Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2022-0236
The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
Affected Products: WP Import Export
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0236'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/changeset/2649762/wp-import-export-lite/trunk/includes/classes/class-wpie-general.php'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/qurbat/CVE-2022-0236'}]
CVE State: PUBLISHED
Explain CVE-2022-0237
Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80.
Affected Products: Insight Agent
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://docs.rapid7.com/release-notes/insightagent/20220225/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/n2dez/05d43c616f2b403e84ee55d4d7aab251'}]
CVE State: PUBLISHED
Explain CVE-2022-0238
phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)
Affected Products: phoronix-test-suite/phoronix-test-suite
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/63f24b24-4af2-47b8-baea-7ad5f4db3633'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/phoronix-test-suite/phoronix-test-suite/commit/5755b3bf979cd04caa6feee07e403a5be5ac320e'}, {'name': 'FEDORA-2022-8f968eea82', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57V2CSFU5MKWKL6RJUKMXSD4PCRFTMMQ/'}, {'name': 'FEDORA-2022-43f11039b2', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BU7E6OOZCXS3ZWHOQ2AR7MKM56IN2R6R/'}]
CVE State: PUBLISHED
Explain CVE-2022-0239
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Affected Products: stanfordnlp/corenlp
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/a717aec2-5646-4a5f-ade0-dadc25736ae3'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/stanfordnlp/corenlp/commit/1940ffb938dc4f3f5bc5f2a2fd8b35aabbbae3dd'}]
CVE State: PUBLISHED
Explain CVE-2022-0240
mruby is vulnerable to NULL Pointer Dereference
Affected Products: mruby/mruby
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/5857eced-aad9-417d-864e-0bdf17226cbb'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/mruby/mruby/commit/31fa3304049fc406a201a72293cce140f0557dca'}]
CVE State: PUBLISHED
Explain CVE-2022-0242
Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
Affected Products: crater-invoice/crater
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/19f3e5f7-b419-44b1-9c37-7e4404cbec94'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/crater-invoice/crater/commit/dcb3ddecb9f4cde622cc42c51a2760747797624f'}]
CVE State: PUBLISHED
Explain CVE-2022-0243
Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
Affected Products: orchardcms/orchardcore
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/orchardcms/orchardcore/commit/218f25ddfadb66a54de7a82dffe3ab2e4ab7c4b4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/fa538421-ae55-4288-928f-4e96aaed5803'}]
CVE State: PUBLISHED
Explain CVE-2022-0244
An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/349524'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/1439593'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0244.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0245
Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/6a6aca72-32b7-45b3-a8ba-9b400b2d669c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/c2fa19afeb8b1ea927fea3fd452515c95f289fb9'}]
CVE State: PUBLISHED
Explain CVE-2022-0246
The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
Affected Products: iQ Block Country
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776'}]
CVE State: PUBLISHED
Explain CVE-2022-0247
An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5d3d or any of the listed versions.
Affected Products: Fuchsia
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://fuchsia.googlesource.com/fuchsia/+/d97c05d2301799ed585620a9c5c739d36e7b5d3d'}]
CVE State: PUBLISHED
Explain CVE-2022-0248
The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
Affected Products: Contact Form Submissions
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/d02cf542-2d75-46bc-a0df-67bbe501cc89'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2682024'}]
CVE State: PUBLISHED
Explain CVE-2022-0249
A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/29395'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/579934'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0249.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0250
The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
Affected Products: Redirection for Contact Form 7
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/05700942-3143-4978-89eb-814ceff74867'}]
CVE State: PUBLISHED
Explain CVE-2022-0251
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/eb4b08f9-cf8b-4335-b3b8-ed44e5fa80a5'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/3ae96b9d41c117aafa45873ad10077d4b873a3cb'}]
CVE State: PUBLISHED
Explain CVE-2022-0252
The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
Affected Products: GiveWP – Donation Plugin and Fundraising Platform
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2659032'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/b0e551af-087b-43e7-bdb7-11d7f639028a'}]
CVE State: PUBLISHED
Explain CVE-2022-0253
livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/ac7f7eba-ee0b-4a50-bd89-29fd9b3e8303'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/407d0b1a1fa56fa6f824a19092774f10f4880437'}]
CVE State: PUBLISHED
Explain CVE-2022-0254
The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Affected Products: WordPress Zero Spam
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/ae54681f-7b89-408c-b0ee-ba4a520db997'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2660225'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2680906'}]
CVE State: PUBLISHED
Explain CVE-2022-0255
The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
Affected Products: Database Backup for WordPress
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/684bb06d-864f-4cba-ab0d-f83974d026fa'}]
CVE State: PUBLISHED
Explain CVE-2022-0256
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/8d88e48a-7124-4aaf-9f1d-6cfe4f9a79c1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/dff1cb0c466abcd55f1268934de3ed937b7436a7'}]
CVE State: PUBLISHED
Explain CVE-2022-0257
pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/bad2073c-bbd5-4425-b3e9-c336b73ddda6'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/dfaf78b26fb77990267c0cc05b9fcb9f8de7b66d'}]
CVE State: PUBLISHED
Explain CVE-2022-0258
pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/0df891e4-6412-4d9a-a9b7-d9df50311802'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/66281c12479dc01a06258d8533eaddfb1770d5bd'}]
CVE State: PUBLISHED
Explain CVE-2022-0260
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/89e4ab60-21ec-4396-92ad-5b78d4c2897e'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/3125d5f0c04cfb5835857ca9416f0bb143130a2f'}]
CVE State: PUBLISHED
Explain CVE-2022-0261
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/fa795954-8775-4f23-98c6-d4d4d3fe8a82'}, {'url': 'https://github.com/vim/vim/commit/9f8c304c8a390ade133bac29963dc8e56ab14cbc'}, {'name': '[debian-lts-announce] 20220516 [SECURITY] [DLA 3011-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'url': 'https://support.apple.com/kb/HT213444'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '20221030 APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/43'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0262
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/b38a4e14-5dcb-4e49-9990-494dc2a8fa0d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/6f36e841ce55f67e2e95253dd58f80659ef166c7'}]
CVE State: PUBLISHED
Explain CVE-2022-0263
Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/96506857-06bc-4c84-88b7-4f397715bcf6'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/35d1853baf64d6a1d90fd8803e52439da53a3911'}]
CVE State: PUBLISHED
Explain CVE-2022-0264
A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6
Affected Products: kernel
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2041547'}]
CVE State: PUBLISHED
Explain CVE-2022-0265
Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
Affected Products: hazelcast/hazelcast
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/d63972a2-b910-480a-a86b-d1f75d24d563'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/hazelcast/hazelcast/commit/4d6b666cd0291abd618c3b95cdbb51aa4208e748'}]
CVE State: PUBLISHED
Explain CVE-2022-0266
Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/1ac267be-3af8-4774-89f2-77234d144d6b'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/cc1122aed0d1ad9f05757eaea2ab9e6a924776bd'}]
CVE State: PUBLISHED
Explain CVE-2022-0267
The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
Affected Products: AdRotate – Ad manager & AdSense Ads
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/7df70f49-547f-4bdb-bf9b-2e06f93488c6'}]
CVE State: PUBLISHED
Explain CVE-2022-0268
Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.
Affected Products: getgrav/grav
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/67085545-331e-4469-90f3-a1a46a078d39'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/getgrav/grav/commit/6f2fa9311afb9ecd34030dec2aff7b39e9e7e735'}]
CVE State: PUBLISHED
Explain CVE-2022-0269
Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.
Affected Products: yetiforcecompany/yetiforcecrm
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/a0470915-f6df-45b8-b3a2-01aebe764df0'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/yetiforcecompany/yetiforcecrm/commit/298c7870e6fe4332d8aa1757a9c8d79f841389ff'}]
CVE State: PUBLISHED
Explain CVE-2022-0270
Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
Affected Products: bored-agent
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/Mirantis/security/blob/main/advisories/0004.md'}]
CVE State: PUBLISHED
Explain CVE-2022-0271
The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting
Affected Products: LearnPress – WordPress LMS Plugin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/ad07d9cd-8a75-4f7c-bbbe-3b6b89b699f2'}]
CVE State: PUBLISHED
Explain CVE-2022-0272
Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
Affected Products: detekt/detekt
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/23e37ba7-96d5-4037-a90a-8c8f4a70ce44'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/detekt/detekt/commit/c965a8d2a6bbdb9bcfc6acfa7bbffd3da81f5395'}]
CVE State: PUBLISHED
Explain CVE-2022-0273
Improper Access Control in Pypi calibreweb prior to 0.6.16.
Affected Products: janeczku/calibre-web
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/8f27686f-d698-4ab6-8ef0-899125792f13'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/janeczku/calibre-web/commit/0c0313f375bed7b035c8c0482bbb09599e16bfcf'}]
CVE State: PUBLISHED
Explain CVE-2022-0274
Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
Affected Products: orchardcms/orchardcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/a82a714a-9b71-475e-bfc3-43326fcaf764'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/orchardcms/orchardcore/commit/218f25ddfadb66a54de7a82dffe3ab2e4ab7c4b4'}]
CVE State: PUBLISHED
Explain CVE-2022-0277
Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'url': 'https://huntr.dev/bounties/0e776f3d-35b1-4a9e-8fe8-91e46c0d6316'}, {'url': 'https://github.com/microweber/microweber/commit/e680e134a4215c979bfd2eaf58336be34c8fc6e6'}]
CVE State: PUBLISHED
Explain CVE-2022-0278
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/64495d0f-d5ec-4542-9693-32372c18d030'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/b64ef574b82dbf89a908e1569d790c7012d1ccd7'}]
CVE State: PUBLISHED
Explain CVE-2022-0279
The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users
Affected Products: AnyComment
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/43a4b2d3-1bd5-490c-982c-bb7120595865'}]
CVE State: PUBLISHED
Explain CVE-2022-0280
A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43 that allows a local user to gain privilege elevation and perform an arbitrary file delete. This could lead to sensitive files being deleted and potentially cause denial of service. This attack exploits the way symlinks are created and how the product works with them.
Affected Products: McAfee Total Protection for Windows
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://service.mcafee.com/?articleId=TS103271&page=shell&shell=article-view'}]
CVE State: PUBLISHED
Explain CVE-2022-0281
Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/e680e134a4215c979bfd2eaf58336be34c8fc6e6'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/315f5ac6-1b5e-4444-ad8f-802371da3505'}]
CVE State: PUBLISHED
Explain CVE-2022-0282
Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11.


Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/8815b642-bd9b-4737-951b-bde7319faedd'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/51b5a4e3ef01e587797c0109159a8ad9d2bac77a'}]
CVE State: PUBLISHED
Explain CVE-2022-0283
An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab integration with Jira that a could cause the web application to redirect the request to the attacker specified URL.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/349422'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0283.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0284
A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.
Affected Products: ImageMagick
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2045943'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-0284'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/ImageMagick/ImageMagick/issues/4729'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/ImageMagick/ImageMagick/commit/e50f19fd73c792ebe912df8ab83aa51a243a3da7'}]
CVE State: PUBLISHED
Explain CVE-2022-0285
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/321918b2-aa01-410e-9f7c-dca5f286bc9c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/b432225952e2a5ab0268f401b85a14480369b835'}]
CVE State: PUBLISHED
Explain CVE-2022-0286
A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service.
Affected Products: n/a
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=105cd17a866017b45f3c45901b394c711c97bf40'}, {'tags': ['x_refsource_MISC'], 'url': 'https://syzkaller.appspot.com/bug?id=160f641886d88bf11cbf1236cc4db994bb210626'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujul2022.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0287
The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog
Affected Products: myCred
References: [{'url': 'https://wpscan.com/vulnerability/6cd7cd6d-1cc1-472c-809b-b66389f149b0', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0288
The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Affected Products: Ad Inserter – Ad Manager & AdSense Ads
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/27b64412-33a4-462c-bc45-f81697e4fe42'}]
CVE State: PUBLISHED
Explain CVE-2022-0289
Use after free in Safe browsing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1284367'}, {'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/166547/Chrome-safe_browsing-ThreatDetails-OnReceivedThreatDOMDetails-Use-After-Free.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0290
Use after free in Site isolation in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1260134'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/166080/Chrome-RenderFrameHostImpl-Use-After-Free.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0291
Inappropriate implementation in Storage in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1281084'}]
CVE State: PUBLISHED
Explain CVE-2022-0292
Inappropriate implementation in Fenced Frames in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1270358'}]
CVE State: PUBLISHED
Explain CVE-2022-0293
Use after free in Web packaging in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1283371'}]
CVE State: PUBLISHED
Explain CVE-2022-0294
Inappropriate implementation in Push messaging in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1273017'}]
CVE State: PUBLISHED
Explain CVE-2022-0295
Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1278180'}]
CVE State: PUBLISHED
Explain CVE-2022-0296
Use after free in Printing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1283375'}]
CVE State: PUBLISHED
Explain CVE-2022-0297
Use after free in Vulkan in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1274316'}]
CVE State: PUBLISHED
Explain CVE-2022-0298
Use after free in Scheduling in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1212957'}]
CVE State: PUBLISHED
Explain CVE-2022-0300
Use after free in Text Input Method Editor in Google Chrome on Android prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1275438'}]
CVE State: PUBLISHED
Explain CVE-2022-0301
Heap buffer overflow in DevTools in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1276331'}]
CVE State: PUBLISHED
Explain CVE-2022-0302
Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1278613'}]
CVE State: PUBLISHED
Explain CVE-2022-0304
Use after free in Bookmarks in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1282118'}]
CVE State: PUBLISHED
Explain CVE-2022-0305
Inappropriate implementation in Service Worker API in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1282354'}]
CVE State: PUBLISHED
Explain CVE-2022-0306
Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1283198'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/166367/Chrome-chrome_pdf-PDFiumEngine-RequestThumbnail-Heap-Buffer-Overflow.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0307
Use after free in Optimization Guide in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1281881'}]
CVE State: PUBLISHED
Explain CVE-2022-0308
Use after free in Data Transfer in Google Chrome on Chrome OS prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1282480'}]
CVE State: PUBLISHED
Explain CVE-2022-0309
Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1240472'}]
CVE State: PUBLISHED
Explain CVE-2022-0310
Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1283805'}]
CVE State: PUBLISHED
Explain CVE-2022-0311
Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1283807'}]
CVE State: PUBLISHED
Explain CVE-2022-0313
The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack
Affected Products: Float menu – awesome floating side menu
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/1ce6c8f4-6f4b-4d56-8d11-43355ef32e8c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2661431'}]
CVE State: PUBLISHED
Explain CVE-2022-0314
The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Affected Products: Nimble Page Builder
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/17585f16-c62c-422d-ad9c-9138b6da97b7'}]
CVE State: PUBLISHED
Explain CVE-2022-0315
Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.
Affected Products: horovod/horovod
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41'}]
CVE State: PUBLISHED
Explain CVE-2022-0316
The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.
Affected Products: WeStand
References: [{'url': 'https://wpscan.com/vulnerability/9ab3d6cf-aad7-41bc-9aae-dc5313f12f7c', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0317
An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.
Affected Products: go-attestation
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774p'}]
CVE State: PUBLISHED
Explain CVE-2022-0318
Heap-based Buffer Overflow in vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/0d10ba02-b138-4e68-a284-67f781a62d08'}, {'url': 'https://github.com/vim/vim/commit/57df9e8a9f9ae1aafdde9b86b10ad907627a87dc'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'url': 'https://support.apple.com/kb/HT213444'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '20221030 APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/43'}, {'name': '[debian-lts-announce] 20221124 [SECURITY] [DLA 3204-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0319
Out-of-bounds Read in vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/ba622fd2-e6ef-4ad9-95b4-17f87b68755b'}, {'url': 'https://github.com/vim/vim/commit/05b27615481e72e3b338bb12990fb3e0c2ecc2a9'}, {'name': '[debian-lts-announce] 20220311 [SECURITY] [DLA 2947-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'url': 'https://support.apple.com/kb/HT213444'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '20221030 APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/43'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0320
The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.
Affected Products: Essential Addons for Elementor
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/0d02b222-e672-4ac0-a1d4-d34e1ecf4a95'}]
CVE State: PUBLISHED
Explain CVE-2022-0321
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
Affected Products: WP Voting Contest
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/286b81a0-6f6d-4024-9bbc-6cb373990a7a'}]
CVE State: PUBLISHED
Explain CVE-2022-0322
A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS).
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2042822'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2d859e3fc97e79d907761550dbc03ff1b36479c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.oracle.com/security-alerts/cpujul2022.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0323
Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.
Affected Products: bobthecow/mustache.php
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/a5f5a988-aa52-4443-839d-299a63f44fb7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/bobthecow/mustache.php/commit/579ffa5c96e1d292c060b3dd62811ff01ad8c24e'}]
CVE State: PUBLISHED
Explain CVE-2022-0324
There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that could cause buffer overflow in a memcpy call, leading to out-of-bounds memory write that would cause dhcp6relay to crash. Dhcp6relay is a critical process and could cause dhcp relay docker to shutdown.

Discovered by Eugene Lim of GovTech Singapore.

Affected Products: Software for Open Networking in the Cloud (SONiC)
References: [{'url': 'https://github.com/sonic-net/sonic-buildimage/security/advisories/GHSA-m4qf-8rrq-mph9'}, {'url': 'https://govtech-csg.github.io/security-advisories/2022/11/14/CVE-2022-0324.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0326
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Affected Products: mruby/mruby
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/795dcbd9-1695-44bb-8c59-ad327c97c976'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/mruby/mruby/commit/b611c43a5de061ec21b343967e1b64c45c373d7e'}]
CVE State: PUBLISHED
Explain CVE-2022-0327
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting
Affected Products: Master Addons for Elementor
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/df38cc99-da3c-4cc0-b179-1e52e841b883'}]
CVE State: PUBLISHED
Explain CVE-2022-0328
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
Affected Products: Simple Membership
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/44532b7c-4d0d-4959-ada4-733f377d6ec9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2662855'}]
CVE State: PUBLISHED
Explain CVE-2022-0330
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.
Affected Products: kernel
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2042404'}, {'url': 'https://www.openwall.com/lists/oss-security/2022/01/25/12'}, {'url': 'https://security.netapp.com/advisory/ntap-20220526-0001/'}, {'name': '[oss-security] 20221130 Security sensitive bug in the i915 kernel driver (CVE-2022-4139)', 'tags': ['mailing-list'], 'url': 'http://www.openwall.com/lists/oss-security/2022/11/30/1'}]
CVE State: PUBLISHED
Explain CVE-2022-0331
An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5 MR2 and older.
Affected Products: Sophos Firewall
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.sophos.com/en-us/security-advisories/sophos-sa-20220328-sfos-18-5-3'}]
CVE State: PUBLISHED
Explain CVE-2022-0332
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
Affected Products: moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2043661'}, {'tags': ['x_refsource_MISC'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=431099'}]
CVE State: PUBLISHED
Explain CVE-2022-0333
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
Affected Products: moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2043663'}, {'tags': ['x_refsource_MISC'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=431100'}]
CVE State: PUBLISHED
Explain CVE-2022-0334
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
Affected Products: moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2043664'}, {'tags': ['x_refsource_MISC'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=431102'}]
CVE State: PUBLISHED
Explain CVE-2022-0335
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
Affected Products: moodle
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2043666'}, {'tags': ['x_refsource_MISC'], 'url': 'https://moodle.org/mod/forum/discuss.php?d=431103'}]
CVE State: PUBLISHED