CVE-2022-42856

CVE-2022-42856 is a type-confusion vulnerability in WebKit/WebKitGTK that could allow arbitrary code execution when processing malicious web content. The connected documents confirm impact across WebKit-based products, including Apple WebKit (Safari) and WebKitGTK, with fixes in Safari 16.2, macO...

CVE-2022-46381

Linear eMerge E3-Series devices are affected by a Cross-Site Scripting (XSS) vulnerability via the type parameter (examples: badging/badge_template_v0.php). Affected firmware/versions include 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e. The cross-site scripting could ...

CVE-2022-44698

CVE-2022-44698 is a Windows SmartScreen security feature bypass that enables bypass of Mark-of-the-Web protections via specially crafted files. The public data confirms exploitation in the wild and active exploitation historically cited by multiple sources (CISA KEV, KrebsOnSecurity). The underly...

CVE-2022-44710

CVE-2022-44710: DirectX Graphics Kernel Elevation of Privilege vulnerability in Windows, reportedly exploitable via a race condition and requiring local access with low privileges; CVSS v3.1 base score 7.8 (HIGH). Patch guidance is to install the relevant Windows updates (as per December 2022 Pat...

CVE-2022-27518

CVE-2022-27518 affects Citrix ADC and Citrix Gateway when configured as a SAML SP or SAML IdP. The vulnerability allows unauthenticated remote arbitrary code execution. Citrix’s security bulletin CTX474995 lists affected versions: ADC/Gateway 13.0 before 13.0-58.32; 12.1 before 12.1-65.25; 12.1-F...

CVE-2022-3982

Summary (concrete details available) : CVE-2022-3982 affects the WordPress plugin “Booking Calendar” prior to version 3.2.2. The vulnerability is an arbitrary file upload flaw due to lack of validation, allowing unauthenticated users to upload files (e.g., PHP) and potentially achieve remote code...

CVE-2022-41800

CVE-2022-41800: BIG-IP Appliance mode iControl REST vulnerability means that, in Appliance mode, an authenticated administrator can bypass restrictions via an undisclosed iControl REST endpoint, potentially crossing a security boundary and, in some exploit samples, enabling root-level access. Pub...

CVE-2022-41622

CVE-2022-41622 is a cross-site request forgery (CSRF) vulnerability in iControl SOAP affecting BIG-IP and BIG-IQ. An authenticated user with resource administrator privileges can trick the user into performing actions on the control plane. Affected versions include BIG-IP (17.x up to 17.0.0.2; 16...

CVE-2022-42458

CVE-2022-42458 affects bingo!CMS versions 1.7.4.1 and earlier, where an authentication bypass vulnerability in management functions allows remote, unauthenticated attackers to upload arbitrary files, potentially enabling arbitrary script execution or file modification. The Red Hat and JVN entries...

CVE-2022-45359

CVE-2022-45359 affects the WordPress YITH WooCommerce Gift Cards Premium plugin up to version 3.19.0. The vulnerability is an unauthenticated Arbitrary File Upload via the import_actions_from_settings_panel function that runs on admin_init, allowing attackers to upload files (e.g., web shells) wi...

CVE-2022-46169

CVE-2022-46169 affects Cacti and enables unauthenticated command execution via remote_agent.php when a poller_item with POLLER_ACTION_SCRIPT_PHP is present. The root cause is an IP-based auth bypass: HTTP_ headers can be spoofed (e.g., Forwarded-For) so get_client_addr returns the server IP, allo...

CVE-2022-4262

CVE-2022-4262 : Type confusion in V8 in Google Chrome prior to 108.0.5359.94 allows remote attackers to potentially exploit heap corruption via a crafted HTML page. Affects Google Chrome/Chromium users; base CVSS v3.1 score 8.8 (HIGH). Chrome notes an exploit exists in the wild and released a fix...

CVE-2022-4257

C-DATA Web Management System contains a vulnerability in the GET Parameter Handler’s cgi-bin/jumpto.php where manipulating the hostname argument leads to argument injection. The issue can be exploited remotely and an exploit has been disclosed publicly. Affected component/file: cgi-bin/jumpto.php...

CVE-2022-45045

The CVE-2022-45045 issue affects Xiongmai NVR models such as MBD6304T (V4.02.R11.00000117.10001.131900.00000) and NBD6808T-PL (V4.02.R11.C7431119.12001.130000.00000). It allows an authenticated attacker to execute arbitrary OS commands as root by supplying a crafted JSON during an upgrade request...

CVE-2022-37932

HP OfficeConnect switches (1820, 1850, 1920S) are affected by CVE-2022-37932, with an authentication bypass vulnerability in the login flow. The issue exists in the web/HTTP login handling where the default password can be changed without prior authentication, enabling an unauthenticated attacker...

CVE-2022-41412

CVE-2022-41412 affects perfSONAR's graphData.cgi in v4.4.5 and earlier, enabling unauthenticated SSRF and access to internal resources/data. The root cause is improper handling of URL parameters in graphData.cgi, allowing attackers to proxy/relay HTTP(S) requests through the server. Impact is dat...

CVE-2022-40799

CVE-2022-40799 affects D-Link DNR-322L firmware, where a data integrity failure in the Backup Config feature (Version

CVE-2022-45933

KubeView

CVE-2022-4135

CVE-2022-4135 affects Google Chrome/Chromium GPU code. It is a heap buffer overflow in the GPU path prior to Chrome 107.0.5304.121 that could allow a remote attacker (with renderer access) to escape the sandbox via a crafted HTML page. Chrome confirms exploitation in the wild; a stable-channel pa...

CVE-2022-41223

The CVE-2022-41223 issue affects the Director database component of Mitel MiVoice Connect (up to 19.3 / 22.22.6100.0). An authenticated attacker can perform a code-injection attack via crafted data due to insufficient restrictions on the database data type. This vulnerability is tracked by CISA a...