CVE-2022-0xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
913 records · Page 1 of 10
An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior.
UpdatedAn integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system.
UpdatedImproper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patche
UpdatedA vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication.
UpdatedAn out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system.
UpdatedThe Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Updated- CVE-2022-0993: SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass 8.1 High
The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5.
Updated The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/
UpdatedInsufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9.
UpdatedServer-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
UpdatedAn unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example from passing malicious domains to hide their trace, by making them pass through the vulnerable domain.
Updated- CVE-2022-0988: Delta Electronics DIAEnergie CLEARTEXT Transmission of Sensitive Information 7.1 High
Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product.
Updated A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists.
UpdatedReflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11.
UpdatedInsufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability.
UpdatedUsers with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges.
UpdatedAn SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
UpdatedThe telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into a fixed buffer b->buf without any bound checks. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability.
UpdatedA flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended.
UpdatedUse after free in New Tab Page in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interactions.
UpdatedUse after free in Safe Browsing in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
UpdatedUse after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
UpdatedUse after free in Browser UI in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
UpdatedHeap buffer overflow in GPU in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
UpdatedUse after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
UpdatedUse after free in Splitscreen in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
UpdatedUse after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
UpdatedUse after free in Extensions in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
UpdatedUse after free in Blink Layout in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
UpdatedCross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
UpdatedThe Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
UpdatedThe microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.
Updated- CVE-2022-0967: Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc 6.9 Medium
Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.
Updated Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.
UpdatedStored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.
UpdatedStored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.
UpdatedUnrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
UpdatedStored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.
UpdatedThe microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.
UpdatedStored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.
UpdatedA malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write.
UpdatedThe Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
UpdatedStored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
UpdatedStored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.
UpdatedCross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.
UpdatedMultiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.
UpdatedThe Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
UpdatedThe Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the
Updated- CVE-2022-0951: File Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdoc 8.2 High
File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.
Updated Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.
UpdatedThe Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection
UpdatedThe Order Listener for WooCommerce WordPress plugin before 3.2.2 does not sanitise and escape the id parameter before using it in a SQL statement via a REST route available to unauthenticated users, leading to an SQL injection
UpdatedA vulnerability in ABB ARG600 Wireless Gateway series that could allow an attacker to exploit the vulnerability by remotely connecting to the serial port gateway, and/or protocol converter, depending on the configuration.
UpdatedStored XSS viva cshtm file upload in GitHub repository star7th/showdoc prior to v2.10.4.
Updated- CVE-2022-0945: Stored XSS viva axd and cshtml file upload in star7th/showdoc in star7th/showdoc 9.0 Critical
Stored XSS viva axd and cshtml file upload in star7th/showdoc in GitHub repository star7th/showdoc prior to v2.10.4.
Updated - CVE-2022-0944: Template injection in connection test endpoint leads to RCE in sqlpad/sqlpad 9.1 Critical
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.
Updated Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
UpdatedStored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
UpdatedStored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
UpdatedStored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
UpdatedServer-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
UpdatedStored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4.
UpdatedStored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.
UpdatedCross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0.
UpdatedHost Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.
UpdatedA single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service.
UpdatedMissing Authorization in GitHub repository saleor/saleor prior to 3.1.2.
UpdatedRed Hat Product Security does not consider this to be a vulnerability. Upstream has not acknowledged this issue as a security flaw.
Updated · Rejected recordFile upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
UpdatedXSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.
UpdatedCross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.
UpdatedFile upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
UpdatedDO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
Updated · Rejected recordOut-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
UpdatedDelta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
UpdatedThe software does not perform any authentication for critical system functionality.
UpdatedAbusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.
UpdatedThe Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data
UpdatedThe Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.
UpdatedA vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing.
UpdatedAn issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
UpdatedThere is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user.
UpdatedThe Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example
UpdatedInteger Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.
UpdatedUnrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.
UpdatedCross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
UpdatedA downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication
UpdatedDivide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
UpdatedNull source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
UpdatedUnchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f2b656e2.
UpdatedUnrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.
UpdatedMissing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.
UpdatedA stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted Apple Pages document.
UpdatedA call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body.
UpdatedImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary
UpdatedThe Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
UpdatedImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NetDataSoft DivvyDrive allows Stored XSS. This issue affects DivvyDrive: from unspecified before v.4.6.2.0.
UpdatedThe Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.
UpdatedThe IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which could lead to Stored Cross-Site Scripting issues
UpdatedA flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFil
Updated