2022 CVE Vulnerabilities
27,563 CVEs published in 2022.
| CVE ID | Severity | CVSS | EPSS | Published | Description |
|---|---|---|---|---|---|
| CVE-2022-25015 | MEDIUM | 5.4 | 0.7% | Feb 28, 2022 | A stored cross-site scripting (XSS) vulnerability in Ice Hrm 30.0.0.OS allows attackers to steal cookies via a crafted p... |
| CVE-2022-25014 | MEDIUM | 6.1 | 0.7% | Feb 28, 2022 | Ice Hrm 30.0.0.OS was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the "m" parameter i... |
| CVE-2022-25013 | MEDIUM | 6.1 | 0.7% | Feb 28, 2022 | Ice Hrm 30.0.0.OS was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the "key" ... |
| CVE-2022-26158 | MEDIUM | 6.1 | 0.7% | Feb 28, 2022 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. It accepts and reflects arbi... |
| CVE-2022-26157 | MEDIUM | 5.3 | 0.5% | Feb 28, 2022 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. The ASP.NET_Sessionid cookie... |
| CVE-2022-26156 | MEDIUM | 6.1 | 0.7% | Feb 28, 2022 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. Injection of a malicious pay... |
| CVE-2022-26155 | MEDIUM | 6.1 | 0.7% | Feb 28, 2022 | An issue was discovered in the web application in Cherwell Service Management (CSM) 10.2.3. XSS can occur via a payload ... |
| CVE-2022-25642 | MEDIUM | 6.1 | 1.4% | Feb 28, 2022 | Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution. |
| CVE-2022-24572 | MEDIUM | 6.1 | 0.6% | Feb 28, 2022 | Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Usernam... |
| CVE-2022-23988 | MEDIUM | 6.1 | 2.2% | Feb 28, 2022 | The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unaut... |
| CVE-2022-23987 | MEDIUM | 4.8 | 0.6% | Feb 28, 2022 | The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow ... |
| CVE-2022-23912 | MEDIUM | 6.1 | 0.9% | Feb 28, 2022 | The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outp... |
| CVE-2022-0385 | MEDIUM | 6.1 | 1.4% | Feb 28, 2022 | The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from whe... |
| CVE-2022-0377 | MEDIUM | 4.3 | 3.2% | Feb 28, 2022 | Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. A... |
| CVE-2022-0360 | MEDIUM | 4.8 | 0.6% | Feb 28, 2022 | The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped... |
| CVE-2022-0345 | MEDIUM | 4.3 | 0.4% | Feb 28, 2022 | The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in it... |
| CVE-2022-0328 | MEDIUM | 4.7 | 0.5% | Feb 28, 2022 | The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could ... |
| CVE-2022-0189 | MEDIUM | 6.1 | 2.2% | Feb 28, 2022 | The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_item... |
| CVE-2022-0150 | MEDIUM | 6.1 | 1.7% | Feb 28, 2022 | The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before... |
| CVE-2022-26159 | MEDIUM | 5.3 | 13.4% | Feb 28, 2022 | The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as... |
| CVE-2022-0772 | MEDIUM | 4.8 | 0.6% | Feb 27, 2022 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.2.2. |
| CVE-2022-22908 | MEDIUM | 5.5 | 0.3% | Feb 26, 2022 | SangforCSClient.exe in Sangfor VDI Client 5.4.2.1006 allows attackers, when they are able to read process memory, to dis... |
| CVE-2022-26146 | MEDIUM | 5.4 | 0.4% | Feb 26, 2022 | Tricentis qTest before 10.4 allows stored XSS by an authenticated attacker. |
| CVE-2022-0764 | MEDIUM | 6.7 | 0.8% | Feb 26, 2022 | Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0. |
| CVE-2022-0723 | MEDIUM | 5.4 | 0.9% | Feb 26, 2022 | Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11. |
Check if your code is affected by 2022 CVEs
Strix scans your code and infrastructure for known vulnerabilities automatically.
Scan your code now