Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2022-0852
There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel.
Affected Products: convert2rhel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2060129'}, {'tags': ['x_refsource_MISC'], 'url': 'https://issues.redhat.com/browse/RHELC-432'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/oamg/convert2rhel/pull/492'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/oamg/convert2rhel/commit/8d72fb030ed31116fdb256b327d299337b000af4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-0852'}]
CVE State: PUBLISHED
Explain CVE-2022-0853
A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability.
Affected Products: jboss-client
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2060725'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/ByteHackr/CVE-2022-0853'}]
CVE State: PUBLISHED
Explain CVE-2022-0854
A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space.
Affected Products: Kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13'}, {'name': 'DSA-5161', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5161'}, {'name': '[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html'}, {'name': 'DSA-5173', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5173'}]
CVE State: PUBLISHED
Explain CVE-2022-0855
Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4.
Affected Products: microweber-dev/whmcs_plugin
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/511879b0-cdaa-4c03-af92-deb54d46284a'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber-dev/whmcs_plugin/commit/2e7a11d332db79cc52ccda00455a15f4dc6147ff'}]
CVE State: PUBLISHED
Explain CVE-2022-0857
A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in.
Affected Products: McAfee ePolicy Orchestrator (ePO)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10379'}]
CVE State: PUBLISHED
Explain CVE-2022-0858
A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in.
Affected Products: McAfee ePolicy Orchestrator (ePO)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10379'}]
CVE State: PUBLISHED
Explain CVE-2022-0859
McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password.
Affected Products: McAfee ePolicy Orchestrator (ePO)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10379'}]
CVE State: PUBLISHED
Explain CVE-2022-0860
Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2.
Affected Products: cobbler/cobbler
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa'}, {'name': 'FEDORA-2022-224e71968f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYWYHWVVRUSPCV5SWBOSAMQJQLTSBTKY/'}, {'name': 'FEDORA-2022-445ec90e7c', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4KCNZYBQC2FM5SEEDRQZO4LRZ4ZECMG/'}, {'name': 'FEDORA-2022-ad2b0ad61b', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYSHMF6MEIITFAG7EJ3IQKVUN7MDV2XM/'}]
CVE State: PUBLISHED
Explain CVE-2022-0861
A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data.
Affected Products: McAfee ePolicy Orchestrator (ePO)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10379'}]
CVE State: PUBLISHED
Explain CVE-2022-0862
A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session without knowing the existing user's password. This functionality was removed from the User Interface in ePO 10 and the API has now been disabled. Other protection is in place to reduce the likelihood of this being successful through sending a link to a logged in user.
Affected Products: McAfee ePolicy Orchestrator (ePO)
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10379'}]
CVE State: PUBLISHED
Explain CVE-2022-0863
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.
Affected Products: WP SVG Icons
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/a30212a0-c910-4657-aee1-4a2d72c77983'}]
CVE State: PUBLISHED
Explain CVE-2022-0864
The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability.
Affected Products: UpdraftPlus WordPress Backup Plugin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/166631/WordPress-UpdraftPlus-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0865
Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045.
Affected Products: libtiff
References: [{'url': 'https://gitlab.com/libtiff/libtiff/-/issues/385'}, {'url': 'https://gitlab.com/libtiff/libtiff/-/merge_requests/306'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0865.json'}, {'name': 'DSA-5108', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2022/dsa-5108'}, {'name': 'FEDORA-2022-e2996202a0', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/'}, {'name': 'FEDORA-2022-c39720a0ed', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/'}, {'name': 'GLSA-202210-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-10'}, {'url': 'https://security.netapp.com/advisory/ntap-20221228-0008/'}]
CVE State: PUBLISHED
Explain CVE-2022-0866
This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled.
Affected Products: Wildfly
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2060929#c0'}]
CVE State: PUBLISHED
Explain CVE-2022-0867
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users
Affected Products: Pricing Table Plugin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/62803aae-9896-410b-9398-3497a838e494'}]
CVE State: PUBLISHED
Explain CVE-2022-0868
Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.
Affected Products: medialize/uri.js
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/5f4db013-64bd-4a6b-9dad-870c296b0b02'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/medialize/uri.js/commit/a8166fe02f3af6dc1b2b888dcbb807155aad9509'}]
CVE State: PUBLISHED
Explain CVE-2022-0869
Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3.
Affected Products: nitely/spirit
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/ed335a88-f68c-4e4d-ac85-f29a51b03342'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef'}]
CVE State: PUBLISHED
Explain CVE-2022-0870
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
Affected Products: gogs/gogs
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb'}]
CVE State: PUBLISHED
Explain CVE-2022-0871
Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.
Affected Products: gogs/gogs
References: [{'url': 'https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62'}, {'url': 'https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78'}]
CVE State: PUBLISHED
Explain CVE-2022-0873
The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed
Affected Products: Gmedia Photo Gallery
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/d5ce4b8a-9aa5-4df8-b521-c2105990a87e'}]
CVE State: PUBLISHED
Explain CVE-2022-0874
The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Affected Products: WP Social Buttons
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/36cdd130-9bb7-4274-bac6-07d00008d810'}]
CVE State: PUBLISHED
Explain CVE-2022-0875
The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks
Affected Products: Google Authenticator
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/fefc1411-594d-465b-aeb9-78c141b23762'}]
CVE State: PUBLISHED
Explain CVE-2022-0876
The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when unfiltered_html is disallowed
Affected Products: Social comments by WpDevArt
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/73be6e92-ea37-4416-977d-52ee2afa022a'}]
CVE State: PUBLISHED
Explain CVE-2022-0877
Cross-site Scripting (XSS) - Stored in GitHub repository bookstackapp/bookstack prior to v22.02.3.
Affected Products: bookstackapp/bookstack
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/b04df4e3-ae5a-4dc6-81ec-496248b15f3c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/bookstackapp/bookstack/commit/856fca8289b7370cafa033ea21c408e7d4303fd6'}]
CVE State: PUBLISHED
Explain CVE-2022-0878
Electric Vehicle (EV) commonly utilises the Combined Charging System (CCS) for DC rapid charging. To exchange important messages such as the State of Charge (SoC) with the Electric Vehicle Supply Equipment (EVSE) CCS uses a high-bandwidth IP link provided by the HomePlug Green PHY (HPGP) power-line communication (PLC) technology. The attack interrupts necessary control communication between the vehicle and charger, causing charging sessions to abort. The attack can be conducted wirelessly from a distance using electromagnetic interference, allowing individual vehicles or entire fleets to be disrupted simultaneously. In addition, the attack can be mounted with off-the-shelf radio hardware and minimal technical knowledge. With a power budget of 1 W, the attack is successful from around 47 m distance. The exploited behavior is a required part of the HomePlug Green PHY, DIN 70121 & ISO 15118 standards and all known implementations exhibit it. In addition to electric cars, Brokenwire affects electric ships, airplanes and heavy duty vehicles utilising these standards.
Affected Products: Combined Charging System
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.brokenwire.fail/'}]
CVE State: PUBLISHED
Explain CVE-2022-0879
The Caldera Forms WordPress plugin before 1.9.7 does not validate and escape the cf-api parameter before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Affected Products: Caldera Forms – More Than Contact Forms
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/c12f6087-1875-4edf-ac32-bec6f712968d'}]
CVE State: PUBLISHED
Explain CVE-2022-0880
Cross-site Scripting (XSS) - Stored in GitHub repository star7th/showdoc prior to 2.10.2.
Affected Products: star7th/showdoc
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/df347aa9-ed9b-4f75-af99-c83b8aad3bcf'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/star7th/showdoc/commit/818d7fe731f452acccacf731ce47ec27ad68049c'}]
CVE State: PUBLISHED
Explain CVE-2022-0881
Insecure Storage of Sensitive Information in GitHub repository chocobozzz/peertube prior to 4.1.1.
Affected Products: chocobozzz/peertube
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/2628431e-6a98-4063-a0e3-a8b1d9ebaa9c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/chocobozzz/peertube/commit/0c058f256a195b92f124be10109c95d1fbe93ad8'}]
CVE State: PUBLISHED
Explain CVE-2022-0882
A bug exists where an attacker can read the kernel log through exposed Zircon kernel addresses without the required capability ZX_RSRC_KIND_ROOT. It is recommended to upgrade the Fuchsia kernel to 4.1.1 or greater.
Affected Products: Fuchsia Kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugs.fuchsia.dev/p/fuchsia/issues/detail?id=94740'}]
CVE State: PUBLISHED
Explain CVE-2022-0883
SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched.
Affected Products: Snow License Manager
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://community.snowsoftware.com/s/feed/0D5690000BsNCO6CQO'}]
CVE State: PUBLISHED
Explain CVE-2022-0884
The Profile Builder WordPress plugin before 3.6.8 does not sanitise and escape Form Fields titles and description, which could allow high privilege user such as admin to perform Criss-Site Scripting attacks even when unfiltered_html is disallowed
Affected Products: Profile Builder – User Profile & User Registration Forms
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/af06b96c-105f-429c-b2ad-c8c823897dba'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2690776'}]
CVE State: PUBLISHED
Explain CVE-2022-0885
The Member Hero WordPress plugin through 1.0.9 lacks authorization checks, and does not validate the a request parameter in an AJAX action, allowing unauthenticated users to call arbitrary PHP functions with no arguments.
Affected Products: Member Hero
References: [{'url': 'https://wpscan.com/vulnerability/8b08b72e-5584-4f25-ab73-5ab0f47412df', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0887
The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selected_icons attribute to the cnss_widget before using it in an SQL statement, leading to a SQL injection vulnerability.
Affected Products: Easy Social Icons
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/a6c1676d-9dcb-45f6-833a-9545bccd0ad6'}]
CVE State: PUBLISHED
Explain CVE-2022-0888
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0
Affected Products: Ninja Forms - File Uploads
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gist.github.com/Xib3rR4dAr/5f0accbbfdee279c68ed144da9cd8607'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0888'}]
CVE State: PUBLISHED
Explain CVE-2022-0889
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.
Affected Products: Ninja Forms - File Uploads Extension
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://ninjaforms.com/extensions/file-uploads/?changelog=1/#:~:text=3.3.13%20%2830%20November%202021%29'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wordfence.com/vulnerability-advisories/#CVE-2022-0889'}]
CVE State: PUBLISHED
Explain CVE-2022-0890
NULL Pointer Dereference in GitHub repository mruby/mruby prior to 3.2.
Affected Products: mruby/mruby
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/68e09ec1-6cc7-48b8-981d-30f478c70276'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/mruby/mruby/commit/da48e7dbb20024c198493b8724adae1b842083aa'}]
CVE State: PUBLISHED
Explain CVE-2022-0891
A heap buffer overflow in ExtractImageSection function in tiffcrop.c in libtiff library Version 4.3.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Affected Products: libtiff
References: [{'url': 'https://gitlab.com/libtiff/libtiff/-/issues/380'}, {'url': 'https://gitlab.com/libtiff/libtiff/-/issues/382'}, {'url': 'https://gitlab.com/freedesktop-sdk/mirrors/gitlab/libtiff/libtiff/-/commit/232282fd8f9c21eefe8d2d2b96cdbbb172fe7b7c'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0891.json'}, {'name': 'DSA-5108', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2022/dsa-5108'}, {'name': 'FEDORA-2022-e2996202a0', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/'}, {'name': 'FEDORA-2022-c39720a0ed', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/'}, {'name': 'GLSA-202210-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-10'}, {'url': 'https://security.netapp.com/advisory/ntap-20221228-0008/'}]
CVE State: PUBLISHED
Explain CVE-2022-0892
The Export All URLs WordPress plugin before 4.2 does not sanitise and escape the CSV filename before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Affected Products: Export All URLs
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/e5d95261-a243-493f-be6a-3c15ccb65435'}]
CVE State: PUBLISHED
Explain CVE-2022-0893
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/2859a1c1-941c-4efc-a3ad-a0657c7a77e9'}]
CVE State: PUBLISHED
Explain CVE-2022-0894
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/18f8e85e-3cbf-4915-b649-8cffe99daa95'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9'}]
CVE State: PUBLISHED
Explain CVE-2022-0895
Static Code Injection in GitHub repository microweber/microweber prior to 1.3.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/3c070828-fd00-476c-be33-9c877172363d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/b2baab6e582b2efe63788d367a2bb61a2fa26470'}]
CVE State: PUBLISHED
Explain CVE-2022-0896
Improper Neutralization of Special Elements Used in a Template Engine in GitHub repository microweber/microweber prior to 1.3.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/113056f1-7a78-4205-9f42-940ad41d8df0'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/e0224462b3dd6b1f7c6ec1197413afc6019bc3b5'}]
CVE State: PUBLISHED
Explain CVE-2022-0897
A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driver->nwfilters mutex before iterating over virNWFilterObj instances. There was no protection to stop another thread from concurrently modifying the driver->nwfilters object. This flaw allows a malicious, unprivileged user to exploit this issue via libvirt's API virConnectNumOfNWFilters to crash the network filter management daemon (libvirtd/virtnwfilterd).
Affected Products: libvirt
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2063883'}, {'name': 'GLSA-202210-06', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-06'}]
CVE State: PUBLISHED
Explain CVE-2022-0898
The IgniteUp WordPress plugin through 3.4.1 does not sanitise and escape some fields when high privilege users don't have the unfiltered_html capability, which could lead to Stored Cross-Site Scripting issues
Affected Products: IgniteUp – Coming Soon and Maintenance Mode
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/f51d8345-3927-4be2-8145-e201371c8c43'}]
CVE State: PUBLISHED
Explain CVE-2022-0899
The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.
Affected Products: Header Footer Code Manager
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/1772417a-1abb-4d97-9694-1254840defd1'}]
CVE State: PUBLISHED
Explain CVE-2022-0900
A Stored Cross-Site Scripting (XSS) vulnerability in DivvyDrive's "aciklama" parameter could allow anyone to gain users' session informations.


Affected Products: DivvyDrive
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.usom.gov.tr/bildirim/tr-22-0375'}]
CVE State: PUBLISHED
Explain CVE-2022-0901
The Ad Inserter Free and Pro WordPress plugins before 2.7.12 do not sanitise and escape the REQUEST_URI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters
Affected Products: Ad Inserter – Ad Manager & AdSense Ads
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/85582b4f-a40a-4394-9834-0c88c5dc57ba'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/166626/WordPress-Ad-Inserter-Cross-Site-Scripting.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0902
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-100-LITE, XIO, XFCG5 , XRCG5 , uFLOG5 , UDC) allows an attacker who successfully exploited this vulnerability could insert and run arbitrary code in an affected system node.
Affected Products: RMC-100 (Standard)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A0927&LanguageCode=en&DocumentPartId=&Action=Launch&_ga'}]
CVE State: PUBLISHED
Explain CVE-2022-0903
A call stack overflow bug in the SAML login feature in Mattermost server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted POST body.
Affected Products: Mattermost
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://mattermost.com/security-updates/'}]
CVE State: PUBLISHED
Explain CVE-2022-0904
A stack overflow bug in the document extractor in Mattermost Server in versions up to and including 6.3.2 allows an attacker to crash the server via submitting a maliciously crafted Apple Pages document.
Affected Products: Mattermost
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://mattermost.com/security-updates/'}]
CVE State: PUBLISHED
Explain CVE-2022-0905
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4.
Affected Products: go-gitea/gitea
References: [{'url': 'https://huntr.dev/bounties/8d221f92-b2b1-4878-bc31-66ff272e5ceb'}, {'url': 'https://github.com/go-gitea/gitea/commit/1314f38b59748397b3429fb9bc9f9d6bac85d2f2'}]
CVE State: PUBLISHED
Explain CVE-2022-0906
Unrestricted file upload leads to stored XSS in GitHub repository microweber/microweber prior to 1.1.12.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/87ed3b42-9824-49b0-91a5-fd908a0601e8'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/d9bae9df873c2d2a13a2eb08d512019d49ebca68'}]
CVE State: PUBLISHED
Explain CVE-2022-0907
Unchecked Return Value to NULL Pointer Dereference in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f2b656e2.
Affected Products: libtiff
References: [{'url': 'https://gitlab.com/libtiff/libtiff/-/issues/392'}, {'url': 'https://gitlab.com/libtiff/libtiff/-/merge_requests/314'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0907.json'}, {'name': 'DSA-5108', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2022/dsa-5108'}, {'name': 'FEDORA-2022-e2996202a0', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/'}, {'name': 'FEDORA-2022-c39720a0ed', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/'}, {'url': 'https://security.netapp.com/advisory/ntap-20220506-0002/'}, {'name': 'GLSA-202210-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-10'}]
CVE State: PUBLISHED
Explain CVE-2022-0908
Null source pointer passed as an argument to memcpy() function within TIFFFetchNormalTag () in tif_dirread.c in libtiff versions up to 4.3.0 could lead to Denial of Service via crafted TIFF file.
Affected Products: libtiff
References: [{'url': 'https://gitlab.com/libtiff/libtiff/-/issues/383'}, {'url': 'https://gitlab.com/libtiff/libtiff/-/commit/a95b799f65064e4ba2e2dfc206808f86faf93e85'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0908.json'}, {'name': 'DSA-5108', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2022/dsa-5108'}, {'name': 'FEDORA-2022-e2996202a0', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/'}, {'name': 'FEDORA-2022-c39720a0ed', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/'}, {'url': 'https://security.netapp.com/advisory/ntap-20220506-0002/'}, {'name': 'GLSA-202210-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-10'}]
CVE State: PUBLISHED
Explain CVE-2022-0909
Divide By Zero error in tiffcrop in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f8d0f9aa.
Affected Products: libtiff
References: [{'url': 'https://gitlab.com/libtiff/libtiff/-/issues/393'}, {'url': 'https://gitlab.com/libtiff/libtiff/-/merge_requests/310'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0909.json'}, {'name': 'DSA-5108', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2022/dsa-5108'}, {'name': 'FEDORA-2022-e2996202a0', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/'}, {'name': 'FEDORA-2022-c39720a0ed', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/'}, {'url': 'https://security.netapp.com/advisory/ntap-20220506-0002/'}, {'name': 'GLSA-202210-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-10'}]
CVE State: PUBLISHED
Explain CVE-2022-0910
A downgrade from two-factor authentication to one-factor authentication vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.32 through 4.71, USG FLEX series firmware versions 4.50 through 5.21, ATP series firmware versions 4.32 through 5.21, and VPN series firmware versions 4.32 through 5.21, that could allow an authenticated attacker to bypass the second authentication phase to connect the IPsec VPN server even though the two-factor authentication (2FA) was enabled.
Affected Products: USG/ZyWALL series firmware
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml'}]
CVE State: PUBLISHED
Explain CVE-2022-0911
Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
Affected Products: pimcore/pimcore
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/b242edb1-b036-4dca-9b53-891494dd7a77'}]
CVE State: PUBLISHED
Explain CVE-2022-0912
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/ae5bb359-7e53-498b-848e-540c05b44c54'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/24245297231f5dc88bb3a2b20d0e4e25b0ebc789'}]
CVE State: PUBLISHED
Explain CVE-2022-0913
Integer Overflow or Wraparound in GitHub repository microweber/microweber prior to 1.3.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/f5f3e468-663b-4df0-8340-a2d77e4cc75f'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/7559e141d0707f8eeff2f9aeaa5a0ca2e3fe6583'}]
CVE State: PUBLISHED
Explain CVE-2022-0914
The Export All URLs WordPress plugin before 4.3 does not have CSRF in place when exporting data, which could allow attackers to make a logged in admin export all posts and pages (including private and draft) into an arbitrary CSV file, which the attacker can then download and retrieve the list of titles for example
Affected Products: Export All URLs
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/c328be28-75dd-43db-a5b9-c1ba0636c930'}]
CVE State: PUBLISHED
Explain CVE-2022-0915
There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user.
Affected Products: Sync
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://prosupport.logi.com/hc/en-us/articles/360040085114-Download-Logitech-Sync'}]
CVE State: PUBLISHED
Explain CVE-2022-0916
An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations.
Affected Products: Options
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://support.logi.com/hc/en-us/articles/360025297893'}]
CVE State: PUBLISHED
Explain CVE-2022-0918
A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing.


Affected Products: 389-ds-base
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2055815'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-0918'}, {'tags': ['issue-tracking'], 'url': 'https://github.com/389ds/389-ds-base/issues/5242'}, {'url': 'https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0919
The Salon booking system Free and pro WordPress plugins before 7.6.3 do not have proper authorisation when searching bookings, allowing any unauthenticated users to search other's booking, as well as retrieve sensitive information about the bookings, such as the full name, email and phone number of the person who booked it.
Affected Products: Salon booking system
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/e8f32e0b-4a89-460b-bb78-7c83ef5e16b4'}]
CVE State: PUBLISHED
Explain CVE-2022-0920
The Salon booking system Free and Pro WordPress plugins before 7.6.3 do not have proper authorisation in some of its endpoints, which could allow customers to access all bookings and other customer's data
Affected Products: Salon booking system
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/5a5ab7a8-be67-4f70-925c-9cb1eff2fbe0'}]
CVE State: PUBLISHED
Explain CVE-2022-0921
Abusing Backup/Restore feature to achieve Remote Code Execution in GitHub repository microweber/microweber prior to 1.2.12.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/e368be37-1cb4-4292-8d48-07132725f622'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/867bdda1b4660b0795ad7f87ab5abe9e44b2b318'}]
CVE State: PUBLISHED
Explain CVE-2022-0923
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability that exists in HandlerDialog_KID.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
Affected Products: DIAEnergie
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01'}]
CVE State: PUBLISHED
Explain CVE-2022-0924
Out-of-bounds Read error in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 408976c4.
Affected Products: libtiff
References: [{'url': 'https://gitlab.com/libtiff/libtiff/-/issues/278'}, {'url': 'https://gitlab.com/libtiff/libtiff/-/merge_requests/311'}, {'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0924.json'}, {'name': 'DSA-5108', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2022/dsa-5108'}, {'name': 'FEDORA-2022-e2996202a0', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/'}, {'name': 'FEDORA-2022-c39720a0ed', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/'}, {'url': 'https://security.netapp.com/advisory/ntap-20220506-0002/'}, {'name': 'GLSA-202210-10', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-10'}]
CVE State: PUBLISHED
Explain CVE-2022-0926
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/dc5d1555-0108-4627-b542-93352f35fa17'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/89200cfcc2cfefe5554721e7fa3cf52f6a2a9120'}]
CVE State: PUBLISHED
Explain CVE-2022-0928
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.2.12.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/085aafdd-ba50-44c7-9650-fa573da29bcd'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/fc9137c031f7edec5f50d73b300919fb519c924a'}]
CVE State: PUBLISHED
Explain CVE-2022-0929
XSS on dynamic_text module in GitHub repository microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/66abf7ec-2dd7-4cb7-87f5-e91375883f03'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/de6d17b52d261902653fbdd2ecefcaac82e54256'}]
CVE State: PUBLISHED
Explain CVE-2022-0930
File upload filter bypass leading to stored XSS in GitHub repository microweber/microweber prior to 1.2.12.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/d184ce19-9608-42f1-bc3d-06ece2d9a993'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/33eb4cc0f80c1f86388c1862a8aee1061fa5d72e'}]
CVE State: PUBLISHED
Explain CVE-2022-0932
Missing Authorization in GitHub repository saleor/saleor prior to 3.1.2.
Affected Products: saleor/saleor
References: [{'url': 'https://huntr.dev/bounties/88ae4cbc-c697-401b-8b04-7dc4e03ad8eb'}, {'url': 'https://github.com/saleor/saleor/commit/521dfd6394f3926a77c60d8633c058e16d0f916d'}]
CVE State: PUBLISHED
Explain CVE-2022-0934
A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service.
Affected Products: dnsmasq
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2057075'}, {'tags': ['x_refsource_MISC'], 'url': 'https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2022q1/016272.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://thekelleys.org.uk/gitweb/?p=dnsmasq.git%3Ba=commit%3Bh=03345ecefeb0d82e3c3a4c28f27c3554f0611b39'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-0934'}]
CVE State: PUBLISHED
Explain CVE-2022-0935
Host Header injection in password Reset in GitHub repository livehelperchat/livehelperchat prior to 3.97.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/a7e40fdf-a333-4a50-8a53-d11b16ce3ec2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/ce96791cb4c7420266b668fc234c211914259ba7'}]
CVE State: PUBLISHED
Explain CVE-2022-0936
Cross-site Scripting (XSS) - Stored in GitHub repository autolab/autolab prior to 2.8.0.
Affected Products: autolab/autolab
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/90701766-bfed-409e-b3dd-6ff884373968'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/autolab/autolab/commit/02d76ab3737689bba95ffe9a1c69ca5166d71c6b'}]
CVE State: PUBLISHED
Explain CVE-2022-0937
Stored xss in showdoc through file upload in GitHub repository star7th/showdoc prior to 2.10.4.
Affected Products: star7th/showdoc
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/6127739d-f4f2-44cd-ae3d-e3ccb7f0d7b5'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/star7th/showdoc/commit/42c0d9813df3035728b36116a6ce9116e6fa8ed3'}]
CVE State: PUBLISHED
Explain CVE-2022-0938
Stored XSS via file upload in GitHub repository star7th/showdoc prior to v2.10.4.
Affected Products: star7th/showdoc
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/3eb5a8f9-24e3-4eae-a212-070b2fbc237e'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/star7th/showdoc/commit/830c89a4c2c5fd0dd491422bf8e97b4eb5713f55'}]
CVE State: PUBLISHED
Explain CVE-2022-0939
Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18.
Affected Products: janeczku/calibre-web
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/768fd7e2-a767-4d8d-a517-e9dda849c6e4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/janeczku/calibre-web/commit/4545f4a20d9ff90b99bbd4e3e34b6de4441d6367'}]
CVE State: PUBLISHED
Explain CVE-2022-0940
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
Affected Products: star7th/showdoc
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/856bd2e2-db4f-4b7d-9927-222261ae3782'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/star7th/showdoc/commit/78522520892d4e29cc94148c6ec84a204a607b73'}]
CVE State: PUBLISHED
Explain CVE-2022-0941
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to v2.10.4.
Affected Products: star7th/showdoc
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/040a910e-e689-4fcb-9e4f-95206515d1bc'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/star7th/showdoc/commit/4b6e6603c714aab1de346c5f5cb0bbb4c871be1f'}]
CVE State: PUBLISHED
Explain CVE-2022-0942
Stored XSS due to Unrestricted File Upload in GitHub repository star7th/showdoc prior to 2.10.4.
Affected Products: star7th/showdoc
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/star7th/showdoc/commit/3caa32334db0c277b84e993eaca2036f5d1dbef8'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/a412707c-18da-4c84-adc0-9801ed8068c9'}]
CVE State: PUBLISHED
Explain CVE-2022-0943
Heap-based Buffer Overflow occurs in vim in GitHub repository vim/vim prior to 8.2.4563.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/9e4de32f-ad5f-4830-b3ae-9467b5ab90a1'}, {'url': 'https://github.com/vim/vim/commit/5c68617d395f9d7b824f68475b24ce3e38d653a3'}, {'name': 'FEDORA-2022-b718ebbfce', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C3R36VSLO4TRX72SWB6IDJOD24BQXPX2/'}, {'name': 'FEDORA-2022-e62adccfca', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAIQTUO35U5WO2NYMY47637EMCVDJRSL/'}, {'name': '[debian-lts-announce] 20220620 [SECURITY] [DLA 3053-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'url': 'https://support.apple.com/kb/HT213488'}, {'name': '20221030 APPLE-SA-2022-10-27-5 Additional information for APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/41'}, {'name': '20221030 APPLE-SA-2022-10-24-2 macOS Ventura 13', 'tags': ['mailing-list'], 'url': 'http://seclists.org/fulldisclosure/2022/Oct/28'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0944
Template injection in connection test endpoint leads to RCE in GitHub repository sqlpad/sqlpad prior to 6.10.1.
Affected Products: sqlpad/sqlpad
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/46630727-d923-4444-a421-537ecd63e7fb'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/sqlpad/sqlpad/commit/3f92be386c6cd3e5eba75d85f0700d3ef54daf73'}]
CVE State: PUBLISHED