CVE-2022-1027

Page Restriction WordPress < 1.2.7 - Admin+ Stored Cross-Site Scripting

The Page Restriction WordPress (WP) WordPress plugin before 1.2.7 allows bad actors with administrator privileges to the settings page to inject Javascript code to its settings leading to stored Cross-Site Scripting that will only affect administrator users.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Minioragne

Products

Page Restriction

CVE-2022-1026

Kyocera Net View Address Book Exposure

Kyocera multifunction printers running vulnerable versions of Net View unintentionally expose sensitive user information, including usernames and passwords, through an insufficiently protected address book export function.

CVSS 3.1 · 8.6 High EPSS 14.6% KEV · Not listed

Vendors

Kyocera

Products

Net Viewer

CVE-2022-1025

Openshift-Gitops: Improper access control allows admin privilege escalation

All unpatched versions of Argo CD starting with v1.0.0 are vulnerable to an improper access control bug, allowing a malicious user to potentially escalate their privileges to admin-level.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Argoproj Redhat

Products

Argo Cd Openshift Gitops

CVE-2022-1023

Podcast Importer SecondLine < 1.3.8 - Admin+ SQLi

The Podcast Importer SecondLine WordPress plugin before 1.3.8 does not sanitise and properly escape some imported data, which could allow SQL injection attacks to be performed by imported a malicious podcast file

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Secondlinethemes

Products

Podcast Importer Secondline

CVE-2022-1022

Cross-site Scripting (XSS) - Stored in chatwoot/chatwoot

Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.5.0.

CVSS 3.1 · 5.4 Medium EPSS 4.5% KEV · Not listed

Vendors

Chatwoot

Products

Chatwoot

CVE-2022-1021

Insecure Storage of Sensitive Information in chatwoot/chatwoot

Insecure Storage of Sensitive Information in GitHub repository chatwoot/chatwoot prior to 2.6.0.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Chatwoot

Products

Chatwoot

CVE-2022-1020

Woo Product Table < 3.1.2 - Unauthenticated Arbitrary Function Call

The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument

CVSS 3.1 · 9.8 Critical EPSS 25.9% KEV · Not listed

Vendors

Codeastrology

Products

Woo Product Table

CVE-2022-1016

kernel: uninitialized registers on stack in nft_do_chain can cause kernel pointer leakage to UM

A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Rhel Eus and 1 more

CVE-2022-1014

WP Contacts Manager <= 2.2.4 - Unauthenticated SQLi

The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 1.6% KEV · Not listed

Vendors

Labarta

Products

Wp Contacts Manager

CVE-2022-1013

Personal Dictionary < 1.3.4 - Unauthenticated SQLi

The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability.

CVSS 3.1 · 9.8 Critical EPSS 7.5% KEV · Not listed

Vendors

Ays-pro

Products

Personal Dictionary

CVE-2022-1010

Login using WordPress Users < 1.13.4 - Admin+ Stored Cross-Site Scripting

The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Miniorange

Products

Login Using Wordpress Users

CVE-2022-1009

Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting

The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Wpmudev

Products

Smush Image Compression And Optimization

CVE-2022-1008

One Click Demo Import < 3.1.0 - Admin+ Arbitrary File Upload

The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed

CVSS 3.1 · 7.2 High EPSS 1.7% KEV · Not listed

Vendors

Ocdi

Products

One Click Demo Import

CVE-2022-1007

Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue

CVSS 3.1 · 6.1 Medium EPSS 1.9% KEV · Not listed

Vendors

Elbtide

Products

Advanced Booking Calendar

CVE-2022-1006

Advanced Booking Calendar < 1.7.1 - Admin+ SQLi

The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks

CVSS 3.1 · 7.2 High EPSS 1.5% KEV · Not listed

Vendors

Elbtide

Products

Advanced Booking Calendar

CVE-2022-1005

WP Statistics < 13.2.2 - Reflected Cross-Site Scripting

The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Veronalabs

Products

Wp Statistics

CVE-2022-1004

Information disclosure in the External Interface

Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Otrs

Products

Otrs

CVE-2022-1001

WP Downgrade < 1.2.3 - Admin+ Stored Cross-Site Scripting

The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not sanitise and escape it server side, allowing high privilege users such as admin to perform Cross-Site attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS 4.9% KEV · Not listed

Vendors

Wp Downgrade Project

Products

Wp Downgrade

CVE-2022-0998

kernel: an integer overflow in the vhost_vdpa_config_validate() can lead to out-of-bounds access on top of a 32-bit Linux kernel

An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Netapp

Products

Linux Kernel H300e H300e Firmware and 14 more

CVE-2022-0997

Local Privilege Escalation Vulnerability in Fidelis Network and Deception

Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Fidelissecurity

Products

Deception Network