alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-37959 (published 2022-09-13)
Network Device Enrollment Service (NDES) Security Feature Bypass Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37961 (published 2022-09-13)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: sharepoint_enterprise_server, sharepoint_foundation, sharepoint_server
CVE-2022-37962 (published 2022-09-13)
Microsoft PowerPoint Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-37963 (published 2022-09-13)
Microsoft Office Visio Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-37964 (published 2022-09-13)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_7, windows_server_2008
CVE-2022-37965 (published 2022-10-11)
Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37966 (published 2022-11-09)
Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: fedoraproject, microsoft, netapp, samba
Affected products: fedora, management_services_for_element_software, management_services_for_netapp_hci, samba, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37967 (published 2022-11-09)
Windows Kerberos Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: fedoraproject, microsoft, netapp, samba
Affected products: fedora, management_services_for_element_software, management_services_for_netapp_hci, samba, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37968 (published 2022-10-11)
Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: azure_arc-enabled_kubernetes, azure_stack_edge
CVE-2022-37969 (published 2022-09-13)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h1, windows_10_21h2, windows_11_21h2, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
Added to CISA KEV catalog: 2022-09-14
KEV required action: Apply updates per vendor instructions.
CVE-2022-3797 (published 2022-11-01)
A vulnerability was found in eolinker apinto-dashboard. It has been rated as problematic. This issue affects some unknown processing of the file /login. The manipulation of the argument callback leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212633 was assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: eolink
Affected products: apinto-dashboard
CVE-2022-37970 (published 2022-10-11)
Windows DWM Core Library Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022
CVE-2022-37971 (published 2022-10-11)
Microsoft Windows Defender Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Affected vendors: microsoft
Affected products: malware_protection_engine
CVE-2022-37972 (published 2022-09-20)
Microsoft Endpoint Configuration Manager Spoofing Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: microsoft
Affected products: endpoint_configuration_manager
CVE-2022-37973 (published 2022-10-11)
Windows Local Session Manager (LSM) Denial of Service Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2022
CVE-2022-37974 (published 2022-10-11)
Windows Mixed Reality Developer Tools Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11
CVE-2022-37975 (published 2022-10-11)
Windows Group Policy Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37976 (published 2022-10-11)
Active Directory Certificate Services Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37977 (published 2022-10-11)
Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37978 (published 2022-10-11)
Windows Active Directory Certificate Services Security Feature Bypass
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37979 (published 2022-10-11)
Windows Hyper-V Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-3798 (published 2022-11-01)
A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212634 is the identifier assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-707
Affected vendors: ibax
Affected products: go-ibax
CVE-2022-37980 (published 2022-10-11)
Windows DHCP Client Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2022
CVE-2022-37981 (published 2022-10-11)
Windows Event Logging Service Denial of Service Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37982 (published 2022-10-11)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37983 (published 2022-10-11)
Microsoft DWM Core Library Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022
CVE-2022-37984 (published 2022-10-11)
Windows WLAN Service Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37985 (published 2022-10-11)
Windows Graphics Component Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37986 (published 2022-10-11)
Windows Win32k Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37987 (published 2022-10-11)
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37988 (published 2022-10-11)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37989 (published 2022-10-11)
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-3799 (published 2022-11-01)
A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212635.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-707
Affected vendors: ibax
Affected products: go-ibax
CVE-2022-37990 (published 2022-10-11)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37991 (published 2022-10-11)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37992 (published 2022-11-09)
Windows Group Policy Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37993 (published 2022-10-11)
Windows Group Policy Preference Client Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37994 (published 2022-10-11)
Windows Group Policy Preference Client Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37995 (published 2022-10-11)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37996 (published 2022-10-11)
Windows Kernel Memory Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37997 (published 2022-10-11)
Windows Graphics Component Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-37998 (published 2022-10-11)
Windows Local Session Manager (LSM) Denial of Service Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2022
CVE-2022-37999 (published 2022-10-11)
Windows Group Policy Preference Client Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-3800 (published 2022-11-01)
A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212636.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-707
Affected vendors: ibax
Affected products: go-ibax
CVE-2022-38000 (published 2022-10-11)
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38001 (published 2022-10-11)
Microsoft Office Spoofing Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-38003 (published 2022-10-11)
Windows Resilient File System Elevation of Privilege
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38004 (published 2022-09-13)
Windows Fax Service Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38005 (published 2022-09-13)
Windows Print Spooler Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38006 (published 2022-09-13)
Windows Graphics Component Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38007 (published 2022-09-13)
Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: azure_arc, azure_guest_configuration
CVE-2022-38008 (published 2022-09-13)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: sharepoint_enterprise_server, sharepoint_foundation, sharepoint_server
CVE-2022-38009 (published 2022-09-13)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: sharepoint_enterprise_server, sharepoint_foundation, sharepoint_server
CVE-2022-3801 (published 2022-11-01)
A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212637 was assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-707
Affected vendors: ibax
Affected products: go-ibax
CVE-2022-38010 (published 2022-09-13)
Microsoft Office Visio Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel, visio
CVE-2022-38011 (published 2022-09-13)
Raw Image Extension Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: raw_image_extension, windows_10, windows_11
CVE-2022-38012 (published 2022-09-13)
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: edge_chromium
CVE-2022-38013 (published 2022-09-13)
.NET Core and Visual Studio Denial of Service Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: fedoraproject, microsoft
Affected products: .net, .net_core, fedora, visual_studio_2019, visual_studio_2022
CVE-2022-38014 (published 2022-11-09)
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: azure_iot_edge_for_linux, windows_subsystem_for_linux
CVE-2022-38015 (published 2022-11-09)
Windows Hyper-V Denial of Service Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38016 (published 2022-10-11)
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022
CVE-2022-38017 (published 2022-10-11)
StorSimple 8000 Series Elevation of Privilege Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: storsimple_8010, storsimple_8010_firmware, storsimple_8020, storsimple_8020_firmware
CVE-2022-38019 (published 2022-09-13)
AV1 Video Extension Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: av1_video_extension
CVE-2022-3802 (published 2022-11-01)
A vulnerability has been found in IBAX go-ibax and classified as critical. This vulnerability affects unknown code of the file /api/v2/open/rowsInfo. The manipulation of the argument where leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212638 is the identifier assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-707
Affected vendors: ibax
Affected products: go-ibax
CVE-2022-38020 (published 2022-09-13)
Visual Studio Code Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: visual_studio_code
CVE-2022-38021 (published 2022-10-11)
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38022 (published 2022-10-11)
Windows Kernel Elevation of Privilege Vulnerability
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38023 (published 2022-11-09)
Netlogon RPC Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: fedoraproject, microsoft, netapp, samba
Affected products: fedora, management_services_for_element_software, management_services_for_netapp_hci, samba, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38025 (published 2022-10-11)
Windows Distributed File System (DFS) Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_11, windows_server_2022
CVE-2022-38026 (published 2022-10-11)
Windows DHCP Client Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38027 (published 2022-10-11)
Windows Storage Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38028 (published 2022-10-11)
Windows Print Spooler Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10_1507, windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h1, windows_10_21h2, windows_11_22h2, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
Added to CISA KEV catalog: 2024-04-23
KEV required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2022-38029 (published 2022-10-11)
Windows ALPC Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-3803 (published 2022-11-01)
A vulnerability was found in eolinker apinto-dashboard and classified as problematic. This issue affects some unknown processing of the file /api/discoveries/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212639.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-707
Affected vendors: eolink
Affected products: apinto-dashboard
CVE-2022-38030 (published 2022-10-11)
Windows USB Serial Driver Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022
CVE-2022-38031 (published 2022-10-11)
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38032 (published 2022-10-11)
Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38033 (published 2022-10-11)
Windows Server Remotely Accessible Registry Keys Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38034 (published 2022-10-11)
Windows Workstation Service Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38036 (published 2022-10-11)
Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_11, windows_server_2022
CVE-2022-38037 (published 2022-10-11)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38038 (published 2022-10-11)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38039 (published 2022-10-11)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022
CVE-2022-3804 (published 2022-11-01)
A vulnerability was found in eolinker apinto-dashboard. It has been classified as problematic. Affected is an unknown function of the file /login. The manipulation of the argument callback leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212640.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-707
Affected vendors: eolink
Affected products: apinto-dashboard
CVE-2022-38040 (published 2022-10-11)
Microsoft ODBC Driver Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38041 (published 2022-10-11)
Windows Secure Channel Denial of Service Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38042 (published 2022-10-11)
Active Directory Domain Services Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38043 (published 2022-10-11)
Windows Security Support Provider Interface Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38044 (published 2022-10-11)
Windows CD-ROM File System Driver Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38045 (published 2022-10-11)
Windows Server Service Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38046 (published 2022-10-11)
Web Account Manager Information Disclosure Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022
CVE-2022-38047 (published 2022-10-11)
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38048 (published 2022-10-11)
Microsoft Office Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-38049 (published 2022-10-11)
Microsoft Office Graphics Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-3805 (published 2022-12-22)
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-639
Affected vendors: jegtheme
Affected products: jeg_elementor_kit
CVE-2022-38050 (published 2022-10-11)
Win32k Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022
CVE-2022-38051 (published 2022-10-11)
Windows Graphics Component Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-38053 (published 2022-10-11)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: sharepoint_enterprise_server, sharepoint_foundation, sharepoint_server
CVE-2022-38054 (published 2022-09-02)
In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-384
Affected vendors: apache
Affected products: airflow
CVE-2022-38055 (published 2024-06-21)
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in gVectors Team wpForo Forum allows Content Spoofing.This issue affects wpForo Forum: from n/a through 2.0.9.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-80
Affected vendors: gvectors
Affected products: wpforo_forum
CVE-2022-38056 (published 2023-02-16)
Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of privilege via network access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Affected vendors: intel
Affected products: endpoint_management_assistant
CVE-2022-38057 (published 2024-03-25)
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: themehunk
Affected products: th_advance_product_search
CVE-2022-38058 (published 2022-09-09)
Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-264
Affected vendors: wpvar
Affected products: wp_shamsi
CVE-2022-38059 (published 2022-09-09)
Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: access_code_feeder_project
Affected products: access_code_feeder
CVE-2022-3806 (published 2023-01-25)
Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-415
Affected vendors: zephyrproject
Affected products: zephyr
CVE-2022-38060 (published 2022-12-21)
A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: openstack
Affected products: kolla
CVE-2022-38061 (published 2022-09-23)
Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-1236
Affected vendors: apasionados
Affected products: export_post_info
CVE-2022-38062 (published 2023-07-17)
Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Theme plugin <= 1.0.9 versions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: metagauss
Affected products: download_theme
CVE-2022-38063 (published 2023-03-16)
Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin <= 5.0.0.0 versions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: social_login_wp_project
Affected products: social_login_wp
CVE-2022-38064 (published 2022-09-09)
OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-305
Affected vendors: openharmony
Affected products: openharmony
CVE-2022-38065 (published 2022-12-21)
A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality within tools leveraging this library within a container can lead increased privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: redhat
Affected products: openstack
CVE-2022-38066 (published 2023-01-26)
An OS command injection vulnerability exists in the httpd SNMP functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP response can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: siretta
Affected products: quartz-gold, quartz-gold_firmware
CVE-2022-38067 (published 2022-09-09)
Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-264
Affected vendors: total-soft
Affected products: event_calendar
CVE-2022-38068 (published 2022-09-09)
Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: apasionados
Affected products: export_post_info
CVE-2022-38069 (published 2022-09-13)
Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient information or modification of device parameters
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-798
Affected vendors: contechealth
Affected products: cms8000, cms8000_firmware
CVE-2022-3807 (published 2022-11-01)
A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Incomplete Fix CVE-2019-13238. The manipulation leads to resource consumption. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212660.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-404
Affected vendors: axiosys
Affected products: bento4
CVE-2022-38070 (published 2022-09-09)
Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-264
Affected vendors: mypopups
Affected products: pop-up
CVE-2022-38072 (published 2023-04-03)
An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-118
Affected vendors: admesh_project, slic3r
Affected products: admesh, libslic3r
CVE-2022-38073 (published 2022-09-21)
Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: getawesomesupport
Affected products: awesome_support
CVE-2022-38074 (published 2023-03-13)
SQL Injection vulnerability in VeronaLabs WP Statistics plugin <= 13.2.10 versions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: veronalabs
Affected products: wp_statistics
CVE-2022-38075 (published 2022-11-18)
Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: webartesanal
Affected products: mantenimiento_web
CVE-2022-38076 (published 2023-08-11)
Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: debian, fedoraproject, intel
Affected products: debian_linux, dual_band_wireless-ac_3165, dual_band_wireless-ac_3168, dual_band_wireless-ac_8260, dual_band_wireless-ac_8265, fedora, killer, killer_wireless-ac_1550, proset\/wireless_wifi, uefi_firmware, wireless-ac_9260, wireless-ac_9461, wireless-ac_9462, wireless-ac_9560, wireless_7265_\(rev_d\)
CVE-2022-38077 (published 2023-03-29)
Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything – A Marketing Popup and Lead Generation Conversions plugin <= 2.2.1 versions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: essentialplugin
Affected products: popup_anything
CVE-2022-38078 (published 2022-08-24)
Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and versions are as follows: Movable Type 7 r.5202 and earlier, Movable Type Advanced 7 r.5202 and earlier, Movable Type 6.8.6 and earlier, Movable Type Advanced 6.8.6 and earlier, Movable Type Premium 1.52 and earlier, and Movable Type Premium Advanced 1.52 and earlier. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: sixapart
Affected products: movable_type
CVE-2022-38079 (published 2022-09-23)
Cross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: backup_scheduler_project
Affected products: backup_scheduler
CVE-2022-38080 (published 2022-08-24)
Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: exceedone
Affected products: exment, laravel-admin
CVE-2022-38081 (published 2022-09-09)
OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-305
Affected vendors: openharmony
Affected products: openharmony