CVE-2022-4097

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-639

Affected software

VendorProductVersions
UnknownAll-In-One Security (AIOS)< 5.0.8

References

Timeline

Published
Dec 12, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-409717.8Incorrect default permissions for the Intel(R) HDMI Firmware Update Tool for NUC before version 1.79.1.1 may allow an authenticated user to CVE-2022-409727.8Improper access control in some Intel(R) QAT drivers for Windows before version 1.9.0 may allow an authenticated user to potentially enable CVE-2022-409745.5Incomplete cleanup in the Intel(R) IPP Cryptography software before version 2021.6 may allow a privileged user to potentially enable informaCVE-2022-409755.4Missing Authorization vulnerability in Aazztech Post Slider.This issue affects Post Slider: from n/a through 1.6.7.CVE-2022-409765.5A path traversal vulnerability was discovered in multiple Pilz products. An unauthenticated local attacker could use a zipped, malicious conCVE-2022-409777.5A path traversal vulnerability was discovered in Pilz PASvisu Server before 1.12.0. An unauthenticated remote attacker could use a zipped, mCVE-2022-409787.8The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijackingCVE-2022-409795.3In JetBrains TeamCity before 2022.04.4 environmental variables of "password" type could be logged when using custom Perforce executableCVE-2022-40988.0Multiple Wiesemann&Theis products of the ComServer Series are prone to an authentication bypass through IP spoofing. After a user logged in CVE-2022-409809.1A potential unathenticated file deletion vulnerabilty on Trend Micro Mobile Security for Enterprise 9.8 SP5 could allow an attacker with accCVE-2022-4098110.0All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior is vulnerable to malicious file upload. An attacker could take advanCVE-2022-409826.5Information exposure through microarchitectural state after transient execution in certain vector execution units for some Intel(R) Processo