CVE-2022-45470

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

missing input validation in Apache Hama may cause information disclosure through path traversal and XSS. Since Apache Hama is EOL, we do not expect these issues to be fixed.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-20

Affected software

No affected versions have been published.

Timeline

Published: Nov 21, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-454717.5In JetBrains Hub before 2022.3.15181 Throttling was missed when sending emails to a particular email address CVE-2022-454725.4CAE LearningSpace Enterprise (with Intuity License) image 267r patch 639 allows DOM XSS, related to ontouchmove and onpointerup.CVE-2022-454735.5In drachtio-server 0.8.18, /var/log/drachtio has mode 0777 and drachtio.log has mode 0666.CVE-2022-454749.8drachtio-server 0.8.18 has a request-handler.cpp event_cb use-after-free for any request.CVE-2022-454756.5Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to access the application's internal files. This is possible becau CVE-2022-454769.8Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download CVE-2022-454779.8Telepad allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorization CVE-2022-454785.9Telepad allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data (including keypresses CVE-2022-454799.8PC Keyboard allows remote unauthenticated users to send instructions to the server to execute arbitrary code without any previous authorizat CVE-2022-45486.5The Optimize images ALT Text & names for SEO using AI WordPress plugin before 2.0.8 does not have CSRF check in place when updating its sett CVE-2022-454805.9PC Keyboard WiFi & Bluetooth allows an attacker (in a man-in-the-middle position between the server and a connected device) to see all data CVE-2022-454819.8The default configuration of Lazy Mouse does not require a password, allowing remote unauthenticated users to execute arbitrary code with no