CVE-2022-38xxx records
Browse official CVE Program records with vulnerability descriptions, affected products, CVSS scores and source references. Browse by the year and numeric range in each CVE ID; publication and update dates appear on each record.
691 records · Page 7 of 7
A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely destroying annotation objects, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitatio
UpdatedA NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
UpdatedCross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress.
UpdatedOS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command.
UpdatedMultiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
Updated · Rejected recordImproper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.
UpdatedStored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.
UpdatedA directory traversal vulnerability exists in the httpd downfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.
UpdatedExposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress.
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
Updated · Rejected recordImproper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
UpdatedOpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.
UpdatedReflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.
UpdatedCross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress.
UpdatedMovable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and versions are as follows: Movable Type 7 r.5202 and earlier, Movable Type Advanced 7 r.5202 and earlier, Mo
UpdatedCross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.
UpdatedImproper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation of privilege via local access.
UpdatedCross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.
Updated- CVE-2022-38074: WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL Injection 9.9 Critical
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.
Updated Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.
UpdatedAn improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
UpdatedThis CVE ID has been rejected or withdrawn by its CVE Numbering Authority because it is Unused
Updated · Rejected recordPrivilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress.
Updated- CVE-2022-38069: Contec Health CMS8000 4.3 Medium
Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient information or modification of device parameters
Updated Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.
UpdatedUnauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.
UpdatedAn OS command injection vulnerability exists in the httpd SNMP functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP response can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.
UpdatedA privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality within tools leveraging this library within a container can lead increased privileges.
UpdatedOpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Theme plugin <= 1.0.9 versions.
UpdatedAuthenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.
UpdatedA privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.
UpdatedCross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress.
UpdatedAuthenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.
UpdatedMissing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.
UpdatedImproper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of privilege via network access.
Updated- CVE-2022-38055: WordPress wpForo Forum plugin <= 2.0.9 - Auth. HTML Injection vulnerability 4.3 Medium
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue affects wpForo Forum: from n/a through 2.0.9.
Updated - CVE-2022-38054: Session Fixation Unscored
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
Updated Microsoft SharePoint Server Remote Code Execution Vulnerability
UpdatedWindows Graphics Component Elevation of Privilege Vulnerability
UpdatedWin32k Elevation of Privilege Vulnerability
UpdatedMicrosoft Office Graphics Remote Code Execution Vulnerability
UpdatedMicrosoft Office Remote Code Execution Vulnerability
Updated- CVE-2022-38047: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability 8.1 High
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Updated Web Account Manager Information Disclosure Vulnerability
UpdatedWindows Server Service Elevation of Privilege Vulnerability
UpdatedWindows CD-ROM File System Driver Remote Code Execution Vulnerability
Updated- CVE-2022-38043: Windows Security Support Provider Interface Information Disclosure Vulnerability 5.5 Medium
Windows Security Support Provider Interface Information Disclosure Vulnerability
Updated Active Directory Domain Services Elevation of Privilege Vulnerability
UpdatedWindows Secure Channel Denial of Service Vulnerability
UpdatedMicrosoft ODBC Driver Remote Code Execution Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
UpdatedInternet Key Exchange (IKE) Protocol Denial of Service Vulnerability
UpdatedWindows Workstation Service Elevation of Privilege Vulnerability
UpdatedWindows Server Remotely Accessible Registry Keys Information Disclosure Vulnerability
Updated- CVE-2022-38032: Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability 6.6 Medium
Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability
Updated - CVE-2022-38031: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability 8.8 High
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Updated Windows USB Serial Driver Information Disclosure Vulnerability
UpdatedWindows ALPC Elevation of Privilege Vulnerability
UpdatedWindows Print Spooler Elevation of Privilege Vulnerability
UpdatedWindows Storage Elevation of Privilege Vulnerability
UpdatedWindows DHCP Client Information Disclosure Vulnerability
Updated- CVE-2022-38025: Windows Distributed File System (DFS) Information Disclosure Vulnerability 5.5 Medium
Windows Distributed File System (DFS) Information Disclosure Vulnerability
Updated Netlogon RPC Elevation of Privilege Vulnerability
UpdatedWindows Kernel Elevation of Privilege Vulnerability
Updated- CVE-2022-38021: Connected User Experiences and Telemetry Elevation of Privilege Vulnerability 7.0 High
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Updated Visual Studio Code Elevation of Privilege Vulnerability
UpdatedAV1 Video Extension Remote Code Execution Vulnerability
UpdatedStorSimple 8000 Series Elevation of Privilege Vulnerability
Updated- CVE-2022-38016: Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability 8.8 High
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Updated Windows Hyper-V Denial of Service Vulnerability
Updated- CVE-2022-38014: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability 7.0 High
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
Updated .NET Core and Visual Studio Denial of Service Vulnerability
UpdatedMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability
UpdatedRaw Image Extension Remote Code Execution Vulnerability
UpdatedMicrosoft Office Visio Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Remote Code Execution Vulnerability
UpdatedMicrosoft SharePoint Server Remote Code Execution Vulnerability
UpdatedAzure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability
UpdatedWindows Graphics Component Information Disclosure Vulnerability
UpdatedWindows Print Spooler Elevation of Privilege Vulnerability
UpdatedWindows Fax Service Remote Code Execution Vulnerability
UpdatedWindows Resilient File System Elevation of Privilege
UpdatedMicrosoft Office Spoofing Vulnerability
Updated- CVE-2022-38000: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability 8.1 High
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Updated