMATE TABLES plugin <= 1.6.5 versions. |
CVE-2022-28768 | High | 8.8 | 2022-11-17 | The Zoom Client for Meetings Installer for macOS (Standard and for IT Admin) before version 5.12.6 contains a local privilege escalation vulnerability. A local… |
CVE-2022-28766 | Low | 3.3 | 2022-11-17 | Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injecti… |
CVE-2022-23748 | High | 7.8 | 2022-11-17 | mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In… |
CVE-2022-20460 | Medium | 6.7 | 2022-11-17 | In (TBD) mprot_unmap? of (TBD), there is a possible way to corrupt the memory mapping due to improper input validation. This could lead to local escalation of… |
CVE-2022-20459 | Medium | 6.7 | 2022-11-17 | In (TBD) of (TBD), there is a possible way to redirect code execution due to improper input validation. This could lead to local escalation of privilege with S… |
CVE-2022-20428 | Medium | 6.7 | 2022-11-17 | In (TBD) of (TBD), there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System executio… |
CVE-2022-20427 | Medium | 6.7 | 2022-11-17 | In (TBD) of (TBD), there is a possible way to corrupt memory due to improper input validation. This could lead to local escalation of privilege with System exe… |
CVE-2022-45072 | Medium | 4.3 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. |
CVE-2022-45071 | Medium | 5.4 | 2022-11-17 | Cross-Site Request Forgery (CSRF) vulnerability in WPML Multilingual CMS premium plugin <= 4.5.13 on WordPress. |
CVE-2022-44725 | High | 7.8 | 2022-11-17 | OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a mal… |
CVE-2022-44001 | Critical | 9.8 | 2022-11-17 | An issue was discovered in BACKCLICK Professional 5.9.63. User authentication for accessing the CORBA back-end services can be bypassed. |
CVE-2022-43192 | Medium | 6.7 | 2022-11-17 | An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a craf… |
CVE-2022-42903 | Low | 3.3 | 2022-11-17 | Zoho ManageEngine SupportCenter Plus through 11024 allows low-privileged users to view the organization users list. |
CVE-2022-3090 | High | 7.5 | 2022-11-17 | Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable… |
CVE-2022-39389 | High | 8.2 | 2022-11-17 | Lightning Network Daemon (lnd) is an implementation of a lightning bitcoin overlay network node. All lnd nodes before version `v0.15.4` are vulnerable to a blo… |
CVE-2022-38461 | Medium | 5.4 | 2022-11-17 | Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change… |
CVE-2022-43183 | High | 8.8 | 2022-11-17 | XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java. |
CVE-2022-43179 | High | 7.2 | 2022-11-17 | Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manage_user&id=. |
CVE-2022-43163 | High | 7.2 | 2022-11-17 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /clients/view_client.php. |
CVE-2022-43162 | High | 7.2 | 2022-11-17 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/view_test.php. |
CVE-2022-43142 | Medium | 6.1 | 2022-11-17 | A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arbitrary web scripts… |
CVE-2022-44403 | High | 7.2 | 2022-11-17 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=user/manage_user&id=. |
CVE-2022-44402 | High | 7.2 | 2022-11-17 | Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_transaction. |
CVE-2022-41920 | Medium | 6.3 | 2022-11-17 | Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip… |
CVE-2022-4053 | Low | 2.4 | 2022-11-17 | A vulnerability was found in Student Attendance Management System. It has been classified as problematic. Affected is an unknown function of the file createCla… |
CVE-2022-4052 | Medium | 4.7 | 2022-11-17 | A vulnerability was found in Student Attendance Management System and classified as critical. This issue affects some unknown processing of the file /Admin/cre… |
CVE-2022-4051 | Medium | 6.3 | 2022-11-17 | A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file view-property.php. T… |
CVE-2022-44384 | High | 8.8 | 2022-11-17 | An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-43140 | High | 7.5 | 2022-11-17 | kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile… |
CVE-2022-43138 | Critical | 9.8 | 2022-11-17 | Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API. |
CVE-2022-42894 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). An unauthenticated Server-Side Request Forgery (SSRF) vulnerability was iden… |
CVE-2022-42893 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42892 | Medium | 5.3 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42891 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42734 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42733 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-42732 | High | 7.5 | 2022-11-17 | A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation wit… |
CVE-2022-40751 | Medium | 4.9 | 2022-11-17 | IBM UrbanCode Deploy (UCD) 6.2.7.0 through 6.2.7.17, 7.0.0.0 through 7.0.5.12, 7.1.0.0 through 7.1.2.8, and 7.2.0.0 through 7.2.3.1 could allow a user with ad… |
CVE-2022-38390 | Medium | 5.4 | 2022-11-17 | Multiple IBM Business Automation Workflow versions are vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i… |
CVE-2022-45461 | High | 7.5 | 2022-11-17 | The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been exp… |
CVE-2022-42985 | Medium | 4.8 | 2022-11-17 | The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform… |
CVE-2022-42982 | High | 7.5 | 2022-11-17 | BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (te… |
CVE-2022-42954 | Medium | 5.4 | 2022-11-17 | Keyfactor EJBCA before 7.10.0 allows XSS. |
CVE-2022-39834 | Medium | 5.4 | 2022-11-17 | A stored XSS vulnerability was discovered in adminweb/ra/viewendentity.jsp in PrimeKey EJBCA through 7.9.0.2. A low-privilege user can store JavaScript in orde… |
CVE-2022-36432 | Medium | 5.4 | 2022-11-17 | The Preview functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 uses eval unsafely. This allows attackers to perform Cross-site Scripting attacks… |
CVE-2022-42246 | High | 8.8 | 2022-11-17 | Doufox 0.0.4 contains a CSRF vulnerability that can add system administrator account. |
CVE-2022-42245 | Critical | 9.8 | 2022-11-17 | Dreamer CMS 4.0.01 is vulnerable to SQL Injection. |
CVE-2022-42187 | Medium | 6.1 | 2022-11-17 | Hustoj 22.09.22 has a XSS Vulnerability in /admin/problem_judge.php. |
CVE-2022-40881 | Critical | 9.8 | 2022-11-17 | SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php |
CVE-2022-43782 | Critical | 9.8 | 2022-11-17 | Affected versions of Atlassian Crowd allow an attacker to authenticate as the crowd application via security misconfiguration and subsequent ability to call pr… |
CVE-2022-43781 | Critical | 9.8 | 2022-11-17 | There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their userna… |
CVE-2022-42960 | Medium | 5.4 | 2022-11-17 | EqualWeb Accessibility Widget 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.1.10, 3.0.0, 3.0.1, 3.0.2, 4.0.0, and 4.0.1 allows DOM XSS due to improper validation of mes… |
CVE-2022-44006 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation or sanitization of upload filenames, an externally reachable, unauthentica… |
CVE-2022-44005 | Medium | 5.3 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to the use of consecutive IDs in verification links, the newsletter sign-up functionality is vuln… |
CVE-2022-44004 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to insecure design or lack of authentication, unauthenticated attackers can complete the password… |
CVE-2022-44003 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient escaping of user-supplied input, the application is vulnerable to SQL injection a… |
CVE-2022-44002 | Medium | 6.1 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to insufficient output encoding of user-supplied data, the web application is vulnerable to cross… |
CVE-2022-44000 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system comma… |
CVE-2022-40752 | Critical | 9.8 | 2022-11-16 | IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements. IBM X-Force ID: 236687. |
CVE-2022-44008 | Medium | 6.5 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation, arbitrary local files can be retrieved by accessing the back-end Tomcat s… |
CVE-2022-44007 | High | 8.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users in… |
CVE-2022-43999 | Critical | 9.8 | 2022-11-16 | An issue was discovered in BACKCLICK Professional 5.9.63. Due to exposed CORBA management services, arbitrary system commands can be executed on the server. |
CVE-2022-39319 | Medium | 4.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in the `urbdrc` channel. A mali… |
CVE-2022-39318 | Medium | 4.8 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input validation in `urbdrc` channel. A malicious serve… |
CVE-2022-39317 | Medium | 4.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing a range check for input offset index in ZGFX decoder. A… |
CVE-2022-43135 | Critical | 9.8 | 2022-11-16 | Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnostic/login.php. |
CVE-2022-41914 | Low | 3.7 | 2022-11-16 | Zulip is an open-source team collaboration tool. For organizations with System for Cross-domain Identity Management(SCIM) account management enabled, Zulip Ser… |
CVE-2022-41877 | Medium | 4.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing input length validation in `drive` channel. A malicious… |
CVE-2022-39383 | Medium | 4.9 | 2022-11-16 | KubeVela is an open source application delivery platform. Users using the VelaUX APIServer could be affected by this vulnerability. When using Helm Chart as th… |
CVE-2022-39347 | Low | 2.6 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP are missing path canonicalization and base path check for `drive` c… |
CVE-2022-39320 | Medium | 5.5 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. Affected versions of FreeRDP may attempt integer addition on too narrow types leads to allocatio… |
CVE-2022-39316 | Medium | 4.8 | 2022-11-16 | FreeRDP is a free remote desktop protocol library and clients. In affected versions there is an out of bound read in ZGFX decoder component of FreeRDP. A malic… |
CVE-2022-34354 | Medium | 4.0 | 2022-11-16 | IBM Sterling Partner Engagement Manager 2.0 allows encrypted storage of client data to be stored locally which can be read by another user on the system. IBM… |
CVE-2022-44073 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via svg,Users & Contacts. |
CVE-2022-44071 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile. |
CVE-2022-44070 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles. |
CVE-2022-44069 | Medium | 5.4 | 2022-11-16 | Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module. |
CVE-2022-43264 | High | 7.5 | 2022-11-16 | Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to perform directory traversal and download arbitrary files via a crafted web reque… |
CVE-2022-43263 | Medium | 6.1 | 2022-11-16 | A cross-site scripting (XSS) vulnerability in Arobas Music Guitar Pro for iPad and iPhone before v1.10.2 allows attackers to execute arbitrary web scripts or H… |
CVE-2022-43262 | Critical | 9.8 | 2022-11-16 | Human Resource Management System v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /hrm/controller/login.php. |
CVE-2022-43256 | Critical | 9.8 | 2022-11-16 | SeaCms before v12.6 was discovered to contain a SQL injection vulnerability via the component /js/player/dmplayer/dmku/index.php. |
CVE-2022-43234 | Critical | 9.8 | 2022-11-16 | An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted PHP file. |
CVE-2022-4022 | Medium | 6.4 | 2022-11-16 | The SVG Support plugin for WordPress defaults to insecure settings in version 2.5 and 2.5.1. SVG files containing malicious javascript are not sanitized. While… |
CVE-2022-4021 | High | 8.8 | 2022-11-16 | The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This is due to missing… |
CVE-2022-4018 | Medium | 4.3 | 2022-11-16 | Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6. |
CVE-2022-3980 | Critical | 9.8 | 2022-11-16 | An XML External Entity (XEE) vulnerability allows server-side request forgery (SSRF) and potential code execution in Sophos Mobile managed on-premises between… |
CVE-2022-24036 | High | 8.6 | 2022-11-16 | Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs. |
CVE-2022-45047 | Critical | 9.8 | 2022-11-16 | Class org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider in Apache MINA SSHD <= 2.9.1 uses Java deserialization to load a serialized java.securi… |
CVE-2022-4015 | Medium | 4.7 | 2022-11-16 | A vulnerability, which was classified as critical, was found in Sports Club Management System 119. This affects an unknown part of the file admin/make_payments… |
CVE-2022-4014 | Medium | 4.3 | 2022-11-16 | A vulnerability, which was classified as problematic, has been found in FeehiCMS. Affected by this issue is some unknown functionality of the component Post My… |
CVE-2022-4013 | Medium | 4.3 | 2022-11-16 | A vulnerability classified as problematic was found in Hospital Management Center. Affected by this vulnerability is an unknown functionality of the file appoi… |
CVE-2022-4012 | Medium | 6.3 | 2022-11-16 | A vulnerability classified as critical has been found in Hospital Management Center. Affected is an unknown function of the file patient-info.php. The manipula… |
CVE-2022-4011 | Medium | 6.5 | 2022-11-16 | A vulnerability was found in Simple History Plugin. It has been rated as critical. This issue affects some unknown processing of the component Header Handler… |
CVE-2022-2166 | Critical | 9.8 | 2022-11-16 | Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0. |
CVE-2022-41917 | Medium | 4.3 | 2022-11-16 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. OpenSearch allows users to specify a local file when defining text analyzers to… |
CVE-2022-3920 | Medium | 5.3 | 2022-11-16 | HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the… |
CVE-2022-41918 | Medium | 6.3 | 2022-11-15 | OpenSearch is a community-driven, open source fork of Elasticsearch and Kibana. There is an issue with the implementation of fine-grained access control rules… |
CVE-2022-41916 | Medium | 5.9 | 2022-11-15 | Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI cer… |
CVE-2022-4006 | Low | 3.7 | 2022-11-15 | A vulnerability, which was classified as problematic, has been found in WBCE CMS. Affected by this issue is the function increase_attempts of the file wbce/fra… |