CVE-2022-3175

Missing Custom Error Page in ikus060/rdiffweb

Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ikus-soft

Products

Rdiffweb

CVE-2022-3174

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffweb

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Ikus-soft

Products

Rdiffweb

CVE-2022-3173

Improper Authentication in snipe/snipe-it

Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Snipeitapp

Products

Snipe-it

CVE-2022-3170

kernel: ALSA: control: out-of-bounds access in get_ctl_id_hash()

An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a specially crafted name through ioctl() interface and crash the system or potentially escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux

Products

Linux Kernel

CVE-2022-3167

Improper Restriction of Rendered UI Layers or Frames in ikus060/rdiffweb

Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Ikus-soft

Products

Rdiffweb

CVE-2022-3154

Multiple Plugins from Viszt Peter - Multiple CSRF

The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Integration For Billingo \& Gravity Forms Project Integration For Szamlazz.hu \& Gravity Forms Project Woo Billingo Plus Project

Products

Integration For Billingo \& Gravity Forms Integration For Szamlazz.hu \& Gravity Forms Woo Billingo Plus

CVE-2022-3152

Unverified Password Change in phpfusion/phpfusion

Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Php-fusion

Products

Phpfusion

CVE-2022-3148

Cross-site Scripting (XSS) - Generic in jgraph/drawio

Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-3142

NEX-Forms < 7.9.7 - Authenticated SQLi

The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. The attack can be executed by anyone who is permitted to view the forms statistics chart, by default administrators, however can be configured otherwise via the plugin settings.

CVSS 3.1 · 8.8 High EPSS 15.6% KEV · Not listed

Vendors

Basixonline

Products

Nex-forms

CVE-2022-3141

Translatepress Multilinugal < 2.3.3 - Admin+ SQLi

The Translate Multilingual sites WordPress plugin before 2.3.3 is vulnerable to an authenticated SQL injection. By adding a new language (via the settings page) containing specific special characters, the backticks in the SQL query can be surpassed and a time-based blind payload can be injected.

CVSS 3.1 · 8.8 High EPSS 5.3% KEV · Not listed

Vendors

Cozmoslabs

Products

Translatepress

CVE-2022-3140

Macro URL arbitrary script execution

LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice links using that scheme could be constructed to call internal macros with arbitrary arguments. Which when clicked on, or activated by document events, could result in arbitrary script execution without warning. This issue affects: The Document Foundation LibreOffice 7.4 versions prior to 7.4.1; 7.3 versions prior to 7.3.6.

CVSS 3.1 · 6.3 Medium EPSS 7.0% KEV · Not listed

Vendors

Debian Fedoraproject Libreoffice and 1 more

Products

Debian Linux Fedora Libreoffice and 1 more

CVE-2022-3138

Cross-site Scripting (XSS) - Generic in jgraph/drawio

Cross-site Scripting (XSS) - Generic in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-3137

TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload

The Taskbuilder WordPress plugin before 1.0.8 does not validate and sanitise task's attachments, which could allow any authenticated user (such as subscriber) creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Taskbuilder

Products

Taskbuilder

CVE-2022-3136

Social Rocket < 1.3.3 - Admin+ Stored Cross-Site Scripting

The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wpsocialrocket

Products

Social Rocket

CVE-2022-3133

OS Command Injection in jgraph/drawio

OS Command Injection in GitHub repository jgraph/drawio prior to 20.3.0.

CVSS 3.1 · 7.8 High EPSS 1.1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-3132

Goolytics - Simple Google Analytics < 1.1.2 - Admin+ Stored Cross-Site Scripting

The Goolytics WordPress plugin before 1.1.2 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Goolytics Project

Products

Goolytics

CVE-2022-3128

Donation Thermometer < 2.1.3 - Admin+ Stored Cross-Site Scripting

The Donation Thermometer WordPress plugin before 2.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Donation Thermometer Project

Products

Donation Thermometer

CVE-2022-3127

Cross-site Scripting (XSS) - Stored in jgraph/drawio

Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.2.8.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Diagrams

Products

Drawio

CVE-2022-3125

Frontend File Manager < 21.3 - Subscriber+ Arbitrary File Upload

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any authenticated users, such as subscriber, to rename a file to an arbitrary extension, like PHP, which could allow them to basically be able to upload arbitrary files on the server and achieve RCE

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Najeebmedia

Products

Frontend File Manager

CVE-2022-3124

Frontend File Manager < 21.3 - Unauthenticated File Renaming

The Frontend File Manager Plugin WordPress plugin before 21.3 allows any unauthenticated user to rename uploaded files from users. Furthermore, due to the lack of validation in the destination filename, this could allow allow them to change the content of arbitrary files on the web server

CVSS 3.1 · 5.3 Medium EPSS 8.3% KEV · Not listed

Vendors

Najeebmedia

Products

Frontend File Manager