Lista CVE - 2022 / Novembre
Visualizzazione 1901 - 2000 di 2020 CVE per Novembre 2022 (Pagina 20 di 21)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2022-46146 | 2022-11-29 | Prometheus Exporter Toolkit vulnerable to basic authentication bypass |
| CVE-2021-31693 | 2022-11-29 | The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-24291, CVE-2021-25041, and CVE-2021-46889. NOTE: VMware... |
| CVE-2022-3086 | 2022-11-29 | Cradlepoint IBR600 Command Injection |
| CVE-2022-36136 | 2022-11-29 | ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input Deposit Comment. |
| CVE-2022-36137 | 2022-11-29 | ChurchCRM Version 4.4.5 has XSS vulnerabilities that allow attackers to store XSS via location input sHeader. |
| CVE-2022-36433 | 2022-11-29 | The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the short_content and full_content fields, leading to XSS attacks against... |
| CVE-2022-3751 | 2022-11-29 | SQL Injection in owncast/owncast |
| CVE-2022-40799 | 2022-11-29 | Data Integrity Failure in 'Backup Config' in D-Link DNR-322L <= 2.60B15 allows an authenticated attacker to execute OS level commands on the device. |
| CVE-2022-4144 | 2022-11-29 | An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest... |
| CVE-2022-41568 | 2022-11-29 | LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat. |
| CVE-2022-4172 | 2022-11-29 | An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow... |
| CVE-2022-4202 | 2022-11-29 | GPAC lsr_dec.c lsr_translate_coords integer overflow |
| CVE-2022-42099 | 2022-11-29 | KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location Forum Subject input. |
| CVE-2022-42100 | 2022-11-29 | KLiK SocialMediaWebsite Version 1.0.1 has XSS vulnerabilities that allow attackers to store XSS via location input reply-form. |
| CVE-2022-42109 | 2022-11-29 | Online-shopping-system-advanced 1.0 was discovered to contain a SQL injection vulnerability via the p parameter at /shopping/product.php. |
| CVE-2022-43326 | 2022-11-29 | An Insecure Direct Object Reference (IDOR) vulnerability in the password reset function of Telos Alliance Omnia MPX Node 1.0.0-1.4.[*] allows attackers to arbitrarily change user and Administrator account passwords. |
| CVE-2022-44037 | 2022-11-29 | An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions... |
| CVE-2022-44038 | 2022-11-29 | Russound XSourcePlayer 777D v06.08.03 was discovered to contain a remote code execution vulnerability via the scriptRunner.cgi component. |
| CVE-2022-44279 | 2022-11-29 | Garage Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /garage/php_action/createBrand.php. |
| CVE-2022-44354 | 2022-11-29 | SolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file. |
| CVE-2022-44355 | 2022-11-29 | SolarView Compact 7.0 is vulnerable to Cross-site Scripting (XSS) via /network_test.php. |
| CVE-2022-44356 | 2022-11-29 | WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files. |
| CVE-2022-44635 | 2022-11-29 | Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal |
| CVE-2022-45202 | 2022-11-29 | GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a stack overflow via the function dimC_box_read at isomedia/box_code_3gpp.c. |
| CVE-2022-45204 | 2022-11-29 | GPAC v2.1-DEV-rev428-gcb8ae46c8-master was discovered to contain a memory leak via the function dimC_box_read at isomedia/box_code_3gpp.c. |
| CVE-2022-45301 | 2022-11-29 | Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\ruby31 and all files located in that folder. |
| CVE-2022-45304 | 2022-11-29 | Insecure permissions in Chocolatey Cmder package v1.3.20 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\Cmder and all files located in that folder. |
| CVE-2022-45305 | 2022-11-29 | Insecure permissions in Chocolatey Python3 package v3.11.0 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\Python311 and all files located in that folder. |
| CVE-2022-45306 | 2022-11-29 | Insecure permissions in Chocolatey Azure-Pipelines-Agent package v2.211.1 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\agent and all files located in that folder. |
| CVE-2022-45307 | 2022-11-29 | Insecure permissions in Chocolatey PHP package v8.1.12 and below grants all users in the Authenticated Users group write privileges for the subfolder C:\tools\php81 and all files located in that folder. |
| CVE-2022-45329 | 2022-11-29 | AeroCMS v0.0.1 was discovered to contain a SQL Injection vulnerability via the Search parameter. This vulnerability allows attackers to access database information. |
| CVE-2022-45343 | 2022-11-29 | GPAC v2.1-DEV-rev478-g696e6f868-master was discovered to contain a heap use-after-free via the Q_IsTypeOn function at /gpac/src/bifs/unquantize.c. |
| CVE-2022-46148 | 2022-11-29 | Discourse allows self-XSS through malicious composer message |
| CVE-2022-46150 | 2022-11-29 | Discourse may allow exposure of hidden tags in the subject of notification emails |
| CVE-2022-46152 | 2022-11-29 | OP-TEE Trusted OS vulnerable to Improper Validation of Array Index in the cleanup_shm_refs function |
| CVE-2022-46155 | 2022-11-29 | Airtable.js credentials exposed in browser builds |
| CVE-2022-32966 | 2022-11-29 | Realtek RTL8111FP-CG - Missing Authorization |
| CVE-2022-32967 | 2022-11-29 | Realtek RTL8111EP-CG/RTL8111FP-CG - Use of Hard-coded Credentials |
| CVE-2022-41675 | 2022-11-29 | TEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Formula Injection |
| CVE-2022-41676 | 2022-11-29 | TEAM JOHNLONG SOFTWARE CO., LTD. MAILD Mail Server - Cross-Site Scripting |
| CVE-2022-25848 | 2022-11-29 | Directory Traversal |
| CVE-2022-21126 | 2022-11-29 | Creation of Temporary File in Directory with Insecure Permissions |
| CVE-2022-4027 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during a forum response in versions up to, and including, 6.8 due to insufficient... |
| CVE-2022-4028 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postitem' parameter manipulated during the profile-save action when modifying a profile signature in versions up to, and... |
| CVE-2022-4029 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'sforum_[md5 hash of the WordPress URL]' cookie value in versions up to, and including, 6.8 due to... |
| CVE-2022-4030 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated during user avatar deletion. This... |
| CVE-2022-4031 | 2022-11-29 | The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does not properly restrict files to be... |
| CVE-2022-4032 | 2022-11-29 | The Quiz and Survey Master plugin for WordPress is vulnerable to iFrame Injection via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input sanitization and... |
| CVE-2022-4033 | 2022-11-29 | The Quiz and Survey Master plugin for WordPress is vulnerable to input validation bypass via the 'question[id]' parameter in versions up to, and including, 8.0.4 due to insufficient input validation... |
| CVE-2022-4034 | 2022-11-29 | The Appointment Hour Booking Plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.3.72. This makes it possible for unauthenticated attackers to embed untrusted input... |
| CVE-2022-4035 | 2022-11-29 | The Appointment Hour Booking plugin for WordPress is vulnerable to iFrame Injection via the ‘email’ or general field parameters in versions up to, and including, 1.3.72 due to insufficient input... |
| CVE-2022-4036 | 2022-11-29 | The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm... |
| CVE-2022-3361 | 2022-11-29 | The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes.... |
| CVE-2022-3384 | 2022-11-29 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and passes... |
| CVE-2022-3383 | 2022-11-29 | The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied input and passes... |
| CVE-2022-3747 | 2022-11-29 | The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings.... |
| CVE-2022-3896 | 2022-11-29 | The WP Affiliate Platform plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_SERVER["REQUEST_URI"] in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping.... |
| CVE-2022-3897 | 2022-11-29 | The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output... |
| CVE-2022-3898 | 2022-11-29 | The WP Affiliate Platform plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.3.9. This is due to missing or incorrect nonce validation on... |
| CVE-2022-3995 | 2022-11-29 | The TeraWallet plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 1.4.3. This is due to insufficient validation of the user-controlled key on... |
| CVE-2022-3991 | 2022-11-29 | The Photospace Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters saved via the update() function in versions up to, and including, 2.3.5 due to... |
| CVE-2022-36960 | 2022-11-29 | SolarWinds Platform Improper Input Validation |
| CVE-2022-36962 | 2022-11-29 | SolarWinds Platform Command Injection |
| CVE-2022-36964 | 2022-11-29 | SolarWinds Platform Deserialization of Untrusted Data |
| CVE-2022-4228 | 2022-11-30 | SourceCodester Book Store Management System information disclosure |
| CVE-2022-4232 | 2022-11-30 | SourceCodester Event Registration System unrestricted upload |
| CVE-2021-31740 | 2022-11-30 | SEPPMail's web frontend, user input is not embedded correctly in the web page and therefore leads to cross-site scripting vulnerabilities (XSS). |
| CVE-2021-4242 | 2022-11-30 | Sapido BR270n/BRC76n/GR297/RB1732 syscmd.htm os command injection |
| CVE-2022-22984 | 2022-11-30 | Command Injection |
| CVE-2022-23746 | 2022-11-30 | The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a... |
| CVE-2022-24441 | 2022-11-30 | Code Injection |
| CVE-2022-38801 | 2022-11-30 | In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting. |
| CVE-2022-38802 | 2022-11-30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by... |
| CVE-2022-38803 | 2022-11-30 | Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local files by exploiting XSS into a pdf generator... |
| CVE-2022-41412 | 2022-11-30 | An issue in the graphData.cgi component of perfSONAR v4.4.5 and prior allows attackers to access sensitive data and execute Server-Side Request Forgery (SSRF) attacks. |
| CVE-2022-41413 | 2022-11-30 | perfSONAR v4.x <= v4.4.5 was discovered to contain a Cross-Site Request Forgery (CSRF) which is triggered when an attacker injects crafted input into the Search function. |
| CVE-2022-4222 | 2022-11-30 | SourceCodester Canteen Management System POST Request ajax_invoice.php query sql injection |
| CVE-2022-4229 | 2022-11-30 | SourceCodester Book Store Management System index.php access control |
| CVE-2022-4231 | 2022-11-30 | Tribal Systems Zenario CMS Remember Me session fixiation |
| CVE-2022-4233 | 2022-11-30 | SourceCodester Event Registration System cross site scripting |
| CVE-2022-4234 | 2022-11-30 | SourceCodester Canteen Management System brand.php builtin_echo cross site scripting |
| CVE-2022-44096 | 2022-11-30 | Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel. |
| CVE-2022-44097 | 2022-11-30 | Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel. |
| CVE-2022-44136 | 2022-11-30 | Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE). |
| CVE-2022-44151 | 2022-11-30 | Simple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php. |
| CVE-2022-44294 | 2022-11-30 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manage_service&id=. |
| CVE-2022-44295 | 2022-11-30 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=. |
| CVE-2022-44296 | 2022-11-30 | Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manage_remark.php?id=. |
| CVE-2022-45328 | 2022-11-30 | Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_members.php. |
| CVE-2022-45332 | 2022-11-30 | LibreDWG v0.12.4.4643 was discovered to contain a heap buffer overflow via the function decode_preR13_section_hdr at decode_r11.c. |
| CVE-2022-45337 | 2022-11-30 | Tenda TX9 Pro v22.03.02.10 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind. |
| CVE-2022-45869 | 2022-11-30 | A race condition in the x86 KVM subsystem in the Linux kernel through 6.1-rc6 allows guest OS users to cause a denial of service (host OS crash or host OS... |
| CVE-2022-46149 | 2022-11-30 | Cap'n Proto vulnerable to out-of-bounds read due to logic error handling list-of-list. |
| CVE-2022-46156 | 2022-11-30 | Grafana's default installation of `synthetic-monitoring-agent` exposes sensitive information |
| CVE-2022-46162 | 2022-11-30 | Discourse BBCode plugin vulnerable to arbitrary CSS injection |
| CVE-2022-46338 | 2022-11-30 | g810-led 0.4.2, a LED configuration tool for Logitech Gx10 keyboards, contained a udev rule to make supported device nodes world-readable and writable, allowing any process on the system to read... |
| CVE-2022-40265 | 2022-11-30 | Denial of Service (DoS) Vulnerability in MELSEC iQ-R Series Ethernet Interface Module |
| CVE-2022-3859 | 2022-11-30 | An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. This allows an attacker with admin access, which is required to place the... |
| CVE-2022-26366 | 2022-11-30 | WordPress AdRotate Banner Manager Plugin <= 5.9 is vulnerable to Cross Site Request Forgery (CSRF) |
| CVE-2022-45842 | 2022-11-30 | WordPress WP ULike Plugin <= 4.6.4 is vulnerable to Race Condition vulnerability |