Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2022-0336
The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity.
Affected Products: Samba
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.samba.org/samba/security/CVE-2022-0336.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.samba.org/show_bug.cgi?id=14950'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/samba-team/samba/commit/1a5dc817c0c9379bbaab14c676681b42b0039a3c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/samba-team/samba/commit/c58ede44f382bd0125f761f0479c8d48156be400'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2046134'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-0336'}]
CVE State: PUBLISHED
Explain CVE-2022-0337
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1247389'}]
CVE State: PUBLISHED
Explain CVE-2022-0338
Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.


Affected Products: delgan/loguru
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/359bea50-2bc6-426a-b2f9-175d401b1ed0'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/delgan/loguru/commit/ea39375e62f9b8f18e2ca798a5c0fb8c972b7eaa'}]
CVE State: PUBLISHED
Explain CVE-2022-0339
Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.
Affected Products: janeczku/calibre-web
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/499688c4-6ac4-4047-a868-7922c3eab369'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92'}]
CVE State: PUBLISHED
Explain CVE-2022-0341
Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12.
Affected Products: vanessa219/vditor
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/fa546b57-bc15-4705-824e-9474b616f628'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/vanessa219/vditor/commit/219f8a9e272aba3cbc0096a82cac776532dbb9e5'}]
CVE State: PUBLISHED
Explain CVE-2022-0342
An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
Affected Products: USG/ZyWALL series firmware
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml'}]
CVE State: PUBLISHED
Explain CVE-2022-0343
A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2
Affected Products: Perfetto Dev Scripts
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://android-review.googlesource.com/c/platform/external/perfetto/+/1999296/'}]
CVE State: PUBLISHED
Explain CVE-2022-0344
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/37015'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/724880'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0344.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0345
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
Affected Products: Customize WordPress Emails and Alerts
References: [{'url': 'https://wpscan.com/vulnerability/b3b523b9-6c92-4091-837a-d34e3174eb19', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0346
The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.
Affected Products: XML Sitemap Generator for Google
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/4b339390-d71a-44e0-8682-51a12bd2bfe6'}]
CVE State: PUBLISHED
Explain CVE-2022-0347
The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Affected Products: LoginPress | Custom Login Page Customizer
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/a5084367-842b-496a-a23c-24dbebac1e8b'}]
CVE State: PUBLISHED
Explain CVE-2022-0348
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/250e79be-7e5d-4ba3-9c34-655e39ade2f4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/832c34aeb9f21f213295a0c28377132df996352a'}]
CVE State: PUBLISHED
Explain CVE-2022-0349
The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection
Affected Products: NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/1d0dd7be-29f3-4043-a9c6-67d02746463a'}]
CVE State: PUBLISHED
Explain CVE-2022-0350
Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.
Affected Products: vanessa219/vditor
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/8202aa06-4b49-45ff-aa0f-00982f62005c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/vanessa219/vditor/commit/e912e36ea98251d700499b1ac7702708d3398476'}]
CVE State: PUBLISHED
Explain CVE-2022-0351
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/8b36db58-b65c-4298-be7f-40b9e37fd161'}, {'url': 'https://github.com/vim/vim/commit/fe6fb267e6ee5c5da2f41889e4e0e0ac5bf4b89d'}, {'name': '[debian-lts-announce] 20220516 [SECURITY] [DLA 3011-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'url': 'https://support.apple.com/kb/HT213444'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '20221030 APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/43'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0352
Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
Affected Products: janeczku/calibre-web
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/a577ff17-2ded-4c41-84ae-6ac02440f717'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/janeczku/calibre-web/commit/6bf07539788004513c3692c074ebc7ba4ce005e1'}]
CVE State: PUBLISHED
Explain CVE-2022-0354
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window.
Affected Products: System Update
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://support.lenovo.com/us/en/product_security/LEN-76673'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.infosec.tirol/cve-2022-0354/'}]
CVE State: PUBLISHED
Explain CVE-2022-0355
Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.


Affected Products: feross/simple-get
References: [{'url': 'https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31'}, {'url': 'https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f'}, {'url': 'https://github.com/advisories/GHSA-wpg7-2c88-r8xv'}]
CVE State: PUBLISHED
Explain CVE-2022-0357
Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM.

This issue affects:

Bitdefender Total Security
versions prior to 26.0.10.45.
Bitdefender Internet Security
versions prior to 26.0.10.45.
Bitdefender Antivirus Plus
versions prior to 26.0.10.45.
Affected Products: Total Security
References: [{'url': 'https://www.bitdefender.com/support/security-advisories/improper-quoting-path-issue-in-bitdefender-total-security'}]
CVE State: PUBLISHED
Explain CVE-2022-0358
A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.
Affected Products: QEMU/virtiofsd
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2044863'}, {'url': 'https://gitlab.com/qemu-project/qemu/-/commit/449e8171f96a6a944d1f3b7d3627ae059eae21ca'}, {'url': 'https://access.redhat.com/security/cve/CVE-2022-0358'}, {'url': 'https://security.netapp.com/advisory/ntap-20221007-0008/'}]
CVE State: PUBLISHED
Explain CVE-2022-0359
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/a3192d90-4f82-4a67-b7a6-37046cc88def'}, {'url': 'https://github.com/vim/vim/commit/85b6747abc15a7a81086db31289cf1b8b17e6cb1'}, {'name': '[debian-lts-announce] 20220311 [SECURITY] [DLA 2947-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'url': 'https://support.apple.com/kb/HT213444'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '20221030 APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/43'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0360
The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues
Affected Products: Easy Drag And drop All Import : WP Ultimate CSV Importer
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2662897'}]
CVE State: PUBLISHED
Explain CVE-2022-0361
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/a055618c-0311-409c-a78a-99477121965b'}, {'url': 'https://github.com/vim/vim/commit/dc5490e2cbc8c16022a23b449b48c1bd0083f366'}, {'name': '[debian-lts-announce] 20220311 [SECURITY] [DLA 2947-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'url': 'https://support.apple.com/kb/HT213444'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '20221030 APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/43'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0362
SQL Injection in Packagist showdoc/showdoc prior to 2.10.3.
Affected Products: star7th/showdoc
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/e7c72417-eb8f-416c-8480-be76ac0a9091'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/star7th/showdoc/commit/2b34e267e4186125f99bfa420140634ad45801fb'}]
CVE State: PUBLISHED
Explain CVE-2022-0363
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
Affected Products: myCred
References: [{'url': 'https://wpscan.com/vulnerability/a438a951-497c-43cd-822f-1a48d4315191', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0364
The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Affected Products: Modern Events Calendar Lite
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/0eb40cd5-838e-4b53-994d-22cf7c8a6c50'}]
CVE State: PUBLISHED
Explain CVE-2022-0365
The affected product is vulnerable to an authenticated OS command injection, which may allow an attacker to inject and execute arbitrary shell commands as the Admin (root) user.
Affected Products: Industrial Cellular Router
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-032-01'}]
CVE State: PUBLISHED
Explain CVE-2022-0366
An authenticated and authorized agent user could potentially gain administrative access via an SQLi vulnerability to Capsule8 Console between versions 4.6.0 and 4.9.1.
Affected Products: n/a
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.sophos.com/en-us/security-advisories/sophos-sa-20220201-cap8-console-sqli'}]
CVE State: PUBLISHED
Explain CVE-2022-0367
A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
Affected Products: libmodbus
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/stephane/libmodbus/issues/614'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2045571'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/stephane/libmodbus/commit/b4ef4c17d618eba0adccc4c7d9e9a1ef809fc9b6'}, {'name': '[debian-lts-announce] 20220904 [SECURITY] [DLA 3098-1] libmodbus security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/09/msg00007.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0368
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/bca9ce1f-400a-4bf9-9207-3f3187cb3fa9'}, {'url': 'https://github.com/vim/vim/commit/8d02ce1ed75d008c34a5c9aaa51b67cbb9d33baa'}, {'name': '[debian-lts-announce] 20220311 [SECURITY] [DLA 2947-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'url': 'https://support.apple.com/kb/HT213444'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '20221030 APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/43'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0370
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/fbe4b376-57ce-42cd-a9a9-049c4099b3ca'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/9f5bc33c943349bd765b991db0b7f6b6ef05cfdb'}]
CVE State: PUBLISHED
Explain CVE-2022-0371
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versions starting from 14.7 before 14.7.1. GitLab search may allow authenticated users to search other users by their respective private emails even if a user set their email to private.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/350476'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0371.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0372
Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
Affected Products: crater-invoice/crater
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/crater-invoice/crater/commit/cdc913d16cf624aee852bc9163a7c6ffc8d1da9d'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/563232b9-5a93-4f4d-8389-ed805b262ef1'}]
CVE State: PUBLISHED
Explain CVE-2022-0373
Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/349881'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/1439254'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0373.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0374
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/f8b560a6-aa19-4262-8ae4-cf88204310ef'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/bbfaa26ce54a2a86ce1a42a16496038f5bdfc102'}]
CVE State: PUBLISHED
Explain CVE-2022-0375
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/bbfaa26ce54a2a86ce1a42a16496038f5bdfc102'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/28e1c356-6eaa-4d93-af56-938e3b4d40a7'}]
CVE State: PUBLISHED
Explain CVE-2022-0376
The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Affected Products: User Meta – User Profile Builder and User management plugin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/a3ca2ed4-11ea-4d78-aa4c-4ed58f258932'}]
CVE State: PUBLISHED
Explain CVE-2022-0377
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration.  After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site.
Affected Products: LearnPress
References: [{'url': 'https://wpscan.com/vulnerability/0d95ada6-53e3-4a80-a395-eacd7b090f26', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'https://bozogullarindan.com/en/2022/01/wordpress-learnpress-plugin-4.1.4.1-arbitrary-image-renaming/'}, {'url': 'https://github.com/LearnPress/learnpress/commit/d1dc4af7ef2950f1000abc21bd9520fb3eb98faf'}]
CVE State: PUBLISHED
Explain CVE-2022-0378
Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/529b65c0-5be7-49d4-9419-f905b8153d31'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/fc7e1a026735b93f0e0047700d08c44954fce9ce'}]
CVE State: PUBLISHED
Explain CVE-2022-0379
Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/933f94b8-c5e7-4c3a-92e0-4d1577d5fee6'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/f017cbfbd5c4f097d2c78c5e15b6c8a9da479d7b'}]
CVE State: PUBLISHED
Explain CVE-2022-0380
The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF'] found in the ~/options-fotobook.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 3.2.3.
Affected Products: Fotobook
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/vulnerability-advisories/#CVE-2022-03801'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/browser/fotobook/tags/3.2.3/options-fotobook.php#L128'}]
CVE State: PUBLISHED
Explain CVE-2022-0381
The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0.
Affected Products: Embed Swagger
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0381'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/Xib3rR4dAr/4b3ea7960914e23c3a875b973a5b37a3'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/browser/embed-swagger/trunk/swagger-iframe.php#L59'}]
CVE State: PUBLISHED
Explain CVE-2022-0382
An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user cannot control what is read. This flaw affects the Linux kernel versions prior to 5.17-rc1.
Affected Products: kernel
References: [{'url': 'https://github.com/torvalds/linux/commit/d6d86830705f173fca6087a3e67ceaf68db80523'}]
CVE State: PUBLISHED
Explain CVE-2022-0383
The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could allow a high privilege users to perform SQL Injections attacks
Affected Products: WP Review Slider
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/e0402753-3a80-455b-9fab-a7d2a7687193'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2666513'}]
CVE State: PUBLISHED
Explain CVE-2022-0384
The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog
Affected Products: Video Conferencing with Zoom
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/91c44c45-994b-4aed-b9f9-7db45924eeb4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2671219'}]
CVE State: PUBLISHED
Explain CVE-2022-0385
The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Stored Cross-Site scripting
Affected Products: Crazy Bone
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/60067b8b-9fa5-40d1-817a-929779947891'}]
CVE State: PUBLISHED
Explain CVE-2022-0386
A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710.
Affected Products: Sophos UTM
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.sophos.com/en-us/security-advisories/sophos-sa-20220321-utm-9710'}]
CVE State: PUBLISHED
Explain CVE-2022-0387
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/2e09035b-8f98-4930-b7e8-7abe5f722b98'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/ff70c7dd641b68b9afb170b89ec1ef003a4e3444'}]
CVE State: PUBLISHED
Explain CVE-2022-0388
The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Affected Products: Interactive Medical Drawing of Human Body
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/7d4ad1f3-6d27-4655-9796-ce370ef5fced'}]
CVE State: PUBLISHED
Explain CVE-2022-0389
The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Affected Products: WP Time Slots Booking Form
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/788ead78-9aa2-49a3-b191-12114be8270b'}]
CVE State: PUBLISHED
Explain CVE-2022-0390
Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/330030'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/1179733'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0390.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0391
A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
Affected Products: python
References: [{'url': 'https://bugs.python.org/issue43882'}, {'name': 'FEDORA-2022-ef99a016f6', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UDBDBAU6HUPZHISBOARTXZ5GKHF2VH5U/'}, {'name': 'FEDORA-2022-18ad73aba6', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CSD2YBXP3ZF44E44QMIIAR5VTO35KTRB/'}, {'url': 'https://www.oracle.com/security-alerts/cpuapr2022.html'}, {'url': 'https://security.netapp.com/advisory/ntap-20220225-0009/'}, {'name': 'GLSA-202305-02', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202305-02'}]
CVE State: PUBLISHED
Explain CVE-2022-0392
Heap-based Buffer Overflow in GitHub repository vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/d00a2acd-1935-4195-9d5b-4115ef6b3126'}, {'url': 'https://github.com/vim/vim/commit/806d037671e133bd28a7864248763f643967973a'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'url': 'https://support.apple.com/kb/HT213444'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '20221030 APPLE-SA-2022-10-27-7 Additional information for APPLE-SA-2022-09-12-4 macOS Monterey 12.6', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/43'}, {'name': '[debian-lts-announce] 20221124 [SECURITY] [DLA 3204-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0393
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/ecc8f488-01a0-477f-848f-e30b8e524bba'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/vim/vim/commit/a4bc2dd7cccf5a4a9f78b58b6f35a45d17164323'}, {'name': 'FEDORA-2022-da2fb07efb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/'}, {'name': 'FEDORA-2022-48bf3cb1c4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-32'}]
CVE State: PUBLISHED
Explain CVE-2022-0394
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/e13823d0-271c-448b-a0c5-8549ea7ea272'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/d7b85466c217b3750eaccc8703ce54ba8785c4d3'}]
CVE State: PUBLISHED
Explain CVE-2022-0395
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/36abbd6e-239e-4739-8c77-ba212b946a4a'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/8fdb4f67ac1a095331aa0fb4630ef9dfe8e75dcb'}]
CVE State: PUBLISHED
Explain CVE-2022-0396
BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection.
Affected Products: BIND
References: [{'url': 'https://kb.isc.org/v1/docs/cve-2022-0396'}, {'name': 'FEDORA-2022-14e36aac0c', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/'}, {'url': 'https://security.netapp.com/advisory/ntap-20220408-0001/'}, {'url': 'https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf'}, {'name': 'GLSA-202210-25', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-25'}]
CVE State: PUBLISHED
Explain CVE-2022-0397
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Affected Products: WPC Smart Wishlist for WooCommerce
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/c8091254-1ced-4363-ab7f-5b880447713d'}]
CVE State: PUBLISHED
Explain CVE-2022-0398
The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website
Affected Products: ThirstyAffiliates Affiliate Link Manager
References: [{'url': 'https://wpscan.com/vulnerability/21aec131-91ff-4300-ac7a-0bf31d6b2b24', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0399
The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's response, leading to a Reflected Cross-Site Scripting
Affected Products: Advanced Product Labels for WooCommerce
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/5e5fdcf4-ec2b-4e73-8009-05606b2d5164'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2678919'}]
CVE State: PUBLISHED
Explain CVE-2022-0400
An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos.
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2040604'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2044575'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-0400'}]
CVE State: PUBLISHED
Explain CVE-2022-0401
Path Traversal in NPM w-zip prior to 1.0.12.
Affected Products: yuda-lyu/w-zip
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/d93259aa-ad03-43d6-8846-a00b9f58876d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/yuda-lyu/w-zip/commit/d7039d034e02fa358e6656565157cedf5fa83288'}]
CVE State: PUBLISHED
Explain CVE-2022-0403
The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders.
Affected Products: Library File Manager
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/997a7fbf-98c6-453e-ad84-75c1e91d5a1e'}]
CVE State: PUBLISHED
Explain CVE-2022-0404
The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site.
Affected Products: Material Design for Contact Form 7
References: [{'url': 'https://wpscan.com/vulnerability/6d0932bb-d515-4432-b67b-16aba34bd285', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0405
Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16.
Affected Products: janeczku/calibre-web
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/370538f6-5312-4c15-9fc0-b4c36ac236fe'}]
CVE State: PUBLISHED
Explain CVE-2022-0406
Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16.
Affected Products: janeczku/calibre-web
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/d7498799-4797-4751-b5e2-b669e729d5db'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/janeczku/calibre-web/commit/e0e04220109920575179a8f924543449c6de0706'}]
CVE State: PUBLISHED
Explain CVE-2022-0407
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/81822bf7-aafe-4d37-b836-1255d46e572c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/vim/vim/commit/44db8213d38c39877d2148eff6a72f4beccfb94e'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-32'}]
CVE State: PUBLISHED
Explain CVE-2022-0408
Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/5e635bad-5cf6-46cd-aeac-34ef224e179d'}, {'url': 'https://github.com/vim/vim/commit/06f15416bb8d5636200a10776f1752c4d6e49f31'}, {'name': 'FEDORA-2022-da2fb07efb', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/'}, {'name': 'FEDORA-2022-48bf3cb1c4', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/'}, {'name': '[debian-lts-announce] 20220311 [SECURITY] [DLA 2947-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0409
Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2.
Affected Products: star7th/showdoc
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/c25bfad1-2611-4226-954f-009e50f966f7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/star7th/showdoc/commit/7383d7a3c1b0807b6f397ba7df415a0ce7ccc436'}]
CVE State: PUBLISHED
Explain CVE-2022-0410
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection
Affected Products: WP Visitor Statistics (Real Time Traffic)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/0d6b89f5-cf12-4ad4-831b-fed26763ba20'}]
CVE State: PUBLISHED
Explain CVE-2022-0411
The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection
Affected Products: Asgaros Forum
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/35272197-c973-48ad-8405-538bfbafa172'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2669226/asgaros-forum'}]
CVE State: PUBLISHED
Explain CVE-2022-0412
The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks
Affected Products: TI WooCommerce Wishlist
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/e984ba11-abeb-4ed4-9dad-0bfd539a9682'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2668899'}]
CVE State: PUBLISHED
Explain CVE-2022-0413
Use After Free in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/563d1e8f-5c3d-4669-941c-3216f4a87c38'}, {'url': 'https://github.com/vim/vim/commit/37f47958b8a2a44abc60614271d9537e7f14e51a'}, {'name': 'FEDORA-2022-da2fb07efb', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/'}, {'name': 'FEDORA-2022-48bf3cb1c4', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/'}, {'name': '[debian-lts-announce] 20220516 [SECURITY] [DLA 3011-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0414
Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0.
Affected Products: dolibarr/dolibarr
References: [{'url': 'https://huntr.dev/bounties/76f3b405-9f5d-44b1-8434-b52b56ee395f'}, {'url': 'https://github.com/dolibarr/dolibarr/commit/37fb02ee760cfff18c795ba468da1ba1c53f4684'}]
CVE State: PUBLISHED
Explain CVE-2022-0415
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
Affected Products: gogs/gogs
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284'}]
CVE State: PUBLISHED
Explain CVE-2022-0417
Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/fc86bc8d-c866-4ade-8b7f-e49cec306d1a'}, {'url': 'https://github.com/vim/vim/commit/652dee448618589de5528a9e9a36995803f5557a'}, {'name': 'FEDORA-2022-da2fb07efb', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/'}, {'name': 'FEDORA-2022-48bf3cb1c4', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/'}, {'name': '[debian-lts-announce] 20220620 [SECURITY] [DLA 3053-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0418
The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks against other admin even when the unfiltered_html is disallowed
Affected Products: Event List
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/74888a9f-fb75-443d-bb85-0120cbb764a0'}]
CVE State: PUBLISHED