CVE-2022-2290

CVE-2022-2290 is a reflected Cross-Site Scripting (XSS) vulnerability in Trilium Notes prior to 0.52.4 and 0.53.1-beta, as disclosed by multiple sources. The issue affects the web interface where user-supplied input can be reflected in the browser without proper sanitization, enabling an attacker...

CVE-2022-1916

CVE-2022-1916 concerns the WordPress plugin “Active Products Tables for WooCommerce” (prior to v1.0.5). The vulnerability is a reflected cross-site scripting (XSS) flaw caused by the plugin not sanitizing/escaping a parameter before echoing it in the response of an AJAX action. This action is acc...

CVE-2022-1574

WordPress HTML2WP plugin

CVE-2022-33915

CVE-2022-33915 describes a race-condition in the Amazon AWS log4j-cve-2021-44228-hotpatch package (pre-1.3.5). The hotpatch iterates running Java processes and loads a patch with the same permissions, which can be exploited by a local user to cause a privileged execution when a custom Java proces...

CVE-2022-30023

The CVE-2022-30023 issue affects Tenda ONT GPON AC1200 Dual Band WiFi HG9 (firmware v1.0.1). It is a command-injection vulnerability exploitable via the Ping function, enabling remote code execution with network access and high impact on confidentiality, integrity, and availability (as reflected ...

CVE-2022-31847

CVE-2022-31847 affects WAVLINK WN579 X3 M79X3.V5030.180719. The vulnerability is in /cgi-bin/ExportAllSettings.sh and allows an attacker to obtain sensitive router information via a crafted POST request, as described in multiple sources. The incident is characterized as an information-disclosure ...

CVE-2022-22071

CVE-2022-22071 describes a use-after-free condition in Qualcomm Snapdragon chipsets where process shell memory is freed via IOCTL munmap during initialization. Affected lines include Snapdragon Auto, Compute, Connectivity, Consumer IOT, Industrial IOT, Mobile, and Voice & Music families. The vuln...

CVE-2022-31446

CVE-2022-31446 affects Tenda AC18 router versions V15.03.05.05–V15.03.05.19. It is a remote code execution vulnerability exploitable via the Mac parameter at the endpoint ip/goform/WriteFacMac, caused by failure to properly filter special elements in the constructed code segment. Potential impact...

CVE-2022-1768

WordPress RSVPMaker plugin =9.3.3 and review database permissions to limit potential impact until patching is complete.

CVE-2022-0827

WordPress Best Books plugin (versions up to 2.6.3) contains an SQL injection due to insufficient sanitization/escaping of parameters in an Ajax action. The vulnerability affects the plugin's handling of user-supplied data in SQL statements, enabling unauthenticated attackers to potentially read o...

CVE-2022-0786

CVE-2022-0786 : WordPress KiviCare plugin vulnerable to unauthenticated SQL injection in versions before 2.3.9 via the ajax_post route get_doctor_details. The issue arises from improper sanitization/escaping of parameters used in SQL statements, allowing attackers to access or modify data and pot...

CVE-2022-25845

CVE-2022-25845 affects Alibaba Fastjson prior to 1.2.83. The root cause is a bypass of the default autoType shutdown restrictions during deserialization of untrusted data, allowing attacker-controlled payloads to trigger deserialization. The impact is described as remote attack potential on vulne...

CVE-2022-29014

Razer Sila Gaming Router 2.0.441_api-2.0.418 is vulnerable to Local File Inclusion, enabling an attacker to read arbitrary files on the device. The entry points and exact vulnerable component are documented in the Nuclei template for CVE-2022-29014, with the root cause described as LFI in the aff...

CVE-2022-29013

CVE-2022-29013 concerns the Razer Sila Gaming Router. The vulnerability is a command injection in the router’s ubus API where the attacker can supply a crafted POST request to the command parameter, enabling arbitrary commands to be executed. The issue is unauthenticated and can lead to complete ...

CVE-2022-26134

CVE-2022-26134 is an unauthenticated OGNL injection in Atlassian Confluence Server and Data Center that enables remote code execution. Affected: Confluence Server/Data Center versions from 1.3.0 up to 7.4.16, 7.13.x up to 7.13.6, 7.14.x up to 7.14.2, 7.15.x up to 7.15.1, 7.16.x up to 7.16.3, 7.17...

CVE-2022-1703

CVE-2022-1703 affects the SonicWall SSL-VPN SMA100 series, specifically the management interface. The issue is an improper neutralization of special elements in the interface, enabling a remote authenticated attacker to inject OS commands and potentially achieve remote command execution or cause ...

CVE-2022-31459

CVE-2022-31459 affects Owl Labs Meeting Owl 5.2.0.15 and describes an information-disclosure vulnerability where an attacker can retrieve the passcode hash over Bluetooth Low Energy. The vulnerability stems from weak data exposure (passcode hash) via a BLE endpoint, enabling potential offline bru...

CVE-2022-31461

The CVE-2022-31461 issue affects Owl Labs Meeting Owl 5.2.0.15, where an attacker in proximity can deactivate the device’s passcode protection by sending a specific BLE/companion-app message, effectively bypassing authentication. Root cause is a bypass of the passcode mechanism via a crafted mess...

CVE-2022-31462

CVE-2022-31462 affects Owl Labs Meeting Owl 5.2.0.15. The root issue is a backdoor passcode vulnerability: a hardcoded passcode, derived from the device serial number, is broadcast via BLE as part of the device name, enabling a nearby attacker to gain control of the device. Related documentation ...

CVE-2022-31463

CVE-2022-31463 affects Owl Labs Meeting Owl 5.2.0.15, where Bluetooth commands are authenticated only on the client side, allowing a nearby attacker to control the device and potentially disable passcodes. Exploitation details are not provided in the sources; the risk is described as an authoriza...