CVE Daily
← All years

Uncategorized 2022

Page 2/27.

CVEs without a recognized CWE (not present in the CWE map or marked as N/A).

CVSS ≥ 0.0
2022-12-13
High

CVE-2022-44675

Windows Bluetooth Driver Elevation of Privilege Vulnerability

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2022-44674

Windows Bluetooth Driver Information Disclosure Vulnerability

CVSS: 5.5CWE: N/A
Read more
High

CVE-2022-44673

Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability

CVSS: 7.0CWE: N/A
Read more
High

CVE-2022-44671

Windows Graphics Component Elevation of Privilege Vulnerability

CVSS: 7.8CWE: N/A
Read more
High

CVE-2022-44668

Windows Media Remote Code Execution Vulnerability

CVSS: 7.8CWE: N/A
Read more
High

CVE-2022-44667

Windows Media Remote Code Execution Vulnerability

CVSS: 7.8CWE: N/A
Read more
High

CVE-2022-44666

Windows Contacts Remote Code Execution Vulnerability

CVSS: 7.8CWE: N/A
Read more
Critical

CVE-2022-41561

The JNDI Data Sources component of TIBCO Software Inc.'s TIBCO JasperReports Server, TIBCO JasperReports Server, TIBCO JasperReports Server - Community Edition, TIBCO JasperReports Server - Developer…

CVSS: 9.1CWE: N/A
Read more
High

CVE-2022-41127

Microsoft Dynamics NAV and Microsoft Dynamics 365 Business Central (On Premises) Remote Code Execution Vulnerability

CVSS: 8.5CWE: N/A
Read more
High

CVE-2022-41121

Windows Graphics Component Elevation of Privilege Vulnerability

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2022-41115

Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability

CVSS: 6.6CWE: N/A
Read more
High

CVE-2022-41094

Windows Hyper-V Elevation of Privilege Vulnerability

CVSS: 7.8CWE: N/A
Read more
High

CVE-2022-41089

.NET Framework Remote Code Execution Vulnerability

CVSS: 7.8CWE: N/A
Read more
High

CVE-2022-41077

Windows Fax Compose Form Elevation of Privilege Vulnerability

CVSS: 7.8CWE: N/A
Read more
High

CVE-2022-41076

PowerShell Remote Code Execution Vulnerability

CVSS: 8.5CWE: N/A
Read more
Medium

CVE-2022-41074

Windows Graphics Component Information Disclosure Vulnerability

CVSS: 5.5CWE: N/A
Read more
High

CVE-2022-26806

Microsoft Office Graphics Remote Code Execution Vulnerability

CVSS: 7.8CWE: N/A
Read more
High

CVE-2022-26805

Microsoft Office Graphics Remote Code Execution Vulnerability

CVSS: 7.8CWE: N/A
Read more
High

CVE-2022-26804

Microsoft Office Graphics Remote Code Execution Vulnerability

CVSS: 7.8CWE: N/A
Read more
Medium

CVE-2022-24480

Outlook for Android Elevation of Privilege Vulnerability

CVSS: 6.3CWE: N/A
Read more
High

CVE-2021-32415

EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in installers it creates.

CVSS: 7.8CWE: N/A
Read more
2022-12-12
Medium

CVE-2022-4016

The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly ch…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2022-4010

The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting atta…

CVSS: 4.8CWE: N/A
Read more
Medium

CVE-2022-4005

The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.

CVSS: 5.4CWE: N/A
Read more
Medium

CVE-2022-4004

The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX action, which may allow any users with an…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2022-4000

The WooCommerce Shipping WordPress plugin through 1.2.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting…

CVSS: 4.8CWE: N/A
Read more
High

CVE-2022-3989

The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim's WordPress i…

CVSS: 8.8CWE: N/A
Read more
Critical

CVE-2022-3982

The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and ach…

CVSS: 9.8CWE: N/A
Read more
High

CVE-2022-3981

The Icegram Express WordPress plugin before 5.5.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated use…

CVSS: 8.8CWE: N/A
Read more
Medium

CVE-2022-3935

The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting…

CVSS: 5.4CWE: N/A
Read more
Medium

CVE-2022-3934

The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high…

CVSS: 5.4CWE: N/A
Read more
Medium

CVE-2022-3933

The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.

CVSS: 5.4CWE: N/A
Read more
Medium

CVE-2022-3930

The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own.

CVSS: 6.5CWE: N/A
Read more
High

CVE-2022-3925

The buddybadges WordPress plugin through 1.0.0 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users

CVSS: 7.2CWE: N/A
Read more
Critical

CVE-2022-3921

The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE

CVSS: 9.8CWE: N/A
Read more
Medium

CVE-2022-3919

The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_h…

CVSS: 4.8CWE: N/A
Read more
Critical

CVE-2022-3915

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users

CVSS: 9.8CWE: N/A
Read more
Medium

CVE-2022-3908

The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting

CVSS: 6.1CWE: N/A
Read more
Medium

CVE-2022-3906

The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting atta…

CVSS: 4.8CWE: N/A
Read more
Critical

CVE-2022-3900

The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated atta…

CVSS: 9.8CWE: N/A
Read more
Medium

CVE-2022-3862

The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Sc…

CVSS: 4.8CWE: N/A
Read more
Medium

CVE-2022-3609

The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting atta…

CVSS: 4.8CWE: N/A
Read more
High

CVE-2022-3605

The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability.

CVSS: 7.8CWE: N/A
Read more
High

CVE-2022-3359

The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentiona…

CVSS: 8.8CWE: N/A
Read more
Medium

CVE-2022-38661

HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash.

CVSS: 6.2CWE: N/A
Read more
High

CVE-2022-38656

HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes.

CVSS: 8.6CWE: N/A
Read more
High

CVE-2022-37932

A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S Network switches. The vulnerability could be remotely exploited to allow authe…

CVSS: 8.8CWE: N/A
Read more
High

CVE-2022-37923

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attac…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2022-37922

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attac…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2022-37921

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attac…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2022-37920

Vulnerabilities in the Aruba EdgeConnect Enterprise command line interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attac…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2022-37919

A vulnerability exists in the API of Aruba EdgeConnect Enterprise. An unauthenticated attacker can exploit this condition via the web-based management interface to create a denial-of-service conditio…

CVSS: 7.5CWE: N/A
Read more
High

CVE-2022-45797

An arbitrary file deletion vulnerability in the Damage Cleanup Engine component of Trend Micro Apex One and Trend Micro Apex One as a Service could allow a local attacker to escalate privileges and d…

CVSS: 7.1CWE: N/A
Read more
High

CVE-2022-46908

SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions su…

CVSS: 7.3CWE: N/A
Read more
2022-12-09
Critical

CVE-2022-4390

A network misconfiguration is present in versions prior to 1.0.9.90 of the NETGEAR RAX30 AX2400 series of routers. IPv6 is enabled for the WAN interface by default on these devices. While there are f…

CVSS: 10.0CWE: N/A
Read more
2022-12-07
Medium

CVE-2022-39044

Hidden functionality vulnerability in multiple Buffalo network devices allows a network-adjacent attacker with an administrative privilege to execute an arbitrary OS command. The affected products/ve…

CVSS: 6.8CWE: N/A
Read more
Medium

CVE-2022-41783

tdpServer of TP-Link RE300 V1 improperly processes its input, which may allow an attacker to cause a denial-of-service (DoS) condition of the product's OneMesh function.

CVSS: 5.5CWE: N/A
Read more
2022-12-06
High

CVE-2022-4147

Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on t…

CVSS: 7.5CWE: CWE-1026
Read more
Medium

CVE-2022-41560

The Statement Set Upload via the Web Client component of TIBCO Software Inc.'s TIBCO Nimbus contains an easily exploitable vulnerability that allows a low privileged attacker with network access to e…

CVSS: 6.5CWE: N/A
Read more
Critical

CVE-2022-46383

RackN Digital Rebar through 4.6.14, 4.7 through 4.7.22, 4.8 through 4.8.5, 4.9 through 4.9.12, and 4.10 through 4.10.8 has exposed a privileged token via a public API endpoint (Incorrect Access Contr…

CVSS: 9.8CWE: N/A
Read more
2022-12-05
Medium

CVE-2022-43516

A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)

CVSS: 6.5CWE: CWE-16
Read more
Medium

CVE-2022-3909

The Add Comments WordPress plugin through 1.0.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks…

CVSS: 4.8CWE: N/A
Read more
Medium

CVE-2022-3892

The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scr…

CVSS: 4.8CWE: N/A
Read more
High

CVE-2022-3858

The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2022-3856

The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2022-3846

The Workreap WordPress theme before 2.6.3 has a vulnerability with the notifications feature as it's possible to read any user's notification (employer or freelancer) as the notification ID is brute-…

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2022-3837

The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks…

CVSS: 4.8CWE: N/A
Read more
Medium

CVE-2022-3830

The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attac…

CVSS: 4.8CWE: N/A
Read more
High

CVE-2022-3694

The Syncee WordPress plugin before 1.0.10 leaks the administrator token that can be used to take over the administrator's account.

CVSS: 7.5CWE: N/A
Read more
Medium

CVE-2022-3677

The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackers to make a logged in admin install arbitrary plugins from…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2022-3426

The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting a…

CVSS: 4.8CWE: N/A
Read more
High

CVE-2022-3249

The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high privilege users such as admin to perform SQ…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2022-1540

The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.

CVSS: 7.2CWE: N/A
Read more
2022-12-04
High

CVE-2022-46413

An issue was discovered in Veritas NetBackup Flex Scale through 3.0 and Access Appliance through 8.0.100. Authenticated remote command execution can occur via the management portal.

CVSS: 8.8CWE: N/A
Read more
High

CVE-2022-46412

An issue was discovered in Veritas NetBackup Flex Scale through 3.0. A non-privileged user may escape a restricted shell and execute privileged commands.

CVSS: 8.8CWE: N/A
Read more
2022-12-02
Medium

CVE-2022-4220

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function.…

CVSS: 5.4CWE: N/A
Read more
Medium

CVE-2022-4219

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the manage() function. This mak…

CVSS: 5.4CWE: N/A
Read more
Medium

CVE-2022-4218

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_quizzes() function. Th…

CVSS: 5.4CWE: N/A
Read more
Medium

CVE-2022-4217

The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'api_key' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and out…

CVSS: 5.5CWE: N/A
Read more
Medium

CVE-2022-4216

The Chained Quiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'facebook_appid' parameter in versions up to, and including, 1.3.2.2 due to insufficient input sanitization…

CVSS: 5.5CWE: N/A
Read more
Medium

CVE-2022-4215

The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'date' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.3 due to insuffic…

CVSS: 6.1CWE: N/A
Read more
Medium

CVE-2022-4213

The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.2 due to insufficie…

CVSS: 6.1CWE: N/A
Read more
Medium

CVE-2022-4212

The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'ipf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficien…

CVSS: 6.1CWE: N/A
Read more
Medium

CVE-2022-4211

The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'emailf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insuffic…

CVSS: 6.1CWE: N/A
Read more
Medium

CVE-2022-4210

The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dnf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insufficien…

CVSS: 6.1CWE: N/A
Read more
Medium

CVE-2022-4209

The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'pointsf' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insuffi…

CVSS: 6.1CWE: N/A
Read more
Medium

CVE-2022-4208

The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'datef' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2 due to insuffici…

CVSS: 6.1CWE: N/A
Read more
2022-12-01
High

CVE-2022-37017

Symantec Endpoint Protection (Windows) agent, prior to 14.3 RU6/14.3 RU5 Patch 1, may be susceptible to a Security Control Bypass vulnerability, which is a type of issue that can potentially allow a…

CVSS: 7.5CWE: N/A
Read more
Critical

CVE-2022-37016

Symantec Endpoint Protection (Windows) agent may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software applicatio…

CVSS: 9.8CWE: N/A
Read more
2022-11-30
Critical

CVE-2022-44136

Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE).

CVSS: 9.8CWE: N/A
Read more
Medium

CVE-2022-4195

Insufficient policy enforcement in Safe Browsing in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass Safe Browsing warnings via a malicious file. (Chromium security severity:…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2022-4193

Insufficient policy enforcement in File System API in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security sev…

CVSS: 8.8CWE: N/A
Read more
High

CVE-2022-4190

Insufficient data validation in Directory in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. (Chromium security severity: Me…

CVSS: 8.8CWE: N/A
Read more
Medium

CVE-2022-4189

Insufficient policy enforcement in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a c…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2022-4187

Insufficient policy enforcement in DevTools in Google Chrome on Windows prior to 108.0.5359.71 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (Chromium security…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2022-4185

Inappropriate implementation in Navigation in Google Chrome on iOS prior to 108.0.5359.71 allowed a remote attacker to spoof the contents of the modal dialogue via a crafted HTML page. (Chromium secu…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2022-4184

Insufficient policy enforcement in Autofill in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass autofill restrictions via a crafted HTML page. (Chromium security severity: Med…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2022-4183

Insufficient policy enforcement in Popup Blocker in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severi…

CVSS: 4.3CWE: N/A
Read more
Medium

CVE-2022-4182

Inappropriate implementation in Fenced Frames in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to bypass fenced frame restrictions via a crafted HTML page. (Chromium security severit…

CVSS: 4.3CWE: N/A
Read more
2022-11-29
High

CVE-2022-3384

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the populate_dropdown_options function that accepts user supplied input and…

CVSS: 7.2CWE: N/A
Read more
High

CVE-2022-3383

The Ultimate Member plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 2.5.0 via the get_option_value_from_callback function that accepts user supplied inpu…

CVSS: 7.2CWE: N/A
Read more
Medium

CVE-2021-31693

The 10Web Photo Gallery plugin through 1.5.68 for WordPress allows XSS via album_gallery_id_0, bwg_album_search_0, and type_0 for bwg_frontend_data. NOTE: other parameters are covered by CVE-2021-242…

CVSS: 6.5CWE: N/A
Read more
Medium

CVE-2022-4202

A vulnerability, which was classified as problematic, was found in GPAC 2.1-DEV-rev490-g68064e101-master. Affected is the function lsr_translate_coords of the file laser/lsr_dec.c. The manipulation l…

CVSS: 6.3CWE: CWE-189
Read more
2022-11-28
Medium

CVE-2022-38753

This update resolves a multi-factor authentication bypass attack

CVSS: 6.3CWE: N/A
Read more
High

CVE-2022-3865

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as l…

CVSS: 8.8CWE: N/A
Read more
Medium

CVE-2022-3850

The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via…

CVSS: 4.3CWE: N/A
Read more
High

CVE-2022-3849

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as l…

CVSS: 8.8CWE: N/A
Read more
Medium

CVE-2022-3847

The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make log…

CVSS: 6.1CWE: N/A
Read more
Medium

CVE-2022-3839

The Analytics for WP WordPress plugin through 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting atta…

CVSS: 4.8CWE: N/A
Read more
Medium

CVE-2022-3833

The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site…

CVSS: 4.8CWE: N/A
Read more
Medium

CVE-2022-3831

The reCAPTCHA WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even…

CVSS: 4.8CWE: N/A
Read more
Medium

CVE-2022-3828

The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting att…

CVSS: 4.8CWE: N/A
Read more
Medium

CVE-2022-3824

The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting…

CVSS: 4.8CWE: N/A
Read more
Medium

CVE-2022-3823

The Beautiful Cookie Consent Banner WordPress plugin before 2.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site…

CVSS: 4.8CWE: N/A
Read more
Medium

CVE-2022-3822

The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting a…

CVSS: 4.8CWE: N/A
Read more
High

CVE-2022-3769

The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low…

CVSS: 8.8CWE: N/A
Read more
High

CVE-2022-3689

The HTML Forms WordPress plugin before 1.3.25 does not properly properly escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users

CVSS: 7.2CWE: N/A
Read more
Medium

CVE-2022-3610

The Jeeng Push Notifications WordPress plugin before 2.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripti…

CVSS: 4.8CWE: N/A
Read more
Critical

CVE-2022-3603

The Export customers list csv for WooCommerce, WordPress users csv, export Guest customer list WordPress plugin before 2.0.69 does not validate data when outputting it back in a CSV file, which could…

CVSS: 9.8CWE: N/A
Read more
Medium

CVE-2022-3601

The Image Hover Effects Css3 WordPress plugin through 4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scriptin…

CVSS: 4.8CWE: N/A
Read more
>