Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2022-0506
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/0a5ec24c-343e-4cc4-b27b-2beb19a1c35f'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/05d55f2befb1b25375ca5371875ff535d6cc5f70'}]
CVE State: PUBLISHED
Explain CVE-2022-0507
Found a potential security vulnerability inside the Pandora API. Affected Pandora FMS version range: all versions of NG version, up to OUM 759. This vulnerability could allow an attacker with authenticated IP to inject SQL.
Affected Products: Pandora FMS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.incibe.es/en/cve-assignment-publication/coordinated-cves'}, {'tags': ['x_refsource_MISC'], 'url': 'https://khoori.org/posts/cve-2022-0507/'}]
CVE State: PUBLISHED
Explain CVE-2022-0508
Server-Side Request Forgery (SSRF) in GitHub repository chocobozzz/peertube prior to f33e515991a32885622b217bf2ed1d1b0d9d6832
Affected Products: chocobozzz/peertube
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/c3724574-b6c9-430b-849b-40dd2b20f23c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/chocobozzz/peertube/commit/f33e515991a32885622b217bf2ed1d1b0d9d6832'}]
CVE State: PUBLISHED
Explain CVE-2022-0509
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.3.1.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/26cdf86c-8edc-4af6-8411-d569699ecd1b'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/6ccb5c12fc1be065ebce9c89c4677ee939b88597'}]
CVE State: PUBLISHED
Explain CVE-2022-0510
Cross-site Scripting (XSS) - Reflected in Packagist pimcore/pimcore prior to 10.3.1.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/bb3525d5-dedc-48b8-ab04-ad4c72499abe'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/b5a9ad65e5a4dde1916f02019f8686ad835681ce'}]
CVE State: PUBLISHED
Explain CVE-2022-0511
Mozilla developers and community members Gabriele Svelto, Sebastian Hengst, Randell Jesup, Luan Herrera, Lars T Hansen, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 96. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 97.
Affected Products: Firefox
References: [{'url': 'https://www.mozilla.org/security/advisories/mfsa2022-04/'}, {'url': 'https://bugzilla.mozilla.org/buglist.cgi?bug_id=1713579%2C1735448%2C1743821%2C1746313%2C1746314%2C1746316%2C1746321%2C1746322%2C1746323%2C1746412%2C1746430%2C1746451%2C1746488%2C1746875%2C1746898%2C1746905%2C1746907%2C1746917%2C1747128%2C1747137%2C1747331%2C1747346%2C1747439%2C1747457%2C1747870%2C1749051%2C1749274%2C1749831'}]
CVE State: PUBLISHED
Explain CVE-2022-0512
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
Affected Products: unshiftio/url-parse
References: [{'url': 'https://huntr.dev/bounties/6d1bc51f-1876-4f5b-a2c2-734e09e8e05b'}, {'url': 'https://github.com/unshiftio/url-parse/commit/9be7ee88afd2bb04e4d5a1a8da9a389ac13f8c40'}, {'name': '[debian-lts-announce] 20230223 [SECURITY] [DLA 3336-1] node-url-parse security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0513
The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.4. This requires the "Record Exclusions" option to be enabled on the vulnerable site.
Affected Products: WP Statistics
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/blog/2022/02/unauthenticated-sql-injection-vulnerability-patched-in-wordpress-statistics-plugin/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/changeset/2671297/wp-statistics/trunk/includes/class-wp-statistics-hits.php'}]
CVE State: PUBLISHED
Explain CVE-2022-0514
Business Logic Errors in GitHub repository crater-invoice/crater prior to 6.0.5.
Affected Products: crater-invoice/crater
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/af08000d-9f4a-4743-865d-5d5cdaf7fb27'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/crater-invoice/crater/commit/fadef0ea07d2f7fb3f41c2cae444ebca2f479679'}]
CVE State: PUBLISHED
Explain CVE-2022-0515
Cross-Site Request Forgery (CSRF) in GitHub repository crater-invoice/crater prior to 6.0.4.
Affected Products: crater-invoice/crater
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/efb93f1f-1896-4a4c-a059-9ecadac1c4de'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/crater-invoice/crater/commit/2b7028b7c83fd6e8897f244a2e6723baa20479e5'}]
CVE State: PUBLISHED
Explain CVE-2022-0516
A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local attacker with a normal user privilege to obtain unauthorized memory write access. This flaw affects Linux kernel versions prior to 5.17-rc4.
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2050237'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09a93c1df3eafa43bcdfd7bf837c574911f12f55'}, {'name': 'DSA-5092', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5092'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20220331-0009/'}]
CVE State: PUBLISHED
Explain CVE-2022-0517
Mozilla VPN can load an OpenSSL configuration file from an unsecured directory. A user or attacker with limited privileges could leverage this to launch arbitrary code with SYSTEM privilege. This vulnerability affects Mozilla VPN < 2.7.1.
Affected Products: Mozilla VPN
References: [{'url': 'https://www.mozilla.org/security/advisories/mfsa2022-08/'}, {'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1752291'}]
CVE State: PUBLISHED
Explain CVE-2022-0518
Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.2.
Affected Products: radareorg/radare2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/10051adf-7ddc-4042-8fd0-8e9e0c5b1184'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/radareorg/radare2/commit/9650e3c352f675687bf6c6f65ff2c4a3d0e288fa'}, {'name': 'FEDORA-2022-7db9e7bb5b', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/'}, {'name': 'FEDORA-2022-85b277e748', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/'}]
CVE State: PUBLISHED
Explain CVE-2022-0519
Buffer Access with Incorrect Length Value in GitHub repository radareorg/radare2 prior to 5.6.2.
Affected Products: radareorg/radare2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/af85b9e1-d1cf-4c0e-ba12-525b82b7c1e3'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5'}, {'name': 'FEDORA-2022-7db9e7bb5b', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/'}, {'name': 'FEDORA-2022-85b277e748', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/'}]
CVE State: PUBLISHED
Explain CVE-2022-0520
Use After Free in NPM radare2.js prior to 5.6.2.
Affected Products: radareorg/radare2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/ce13c371-e5ef-4993-97f3-3d33dcd943a6'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/radareorg/radare2/commit/8525ad0b9fd596f4b251bb3d7b114e6dc7ce1ee8'}, {'name': 'FEDORA-2022-7db9e7bb5b', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/'}, {'name': 'FEDORA-2022-85b277e748', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/'}]
CVE State: PUBLISHED
Explain CVE-2022-0521
Access of Memory Location After End of Buffer in GitHub repository radareorg/radare2 prior to 5.6.2.
Affected Products: radareorg/radare2
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/radareorg/radare2/commit/6c4428f018d385fc80a33ecddcb37becea685dd5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/4d436311-bbf1-45a3-8774-bdb666d7f7ca'}, {'name': 'FEDORA-2022-7db9e7bb5b', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/'}, {'name': 'FEDORA-2022-85b277e748', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/'}]
CVE State: PUBLISHED
Explain CVE-2022-0522
Access of Memory Location Before Start of Buffer in NPM radare2.js prior to 5.6.2.
Affected Products: radareorg/radare2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/2d45e589-d614-4875-bba1-be0f729e7ca9'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/radareorg/radare2/commit/d17a7bdf166108a29a27cd89bf454f9fa6c050d6'}, {'name': 'FEDORA-2022-7db9e7bb5b', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/'}, {'name': 'FEDORA-2022-85b277e748', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/'}]
CVE State: PUBLISHED
Explain CVE-2022-0523
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
Affected Products: radareorg/radare2
References: [{'url': 'https://huntr.dev/bounties/9d8d6ae0-fe00-40b9-ae1e-b0e8103bac69'}, {'url': 'https://github.com/radareorg/radare2/commit/35482cb760db10f87a62569e2f8872dbd95e9269'}, {'name': 'FEDORA-2022-7db9e7bb5b', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/'}, {'name': 'FEDORA-2022-85b277e748', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/'}]
CVE State: PUBLISHED
Explain CVE-2022-0524
Business Logic Errors in GitHub repository publify/publify prior to 9.2.7.
Affected Products: publify/publify
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/bfffae58-b3cd-4e0e-b1f2-3db387a22c3d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/publify/publify/commit/16fceecadbe80ab0ef846b62a12dc7bfff10b8c5'}]
CVE State: PUBLISHED
Explain CVE-2022-0525
Out-of-bounds Read in Homebrew mruby prior to 3.2.
Affected Products: mruby/mruby
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/e19e109f-acf0-4048-8ee8-1b10a870f1e9'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/mruby/mruby/commit/0849a2885f81cfd82134992c06df3ccd59052ac7'}]
CVE State: PUBLISHED
Explain CVE-2022-0526
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
Affected Products: chatwoot/chatwoot
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/d8f5ce74-2a00-4813-b220-70af771b0edd'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/chatwoot/chatwoot/commit/9f37a6e2ba7a7212bb419e318b8061f472e82d9f'}]
CVE State: PUBLISHED
Explain CVE-2022-0527
Cross-site Scripting (XSS) - Stored in GitHub repository chatwoot/chatwoot prior to 2.2.0.
Affected Products: chatwoot/chatwoot
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/a2f598f6-c142-449a-96f8-b4b2f7a9e228'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/chatwoot/chatwoot/commit/a737f89c473e64f9abdf8ff13a3e64edefa28877'}]
CVE State: PUBLISHED
Explain CVE-2022-0528
Server-Side Request Forgery (SSRF) in GitHub repository transloadit/uppy prior to 3.3.1.


Affected Products: transloadit/uppy
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/8b060cc3-2420-468e-8293-b9216620175b'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/transloadit/uppy/commit/267c34045a1e62c98406d8c31261c604a11e544a'}]
CVE State: PUBLISHED
Explain CVE-2022-0529
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Affected Products: unzip
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2051395'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/ByteHackr/unzip_poc'}, {'name': 'DSA-5202', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5202'}, {'name': '[debian-lts-announce] 20220922 [SECURITY] [DLA 3118-1] unzip security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0530
A flaw was found in Unzip. The vulnerability occurs during the conversion of a wide string to a local string that leads to a heap of out-of-bound write. This flaw allows an attacker to input a specially crafted zip file, leading to a crash or code execution.
Affected Products: unzip
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2051395'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/ByteHackr/unzip_poc'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT213257'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT213256'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT213255'}, {'name': '20220516 APPLE-SA-2022-05-16-4 Security Update 2022-004 Catalina', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2022/May/33'}, {'name': '20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2022/May/35'}, {'name': '20220516 APPLE-SA-2022-05-16-2 macOS Monterey 12.4', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2022/May/38'}, {'name': 'DSA-5202', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5202'}, {'name': '[debian-lts-announce] 20220922 [SECURITY] [DLA 3118-1] unzip security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/09/msg00028.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0531
The Migration, Backup, Staging WordPress plugin before 0.9.70 does not sanitise and escape the sub_page parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting
Affected Products: Migration, Backup, Staging – WPvivid
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/ac5c2a5d-09b6-470b-a598-2972183413ca'}]
CVE State: PUBLISHED
Explain CVE-2022-0532
An incorrect sysctls validation vulnerability was found in CRI-O 1.18 and earlier. The sysctls from the list of "safe" sysctls specified for the cluster will be applied to the host if an attacker is able to create a pod with a hostIPC and hostNetwork kernel namespace.
Affected Products: cri-o
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2051730'}, {'tags': ['x_refsource_MISC'], 'url': 'https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/#enabling-unsafe-sysctls'}]
CVE State: PUBLISHED
Explain CVE-2022-0533
The Ditty (formerly Ditty News Ticker) WordPress plugin before 3.0.15 is affected by a Reflected Cross-Site Scripting (XSS) vulnerability.
Affected Products: Ditty (formerly Ditty News Ticker)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/40f36692-c898-4441-ad24-2dc17856bd74'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2675223/ditty-news-ticker'}]
CVE State: PUBLISHED
Explain CVE-2022-0534
A vulnerability was found in htmldoc version 1.9.15 where the stack out-of-bounds read takes place in gif_get_code() and occurs when opening a malicious GIF file, which can result in a crash (segmentation fault).
Affected Products: htmldoc
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/michaelrsweet/htmldoc/issues/463'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/michaelrsweet/htmldoc/commit/312f0f9c12f26fbe015cd0e6cefa40e4b99017d9'}, {'name': '[debian-lts-announce] 20220226 [SECURITY] [DLA 2928-1] htmldoc security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/02/msg00022.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0535
The E2Pdf WordPress plugin before 1.16.45 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Affected Products: E2Pdf – Export To Pdf Tool for WordPress
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/a4162e96-a3c5-4f38-a60b-aa3ed9508985'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2675049/e2pdf'}]
CVE State: PUBLISHED
Explain CVE-2022-0536
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.


Affected Products: follow-redirects/follow-redirects
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/7cf2bf90-52da-4d59-8028-a73b132de0db'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/follow-redirects/follow-redirects/commit/62e546a99c07c3ee5e4e0718c84a6ca127c5c445'}]
CVE State: PUBLISHED
Explain CVE-2022-0537
The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.
Affected Products: MapPress Maps for WordPress
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/abfbba70-5158-4990-98e5-f302361db367'}]
CVE State: PUBLISHED
Explain CVE-2022-0538
Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.
Affected Products: Jenkins
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.jenkins.io/security/advisory/2022-02-09/#SECURITY-2602'}, {'name': '[oss-security] 20220209 Vulnerability in Jenkins', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2022/02/09/1'}]
CVE State: PUBLISHED
Explain CVE-2022-0539
Cross-site Scripting (XSS) - Stored in Packagist ptrofimov/beanstalk_console prior to 1.7.14.
Affected Products: ptrofimov/beanstalk_console
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/5f41b182-dda2-4c6f-9668-2a9afaed53af'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/ptrofimov/beanstalk_console/commit/5aea5f912f6e6d19dedb1fdfc25a29a2e1fc1694'}]
CVE State: PUBLISHED
Explain CVE-2022-0540
A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. This affects Atlassian Jira Server and Data Center versions before 8.13.18, versions 8.14.0 and later before 8.20.6, and versions 8.21.0 and later before 8.22.0. This also affects Atlassian Jira Service Management Server and Data Center versions before 4.13.18, versions 4.14.0 and later before 4.20.6, and versions 4.21.0 and later before 4.22.0.
Affected Products: Jira Core Server
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://confluence.atlassian.com/display/JIRA/Jira+Security+Advisory+2022-04-20'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jira.atlassian.com/browse/JRASERVER-73650'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jira.atlassian.com/browse/JSDSERVER-11224'}]
CVE State: PUBLISHED
Explain CVE-2022-0541
The flo-launch WordPress plugin before 2.4.1 injects code into wp-config.php when creating a cloned site, allowing any attacker to initiate a new site install by setting the flo_custom_table_prefix cookie to an arbitrary value.
Affected Products: flo-launch
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/822cac2c-decd-4aa4-9e8e-1ba2d0c080ce'}]
CVE State: PUBLISHED
Explain CVE-2022-0542
Cross-site Scripting (XSS) - DOM in GitHub repository chatwoot/chatwoot prior to 2.7.0.
Affected Products: chatwoot/chatwoot
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/e6469ba6-03a2-4b17-8b4e-8932ecd0f7ac'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/chatwoot/chatwoot/commit/dd1fe4f93a6fbafa1d1eed87ac7d4143e701ec08'}]
CVE State: PUBLISHED
Explain CVE-2022-0543
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code execution.
Affected Products: redis
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.debian.org/1005787'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.ubercomp.com/posts/2022-01-20_redis_on_debian_rce'}, {'name': '[debian-security-announce] 20220218 [SECURITY] [DSA 5081-1] redis security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-security-announce/2022/msg00048.html'}, {'name': 'DSA-5081', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5081'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20220331-0004/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/166885/Redis-Lua-Sandbox-Escape.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0544
An integer underflow in the DDS loader of Blender leads to an out-of-bounds read, possibly allowing an attacker to read sensitive data using a crafted DDS image file. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.
Affected Products: Blender
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://developer.blender.org/T94661'}, {'name': '[debian-lts-announce] 20220628 [SECURITY] [DLA 3060-1] blender security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/06/msg00021.html'}, {'name': 'DSA-5176', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5176'}]
CVE State: PUBLISHED
Explain CVE-2022-0545
An integer overflow in the processing of loaded 2D images leads to a write-what-where vulnerability and an out-of-bounds read vulnerability, allowing an attacker to leak sensitive information or achieve code execution in the context of the Blender process when a specially crafted image file is loaded. This flaw affects Blender versions prior to 2.83.19, 2.93.8 and 3.1.
Affected Products: Blender
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://developer.blender.org/T94629'}, {'name': '[debian-lts-announce] 20220628 [SECURITY] [DLA 3060-1] blender security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/06/msg00021.html'}, {'name': 'DSA-5176', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5176'}]
CVE State: PUBLISHED
Explain CVE-2022-0546
A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code execution.
Affected Products: Blender
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://developer.blender.org/T94572'}, {'name': 'FEDORA-2022-d9d630891d', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIZADV3AHTWZ2YKEFTVLNK3K4F4KTYLM/'}, {'name': '[debian-lts-announce] 20220628 [SECURITY] [DLA 3060-1] blender security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/06/msg00021.html'}, {'name': 'DSA-5176', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5176'}]
CVE State: PUBLISHED
Explain CVE-2022-0547
OpenVPN 2.1 until v2.4.12 and v2.5.6 may enable authentication bypass in external authentication plug-ins when more than one of them makes use of deferred authentication replies, which allows an external user to be granted access with only partially correct credentials.
Affected Products: OpenVPN
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://community.openvpn.net/openvpn/wiki/SecurityAnnouncements'}, {'tags': ['x_refsource_MISC'], 'url': 'https://community.openvpn.net/openvpn/wiki/CVE-2022-0547'}, {'tags': ['x_refsource_MISC'], 'url': 'https://openvpn.net/community-downloads/'}, {'name': 'FEDORA-2022-7d46acce7c', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/R36OYC5SJ6FLPVAYJYYT4MOJ2I7MGYFF/'}, {'name': 'FEDORA-2022-cb4c1146dc', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFXJ35WKPME4HYNQCQNAJHLCZOJL2SAE/'}, {'name': '[debian-lts-announce] 20220503 [SECURITY] [DLA 2992-1] openvpn security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/05/msg00002.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0549
An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Under certain conditions, GitLab REST API may allow unprivileged users to add other users to groups even if that is not possible to do through the Web UI.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/342448'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0549.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0550
Improper Input Validation vulnerability in custom report logo upload in Nozomi Networks Guardian, and CMC allows an authenticated attacker with admin or report manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.
Affected Products: Guardian
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.nozominetworks.com/NN-2022:2-01'}]
CVE State: PUBLISHED
Explain CVE-2022-0551
Improper Input Validation vulnerability in project file upload in Nozomi Networks Guardian and CMC allows an authenticated attacker with admin or import manager roles to execute unattended commands on the appliance using web server user privileges. This issue affects: Nozomi Networks Guardian versions prior to 22.0.0. Nozomi Networks CMC versions prior to 22.0.0.
Affected Products: Guardian
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.nozominetworks.com/NN-2022:2-02'}]
CVE State: PUBLISHED
Explain CVE-2022-0552
A flaw was found in the original fix for the netty-codec-http CVE-2021-21409, where the OpenShift Logging openshift-logging/elasticsearch6-rhel8 container was incomplete. The vulnerable netty-codec-http maven package was not removed from the image content. This flaw affects origin-aggregated-logging versions 3.11.
Affected Products: origin-aggregated-logging/elasticsearch
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2052539'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2021-21409'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/openshift/origin-aggregated-logging/commit/d6b72d6c32e7c06b65324294d10406546734004d'}]
CVE State: PUBLISHED
Explain CVE-2022-0553
There is no check to see if slot 0 is being uploaded from the device to the host. When using encrypted images this means the unencrypted firmware can be retrieved easily.
Affected Products: zephyr
References: [{'url': 'https://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-wrj2-9vj9-rrcp'}]
CVE State: PUBLISHED
Explain CVE-2022-0554
Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/7e8f6cd0-b5ee-48a2-8255-6a86f4c46c71'}, {'url': 'https://github.com/vim/vim/commit/e3537aec2f8d6470010547af28dcbd83d41461b8'}, {'name': 'FEDORA-2022-48bf3cb1c4', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/'}, {'name': '[debian-lts-announce] 20220311 [SECURITY] [DLA 2947-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0556
A local privilege escalation vulnerability caused by incorrect permission assignment in some directories of the Zyxel AP Configurator (ZAC) version 1.1.4, which could allow an attacker to execute arbitrary code as a local administrator.
Affected Products: Zyxel AP Configurator (ZAC)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.zyxel.com/support/Zyxel-security-advisory-for-local-privilege-escalation-vulnerability-of-AP-Configurator.shtml'}]
CVE State: PUBLISHED
Explain CVE-2022-0557
OS Command Injection in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/660c89af-2de5-41bc-aada-9e4e78142db8'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/0a7e5f1d81de884861ca677ee1aaac31f188d632'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/166077/Microweber-1.2.11-Shell-Upload.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.exploit-db.com/exploits/50768'}]
CVE State: PUBLISHED
Explain CVE-2022-0558
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/8fffc95f-14ae-457b-aecc-be4716a8b91c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/14a1bb971bcb8b5456c2bf0020c3018907a2704d'}]
CVE State: PUBLISHED
Explain CVE-2022-0559
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.2.
Affected Products: radareorg/radare2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/aa80adb7-e900-44a5-ad05-91f3ccdfc81e'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/radareorg/radare2/commit/b5cb90b28ec71fda3504da04e3cc94a362807f5e'}, {'name': 'FEDORA-2022-7db9e7bb5b', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/'}, {'name': 'FEDORA-2022-85b277e748', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/'}]
CVE State: PUBLISHED
Explain CVE-2022-0560
Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/c9d586e7-0fa1-47ab-a2b3-b890e8dc9b25'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/72d4b12cc487f56a859a8570ada4efb77b4b8c63'}]
CVE State: PUBLISHED
Explain CVE-2022-0561
Null source pointer passed as an argument to memcpy() function within TIFFFetchStripThing() in tif_dirread.c in libtiff versions from 3.9.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, the fix is available with commit eecb0712.
Affected Products: libtiff
References: [{'url': 'https://gitlab.com/libtiff/libtiff/-/issues/362'}, {'url': 'https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/eecb0712f4c3a5b449f70c57988260a667ddbdef'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0561.json'}, {'name': 'FEDORA-2022-df1df6debd', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZEHZ35XVO2VBZ4HHCMM6J6TQIDSBQOM/'}, {'name': '[debian-lts-announce] 20220306 [SECURITY] [DLA 2932-1] tiff security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00001.html'}, {'url': 'https://security.netapp.com/advisory/ntap-20220318-0001/'}, {'name': 'DSA-5108', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2022/dsa-5108'}, {'name': 'GLSA-202210-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-10'}]
CVE State: PUBLISHED
Explain CVE-2022-0562
Null source pointer passed as an argument to memcpy() function within TIFFReadDirectory() in tif_dirread.c in libtiff versions from 4.0 to 4.3.0 could lead to Denial of Service via crafted TIFF file. For users that compile libtiff from sources, a fix is available with commit 561599c.
Affected Products: libtiff
References: [{'url': 'https://gitlab.com/libtiff/libtiff/-/issues/362'}, {'url': 'https://gitlab.com/gitlab-org/build/omnibus-mirror/libtiff/-/commit/561599c99f987dc32ae110370cfdd7df7975586b'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0562.json'}, {'name': 'FEDORA-2022-df1df6debd', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DZEHZ35XVO2VBZ4HHCMM6J6TQIDSBQOM/'}, {'name': '[debian-lts-announce] 20220306 [SECURITY] [DLA 2932-1] tiff security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00001.html'}, {'url': 'https://security.netapp.com/advisory/ntap-20220318-0001/'}, {'name': 'DSA-5108', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2022/dsa-5108'}, {'name': 'GLSA-202210-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-10'}]
CVE State: PUBLISHED
Explain CVE-2022-0563
A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.
Affected Products: util-linux
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://lore.kernel.org/util-linux/20220214110609.msiwlm457ngoic6w%40ws.net.home/T/#u'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20220331-0002/'}]
CVE State: PUBLISHED
Explain CVE-2022-0564
A vulnerability in Qlik Sense Enterprise on Windows could allow an remote attacker to enumerate domain user accounts. An attacker could exploit this vulnerability by sending authentication requests to an affected system. A successful exploit could allow the attacker to compare the response time that are returned by the affected system to determine which accounts are valid user accounts. Affected systems are only vulnerable if they have LDAP configured.


Affected Products: Qlik Sense Enterprise on Windows
References: [{'url': 'https://csirt.divd.nl/DIVD-2021-00021/', 'tags': ['third-party-advisory']}, {'url': 'https://csirt.divd.nl/CVE-2022-0564/', 'tags': ['third-party-advisory']}, {'url': 'https://community.qlik.com/t5/Release-Notes/Qlik-Sense-Enterprise-on-Windows-November-2021-Initial-Release/ta-p/1856531', 'tags': ['vendor-advisory']}]
CVE State: PUBLISHED
Explain CVE-2022-0565
Cross-site Scripting in Packagist pimcore/pimcore prior to 10.3.1.


Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/b0b29656-4bbe-41cf-92f6-8579df0b6de5'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/7697f709a501860144352696e583a2533a6e1245'}]
CVE State: PUBLISHED
Explain CVE-2022-0566
It may be possible for an attacker to craft an email message that causes Thunderbird to perform an out-of-bounds write of one byte when processing the message. This vulnerability affects Thunderbird < 91.6.1.
Affected Products: Thunderbird
References: [{'url': 'https://www.mozilla.org/security/advisories/mfsa2022-07/'}, {'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1753094'}]
CVE State: PUBLISHED
Explain CVE-2022-0567
A flaw was found in ovn-kubernetes. This flaw allows a system administrator or privileged attacker to create an egress network policy that bypasses existing ingress policies of other pods in a cluster, allowing network traffic to access pods that should not be reachable. This issue results in information disclosure and other attacks on other pods that should not be reachable.
Affected Products: ovn-kubernetes
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2053326'}]
CVE State: PUBLISHED
Explain CVE-2022-0569
Observable Discrepancy in Packagist snipe/snipe-it prior to v5.3.9.


Affected Products: snipe/snipe-it
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/b41d5e63-bcd8-4864-8a2e-8ec74eec520b'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/snipe/snipe-it/commit/05c0819776b07425b2831cd31a8a0f4e7ac30c09'}]
CVE State: PUBLISHED
Explain CVE-2022-0570
Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
Affected Products: mruby/mruby
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/65a7632e-f95b-4836-b1a7-9cb95e5124f1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/mruby/mruby/commit/38b164ace7d6ae1c367883a3d67d7f559783faad'}]
CVE State: PUBLISHED
Explain CVE-2022-0571
Cross-site Scripting (XSS) - Reflected in GitHub repository phoronix-test-suite/phoronix-test-suite prior to 10.8.2.
Affected Products: phoronix-test-suite/phoronix-test-suite
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/a5039485-6e48-4313-98ad-915506c19ae8'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/phoronix-test-suite/phoronix-test-suite/commit/1eac9260c8313f0cfc77837ec676f4e6d68bd833'}, {'name': 'FEDORA-2022-e790a2739f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSQH5OWXAMWSM7H6VSBRDGTOE7UIOZHZ/'}, {'name': 'FEDORA-2022-29c30bc7ef', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PQ2PBBODEOE3BUCYHL5CV47M72ST4I7S/'}, {'name': 'FEDORA-2022-cce05f0e5e', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QO32MBF3FS65K5YIC6CHXAJTLLPAXJED/'}]
CVE State: PUBLISHED
Explain CVE-2022-0572
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/bf3e0643-03e9-4436-a1c8-74e7111c32bf'}, {'url': 'https://github.com/vim/vim/commit/6e28703a8e41f775f64e442c5d11ce1ff599aa3f'}, {'name': 'FEDORA-2022-9cef12c14c', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GOY5YWTP5QUY2EFLCL7AUWA2CV57C37/'}, {'name': 'FEDORA-2022-48bf3cb1c4', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/'}, {'name': '[debian-lts-announce] 20220516 [SECURITY] [DLA 3011-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0573
JFrog Artifactory before 7.36.1 and 6.23.41, is vulnerable to Insecure Deserialization of untrusted data which can lead to DoS, Privilege Escalation and Remote Code Execution when a specially crafted request is sent by a low privileged authenticated user due to insufficient validation of a user-provided serialized object.
Affected Products: JFrog Artifactory
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.jfrog.com/confluence/display/JFROG/JFrog+Security+Advisories'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.jfrog.com/confluence/display/JFROG/CVE-2022-0573%3A+Artifactory+Vulnerable+to+Deserialization+of+Untrusted+Data'}]
CVE State: PUBLISHED
Explain CVE-2022-0574
Improper Access Control in GitHub repository publify/publify prior to 9.2.8.
Affected Products: publify/publify
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/6f322c84-9e20-4df6-97e8-92bc271ede3f'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/publify/publify/commit/0e6c66ac2002136517662399bca9d838c80d9739'}]
CVE State: PUBLISHED
Explain CVE-2022-0575
Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.2.0.
Affected Products: librenms/librenms
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/13951f51-deed-4a3d-8275-52306cc5a87d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/librenms/librenms/commit/4f86915866703e2fcd1e34b3fc1181ec2ad78e54'}, {'tags': ['x_refsource_MISC'], 'url': 'https://notes.netbytesec.com/2022/02/multiple-vulnerabilities-in-librenms.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0576
Cross-site Scripting (XSS) - Generic in Packagist librenms/librenms prior to 22.1.0.
Affected Products: librenms/librenms
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/114ba055-a2f0-4db9-aafb-95df944ba177'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/librenms/librenms/commit/135717a9a05c5bf8921f1389cbb469dcbf300bfd'}, {'tags': ['x_refsource_MISC'], 'url': 'https://notes.netbytesec.com/2022/02/multiple-vulnerabilities-in-librenms.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0577
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.
Affected Products: scrapy/scrapy
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/3da527b1-2348-4f69-9e88-2e11a96ac585'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/scrapy/scrapy/commit/8ce01b3b76d4634f55067d6cfdf632ec70ba304a'}, {'name': '[debian-lts-announce] 20220316 [SECURITY] [DLA 2950-1] python-scrapy security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00021.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0578
Code Injection in GitHub repository publify/publify prior to 9.2.8.
Affected Products: publify/publify
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/02c81928-eb47-476f-8000-e93dc796dbcc'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/publify/publify/commit/b50df050c593cc532b2c516792989bcfce2d73f7'}]
CVE State: PUBLISHED
Explain CVE-2022-0579
Missing Authorization in Packagist snipe/snipe-it prior to 5.3.9.


Affected Products: snipe/snipe-it
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/70a99cf4-3241-4ffc-b9ed-5c54932f3849'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/snipe/snipe-it/commit/db0c0e790892db874573d95f8ae4268b8a011ab1'}]
CVE State: PUBLISHED
Explain CVE-2022-0580
Incorrect Authorization in Packagist librenms/librenms prior to 22.2.0.


Affected Products: librenms/librenms
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/2494106c-7703-4558-bb1f-1eae59d264e3'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/librenms/librenms/commit/95970af78e4c899744a715766d744deef8c505f7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://notes.netbytesec.com/2022/02/multiple-vulnerabilities-in-librenms.html'}]
CVE State: PUBLISHED