CVE-2022-1256

Improper Privilege Management in McAfee Agent for Windows

A local privilege escalation vulnerability in MA for Windows prior to 5.7.6 allows a local low privileged user to gain system privileges through running the repair functionality. Temporary file actions were performed on the local user's %TEMP% directory with System privileges through manipulation of symbolic links.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Agent

CVE-2022-1255

Import and export users and customers < 1.19.2.1 - Admin+ Stored Cross-Site Scripting

The Import and export users and customers WordPress plugin before 1.19.2.1 does not sanitise and escaped imported CSV data, which could allow high privilege users to import malicious javascript code and lead to Stored Cross-Site Scripting issues

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Codection

Products

Import And Export Users And Customers

CVE-2022-1254

SWG URL redirection vulnerability

A URL redirection vulnerability in Skyhigh SWG in main releases 10.x prior to 10.2.9, 9.x prior to 9.2.20, 8.x prior to 8.2.27, and 7.x prior to 7.8.2.31, and controlled release 11.x prior to 11.1.3 allows a remote attacker to redirect a user to a malicious website controlled by the attacker. This is possible because SWG incorrectly creates a HTTP redirect response when a user clicks a carefully constructed URL. Following the redirect response, the new request is still filtered by the SWG policy.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Mcafee

Products

Web Gateway

CVE-2022-1253

Heap-based Buffer Overflow in strukturag/libde265

Heap-based Buffer Overflow in GitHub repository strukturag/libde265 prior to and including 1.0.8. The fix is established in commit 8e89fe0e175d2870c39486fdd09250b230ec10b8 but does not yet belong to an official release.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed

Vendors

Struktur

Products

Libde265

CVE-2022-1251

Ask Me < 6.8.4 - CSRF in Edit Profile

The Ask me WordPress theme before 6.8.4 does not perform nonce checks when processing POST requests to the Edit Profile page, allowing an attacker to trick a user to change their profile information by sending a crafted request.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Inkthemes

Products

Ask Me

CVE-2022-1250

LifterLMS PayPal < 1.4.0 - Reflected Cross-Site Scripting

The LifterLMS PayPal WordPress plugin before 1.4.0 does not sanitise and escape some parameters from the payment confirmation page before outputting them back in the page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Lifterlms

Products

Lifterlms

CVE-2022-1249

pesign: NULL pointer dereference in cms_set_pw_data()

A NULL pointer dereference flaw was found in pesign's cms_set_pw_data() function of the cms_common.c file. The function fails to handle the NULL pwdata invocation from daemon.c, which leads to an explicit NULL dereference and crash on all attempts to daemonize pesign.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Pesign Project

Products

Pesign

CVE-2022-1247

kernel: A race condition bug in rose_connect()

An issue found in linux-kernel that leads to a race condition in rose_connect(). The rose driver uses rose_neigh->use to represent how many objects are using the rose_neigh. When a user wants to delete a rose_route via rose_ioctl(), the rose driver calls rose_del_node() and removes neighbours only if their “count” and “use” are zero.

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Linux Redhat

Products

Fedora Linux Kernel Enterprise Linux

CVE-2022-1245

keycloak: Privilege escalation vulnerability on Token Exchange

A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.

CVSS 3.1 · 9.8 Critical EPSS 1.4% KEV · Not listed

Vendors

Redhat

Products

Keycloak Red Hat Single Sign On Rhosemc

CVE-2022-1244

heap-buffer-overflow in radareorg/radare2

heap-buffer-overflow in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is capable of inducing denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Radare

Products

Radare2

CVE-2022-1243

CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.js

CRHTLF can lead to invalid protocol extraction potentially leading to XSS in GitHub repository medialize/uri.js prior to 1.19.11.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Uri.js Project

Products

Uri.js

CVE-2022-1241

Ask Me < 6.8.2 - Reflected Cross-Site Scripting

The Ask me WordPress theme before 6.8.2 does not properly sanitise and escape several of the fields in the Edit Profile page, leading to Reflected Cross-Site Scripting issues

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

2code

Products

Ask Me

CVE-2022-1240

Heap buffer overflow in libr/bin/format/mach0/mach0.c in radareorg/radare2

Heap buffer overflow in libr/bin/format/mach0/mach0.c in GitHub repository radareorg/radare2 prior to 5.8.6. If address sanitizer is disabled during the compiling, the program should executes into the `r_str_ncpy` function. Therefore I think it is very likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Radare

Products

Radare2

CVE-2022-1239

HubSpot < 8.8.15 - Contributor+ Blind SSRF

The HubSpot WordPress plugin before 8.8.15 does not validate the proxy URL given to the proxy REST endpoint, which could allow users with the edit_posts capability (by default contributor and above) to perform SSRF attacks

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed

Vendors

Hubspot

Products

Hubspot

CVE-2022-1238

Out-of-bounds Write in libr/bin/format/ne/ne.c in radareorg/radare2

Out-of-bounds Write in libr/bin/format/ne/ne.c in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Radare

Products

Radare2

CVE-2022-1237

Improper Validation of Array Index in radareorg/radare2

Improper Validation of Array Index in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability is heap overflow and may be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/122.html).

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Radare

Products

Radare2

CVE-2022-1236

Weak Password Requirements in weseek/growi

Weak Password Requirements in GitHub repository weseek/growi prior to v5.0.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Weseek

Products

Growi

CVE-2022-1235

Weak secrethash can be brute-forced in livehelperchat/livehelperchat

Weak secrethash can be brute-forced in GitHub repository livehelperchat/livehelperchat prior to 3.96.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Livehelperchat

Products

Live Helper Chat

CVE-2022-1234

XSS in livehelperchat in livehelperchat/livehelperchat

XSS in livehelperchat in GitHub repository livehelperchat/livehelperchat prior to 3.97. This vulnerability has the potential to deface websites, result in compromised user accounts, and can run malicious code on web pages, which can lead to a compromise of the user’s device.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Livehelperchat

Products

Live Helper Chat

CVE-2022-1233

URL Confusion When Scheme Not Supplied in medialize/uri.js

URL Confusion When Scheme Not Supplied in GitHub repository medialize/uri.js prior to 1.19.11.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Uri.js Project

Products

Uri.js