Total
421927 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2022-0388 | 1 Humananatomyillustrations | 1 Interactive Medical Drawing Of Human Body | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | |||||
| CVE-2022-0387 | 1 Livehelperchat | 1 Livehelperchat | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | |||||
| CVE-2022-0386 | 1 Sophos | 1 Unified Threat Management | 2026-06-17 | 6.5 MEDIUM | 8.8 HIGH |
| A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710. | |||||
| CVE-2022-0385 | 1 Crazy Bone Project | 1 Crazy Bone | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Stored Cross-Site scripting | |||||
| CVE-2022-0384 | 1 Imdpen | 1 Video Conferencing With Zoom | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog | |||||
| CVE-2022-0383 | 1 Ljapps | 1 Wp Review Slider | 2026-06-17 | 6.5 MEDIUM | 7.2 HIGH |
| The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could allow a high privilege users to perform SQL Injections attacks | |||||
| CVE-2022-0382 | 1 Linux | 1 Linux Kernel | 2026-06-17 | 2.1 LOW | 5.5 MEDIUM |
| An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user cannot control what is read. This flaw affects the Linux kernel versions prior to 5.17-rc1. | |||||
| CVE-2022-0381 | 1 Embed Swagger Project | 1 Embed Swagger | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0. | |||||
| CVE-2022-0380 | 1 Fotobook Project | 1 Fotobook | 2026-06-17 | 4.3 MEDIUM | 6.1 MEDIUM |
| The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF'] found in the ~/options-fotobook.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 3.2.3. | |||||
| CVE-2022-0379 | 1 Microweber | 1 Microweber | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11. | |||||
| CVE-2022-0378 | 1 Microweber | 1 Microweber | 2026-06-17 | 4.3 MEDIUM | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11. | |||||
| CVE-2022-0377 | 1 Thimpress | 1 Learnpress | 2026-06-17 | 3.5 LOW | 4.3 MEDIUM |
| Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site. | |||||
| CVE-2022-0376 | 1 User-meta | 1 User Meta User Profile Builder And User Management | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | |||||
| CVE-2022-0375 | 1 Livehelperchat | 1 Live Helper Chat | 2026-06-17 | 3.5 LOW | 4.8 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | |||||
| CVE-2022-0374 | 1 Livehelperchat | 1 Live Helper Chat | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | |||||
| CVE-2022-0373 | 1 Gitlab | 1 Gitlab | 2026-06-17 | 3.5 LOW | 4.3 MEDIUM |
| Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address | |||||
| CVE-2022-0372 | 1 Craterapp | 1 Crater | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2. | |||||
| CVE-2022-0371 | 1 Gitlab | 1 Gitlab | 2026-06-17 | 4.0 MEDIUM | 4.3 MEDIUM |
| An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versions starting from 14.7 before 14.7.1. GitLab search may allow authenticated users to search other users by their respective private emails even if a user set their email to private. | |||||
| CVE-2022-0370 | 1 Livehelperchat | 1 Livehelperchat | 2026-06-17 | 3.5 LOW | 5.4 MEDIUM |
| Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. | |||||
| CVE-2022-0369 | 1 Trianglemicroworks | 1 Scada Data Gateway | 2026-06-17 | N/A | 8.8 HIGH |
| Triangle MicroWorks SCADA Data Gateway Restore Workspace Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Triangle MicroWorks SCADA Data Gateway. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Restore Workspace feature. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-17227. | |||||