CVE-2022-0734

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that could allow an attacker to obtain some information stored in the user's browser, such as cookies or session tokens, via a malicious script.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: May 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-07359.8An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 befor CVE-2022-07367.5Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.CVE-2022-07374.8The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform CVE-2022-07387.5An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.CVE-2022-07399.8The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constr CVE-2022-07404.3Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 be CVE-2022-07417.5Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables v CVE-2022-07427.5Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 pac CVE-2022-07434.6Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.CVE-2022-07456.5The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipi CVE-2022-07464.3Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.CVE-2022-07479.8The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement vi