alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-3050 (published 2022-09-26)
Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: fedoraproject, google
Affected products: chrome, chrome_os, fedora
CVE-2022-30500 (published 2022-05-26)
Jfinal cms 5.1.0 is vulnerable to SQL Injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: jflyfox
Affected products: jfinal_cms
CVE-2022-30503 (published 2022-06-02)
Nginx NJS v0.7.2 was discovered to contain a segmentation violation in the function njs_set_number at src/njs_value.h.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: nginx
Affected products: njs
CVE-2022-30506 (published 2022-06-02)
An arbitrary file upload vulnerability was discovered in MCMS 5.2.7, allowing an attacker to execute arbitrary code through a crafted ZIP file.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: mingsoft
Affected products: mcms
CVE-2022-30508 (published 2022-05-26)
DedeCMS v5.7.93 was discovered to contain arbitrary file deletion vulnerability in upload.php via the delete parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-22
Affected vendors: dedecms
Affected products: dedecms
CVE-2022-3051 (published 2022-09-26)
Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: fedoraproject, google
Affected products: chrome, chrome_os, fedora, linux_and_chrome_os
CVE-2022-30510 (published 2022-06-02)
School Dormitory Management System 1.0 is vulnerable to SQL Injection via reports/daily_collection_report.php:59.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: school_dormitory_management_system_project
Affected products: school_dormitory_management_system
CVE-2022-30511 (published 2022-06-02)
School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/view_details.php:4.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: school_dormitory_management_system_project
Affected products: school_dormitory_management_system
CVE-2022-30512 (published 2022-06-02)
School Dormitory Management System 1.0 is vulnerable to SQL Injection via accounts/payment_history.php:31.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: school_dormitory_management_system_project
Affected products: school_dormitory_management_system
CVE-2022-30513 (published 2022-06-02)
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:125
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: school_dormitory_management_system_project
Affected products: school_dormitory_management_system
CVE-2022-30514 (published 2022-06-02)
School Dormitory Management System v1.0 is vulnerable to reflected cross-site scripting (XSS) via admin/inc/navigation.php:126.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: school_dormitory_management_system_project
Affected products: school_dormitory_management_system
CVE-2022-30515 (published 2022-11-08)
ZKTeco BioTime 8.5.4 is missing authentication on folders containing employee photos, allowing an attacker to view them through filename enumeration.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-306
Affected vendors: zkteco
Affected products: biotime
CVE-2022-30516 (published 2022-05-26)
In Hospital-Management-System v1.0, the editid parameter in the doctor.php page is vulnerable to SQL injection attacks.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: hospital_management_system_project
Affected products: hospital_management_system
CVE-2022-30517 (published 2022-07-12)
Mogu blog 5.2 is vulnerable to Cross Site Scripting (XSS).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: mogublog_project
Affected products: mogublog
CVE-2022-30518 (published 2022-05-20)
ChatBot Application with a Suggestion Feature 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /simple_chat_bot/admin/responses/view_response.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: chatbot_application_with_a_suggestion_feature_project
Affected products: chatbot_application_with_a_suggestion_feature
CVE-2022-30519 (published 2022-12-29)
XSS in signing form in Reprise Software RLM License Administration v14.2BL4 allows remote attacker to inject arbitrary code via password field.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: reprisesoftware
Affected products: reprise_license_manager
CVE-2022-3052 (published 2022-09-26)
Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: fedoraproject, google
Affected products: chrome, chrome_os, fedora, linux_and_chrome_os
CVE-2022-30521 (published 2022-06-02)
The LAN-side Web-Configuration Interface has Stack-based Buffer Overflow vulnerability in the D-Link Wi-Fi router firmware DIR-890L DIR890LA1_FW107b09.bin and previous versions. The function created at 0x17958 of /htdocs/cgibin will call sprintf without checking the length of strings in parameters given by HTTP header and can be controlled by users easily. The attackers can exploit the vulnerability to carry out arbitrary code by means of sending a specially constructed payload to port 49152.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: dlink
Affected products: dir-890l, dir-890l_firmware
CVE-2022-30522 (published 2022-06-09)
If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-789
Affected vendors: apache, fedoraproject, netapp
Affected products: clustered_data_ontap, fedora, http_server
CVE-2022-30523 (published 2022-05-16)
Trend Micro Password Manager (Consumer) version 5.0.0.1266 and below is vulnerable to a Link Following Privilege Escalation Vulnerability that could allow a low privileged local attacker to delete the contents of an arbitrary folder as SYSTEM which can then be used for privilege escalation on the affected machine.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-59
Affected vendors: trendmicro
Affected products: password_manager
CVE-2022-30524 (published 2022-05-09)
There is an invalid memory access in the TextLine class in TextOutputDev.cc in Xpdf 4.0.4 because the text extractor mishandles characters at large y coordinates. It can be triggered by (for example) sending a crafted pdf file to the pdftotext binary, which allows a remote attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: xpdfreader
Affected products: xpdf
CVE-2022-30525 (published 2022-05-12)
A OS command injection vulnerability in the CGI program of Zyxel USG FLEX 100(W) firmware versions 5.00 through 5.21 Patch 1, USG FLEX 200 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 500 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 700 firmware versions 5.00 through 5.21 Patch 1, USG FLEX 50(W) firmware versions 5.10 through 5.21 Patch 1, USG20(W)-VPN firmware versions 5.10 through 5.21 Patch 1, ATP series firmware versions 5.10 through 5.21 Patch 1, VPN series firmware versions 4.60 through 5.21 Patch 1, which could allow an attacker to modify specific files and then execute some OS commands on a vulnerable device.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: zyxel
Affected products: atp100, atp100_firmware, atp100w, atp100w_firmware, atp200, atp200_firmware, atp500, atp500_firmware, atp700, atp700_firmware, atp800, atp800_firmware, usg20w-vpn, usg20w-vpn_firmware, usg_flex_100w, usg_flex_100w_firmware, usg_flex_200, usg_flex_200_firmware, usg_flex_500, usg_flex_500_firmware, usg_flex_50w, usg_flex_50w_firmware, usg_flex_700, usg_flex_700_firmware, vpn100
Added to CISA KEV catalog: 2022-05-16
KEV required action: Apply updates per vendor instructions.
CVE-2022-30526 (published 2022-07-19)
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: zyxel
Affected products: atp100, atp100_firmware, atp100w, atp100w_firmware, atp200, atp200_firmware, atp500, atp500_firmware, atp700, atp700_firmware, atp800, atp800_firmware, usg20-vpn, usg20-vpn_firmware, usg20w-vpn, usg20w-vpn_firmware, usg40, usg40_firmware, usg40w, usg40w_firmware, usg60, usg60_firmware, usg60w, usg60w_firmware, usg_2200-vpn
CVE-2022-30527 (published 2023-10-10)
A vulnerability has been identified in SINEC NMS (All versions < V2.0). The affected application assigns improper access rights to specific folders containing executable files and libraries.

This could allow an authenticated local attacker to inject arbitrary code and escalate privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: siemens
Affected products: sinec_nms
CVE-2022-30528 (published 2022-12-01)
SQL Injection vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to execute arbitrary commands via the username parameter to /system/user/modules/mod_users/controller.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: isic.lk_project
Affected products: isic.lk
CVE-2022-30529 (published 2022-11-22)
File upload vulnerability in asith-eranga ISIC tour booking through version published on Feb 13th 2018, allows attackers to upload arbitrary files via /system/application/libs/js/tinymce/plugins/filemanager/dialog.php and /system/application/libs/js/tinymce/plugins/filemanager/upload.php.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: isic.lk_project
Affected products: isic.lk
CVE-2022-3053 (published 2022-09-26)
Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a remote attacker to restrict user navigation via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: apple, fedoraproject, google
Affected products: chrome, fedora, macos
CVE-2022-30530 (published 2023-02-16)
Protection mechanism failure in the Intel(R) DSA software before version 22.4.26 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: driver_\&_support_assistant
CVE-2022-30531 (published 2023-02-16)
Out-of-bounds read in the Intel(R) Iris(R) Xe MAX drivers for Windows before version 100.0.5.1474 may allow a privileged user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: intel, microsoft
Affected products: iris_xe_max_dedicated_graphics, windows
CVE-2022-30532 (published 2022-07-19)
In affected versions of Octopus Deploy, there is no logging of changes to artifacts within Octopus Deploy.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: linux, microsoft, octopus
Affected products: linux_kernel, octopus_server, windows
CVE-2022-30533 (published 2022-06-16)
Cross-site scripting vulnerability in Modern Events Calendar Lite versions prior to 6.3.0 allows remote an authenticated attacker to inject an arbitrary script via unspecified vectors.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: webnus
Affected products: modern_events_calendar_lite
CVE-2022-30534 (published 2022-08-22)
An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: wwbn
Affected products: avideo
CVE-2022-30535 (published 2022-08-04)
In versions 2.x before 2.3.0 and all versions of 1.x, An attacker authorized to create or update ingress objects can obtain the secrets available to the NGINX Ingress Controller. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: f5
Affected products: nginx_ingress_controller
CVE-2022-30536 (published 2022-07-21)
Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wp_maintenance_project
Affected products: wp_maintenance
CVE-2022-30538 (published 2022-06-16)
Out-of-bounds write vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: fujielectric
Affected products: monitouch_v-sft
CVE-2022-30539 (published 2023-02-16)
Use after free in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: intel
Affected products: xeon_gold_5315y, xeon_gold_5315y_firmware, xeon_gold_5317, xeon_gold_5317_firmware, xeon_gold_5318h, xeon_gold_5318h_firmware, xeon_gold_5318n, xeon_gold_5318n_firmware, xeon_gold_5318s, xeon_gold_5318s_firmware, xeon_gold_5318y, xeon_gold_5318y_firmware, xeon_gold_5320, xeon_gold_5320_firmware, xeon_gold_5320h, xeon_gold_5320h_firmware, xeon_gold_5320t, xeon_gold_5320t_firmware, xeon_gold_6312u, xeon_gold_6312u_firmware, xeon_gold_6314u, xeon_gold_6314u_firmware, xeon_gold_6326, xeon_gold_6326_firmware, xeon_gold_6328h
CVE-2022-3054 (published 2022-09-26)
Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2022-30540 (published 2022-06-02)
The affected product is vulnerable to a heap-based buffer overflow via uninitialized pointer, which may allow an attacker to execute arbitrary code
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-122
Affected vendors: hornerautomation
Affected products: cscape
CVE-2022-30541 (published 2022-10-25)
An OS command injection vulnerability exists in the XCMD setUPnP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: goabode
Affected products: iota_all-in-one_security_kit, iota_all-in-one_security_kit_firmware
CVE-2022-30542 (published 2022-11-11)
Improper input validation in the firmware for some Intel(R) Server Board S2600WF, Intel(R) Server System R1000WF and Intel(R) Server System R2000WF families before version R02.01.0014 may allow a privileged user to potentially enable an escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: r1000wf, r1000wf_firmware, r2000wf, r2000wf_firmware, s2600wf, s2600wf_firmware
CVE-2022-30543 (published 2022-11-09)
A leftover debug code vulnerability exists in the console infct functionality of InHand Networks InRouter302 V3.5.45. A specially-crafted series of network requests can lead to execution of privileged operations. An attacker can send a sequence of requests to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-489
Affected vendors: inhandnetworks
Affected products: ir302, ir302_firmware
CVE-2022-30544 (published 2023-01-17)
Cross-Site Request Forgery (CSRF) in MiKa's OSM – OpenStreetMap plugin <= 6.0.1 versions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: hyumika
Affected products: openstreetmap
CVE-2022-30545 (published 2022-11-08)
Auth. Reflected Cross-Site Scripting (XSS) vulnerability in 5 Anker Connect plugin <= 1.2.6 on WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: 5-anker
Affected products: 5_anker_connect
CVE-2022-30546 (published 2022-06-16)
Out-of-bounds read vulnerability exists in the simulator module contained in the graphic editor 'V-SFT' versions prior to v6.1.6.0, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: fujielectric
Affected products: monitouch_v-sft
CVE-2022-30547 (published 2022-08-22)
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can send an HTTP request to trigger this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: wwbn
Affected products: avideo
CVE-2022-30548 (published 2022-11-11)
Uncontrolled search path element in the Intel(R) Glorp software may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: intel
Affected products: glorp
CVE-2022-30549 (published 2022-06-16)
Out-of-bounds read vulnerability exists in V-Server v4.0.11.0 and earlier and V-Server Lite v4.0.13.0 and earlier, which may allow an attacker to obtain information and/or execute arbitrary code by having a user to open a specially crafted image file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-125
Affected vendors: fujielectric
Affected products: v-server
CVE-2022-3055 (published 2022-09-26)
Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2022-30550 (published 2022-07-17)
An issue was discovered in the auth component in Dovecot 2.2 and 2.3 before 2.3.20. When two passdb configuration entries exist with the same driver and args settings, incorrect username_filter and mechanism settings can be applied to passdb definitions. These incorrectly applied settings can lead to an unintended security configuration and can permit privilege escalation in certain configurations. The documentation does not advise against the use of passdb definitions that have the same driver and args settings. One such configuration would be where an administrator wishes to use the same PAM configuration or passwd file for both normal and master users but use the username_filter setting to restrict which of the users is able to be a master user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: debian, dovecot
Affected products: debian_linux, dovecot
CVE-2022-30551 (published 2022-05-20)
OPC UA Legacy Java Stack 2022-04-01 allows a remote attacker to cause a server to stop processing messages by sending crafted messages that exhaust available resources.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: opcfoundation
Affected products: ua-java
CVE-2022-30552 (published 2022-06-08)
Das U-Boot 2022.01 has a Buffer Overflow.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: denx
Affected products: u-boot
CVE-2022-30556 (published 2022-06-09)
Apache HTTP Server 2.4.53 and earlier may return lengths to applications calling r:wsread() that point past the end of the storage allocated for the buffer.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: apache, fedoraproject, netapp
Affected products: clustered_data_ontap, fedora, http_server
CVE-2022-30557 (published 2022-05-11)
Foxit PDF Reader and PDF Editor before 11.2.2 have a Type Confusion issue that causes a crash because of Unsigned32 mishandling during JavaScript execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-843
Affected vendors: foxit, microsoft
Affected products: pdf_editor, pdf_reader, windows
CVE-2022-3056 (published 2022-09-26)
Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-693
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2022-30560 (published 2022-06-28)
When an attacker obtaining the administrative account and password, or through a man-in-the-middle attack, the attacker could send a specified crafted packet to the vulnerable interface then lead the device to crash.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H)
Affected vendors: dahuasecurity
Affected products: asi7213x, asi7213x-t1, asi7213x-t1_firmware, asi7213x_firmware, asi7223x-a, asi7223x-a-t1, asi7223x-a-t1_firmware, asi7223x-a_firmware, ipc-hdbw2230e-s-s2, ipc-hdbw2230e-s-s2_firmware, ipc-hdbw2231e-s-s2, ipc-hdbw2231e-s-s2_firmware, ipc-hdbw2231f-as-s2, ipc-hdbw2231f-as-s2_firmware, ipc-hdbw2231r-zas-s2, ipc-hdbw2231r-zas-s2_firmware, ipc-hdbw2231r-zs-s2, ipc-hdbw2231r-zs-s2_firmware, ipc-hdbw2431e-s-s2, ipc-hdbw2431e-s-s2_firmware, ipc-hdbw2431r-zas-s2, ipc-hdbw2431r-zas-s2_firmware, ipc-hdbw2431r-zs-s2, ipc-hdbw2431r-zs-s2_firmware, ipc-hdbw2531e-s-s2
CVE-2022-30561 (published 2022-06-28)
When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in, the attacker could log in to the device by replaying the user's login packet.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: dahuasecurity
Affected products: asi7213x, asi7213x-t1, asi7213x-t1_firmware, asi7213x_firmware, asi7223x-a, asi7223x-a-t1, asi7223x-a-t1_firmware, asi7223x-a_firmware, ipc-hdbw2230e-s-s2, ipc-hdbw2230e-s-s2_firmware, ipc-hdbw2231e-s-s2, ipc-hdbw2231e-s-s2_firmware, ipc-hdbw2231f-as-s2, ipc-hdbw2231f-as-s2_firmware, ipc-hdbw2231r-zas-s2, ipc-hdbw2231r-zas-s2_firmware, ipc-hdbw2231r-zs-s2, ipc-hdbw2231r-zs-s2_firmware, ipc-hdbw2431e-s-s2, ipc-hdbw2431e-s-s2_firmware, ipc-hdbw2431r-zas-s2, ipc-hdbw2431r-zas-s2_firmware, ipc-hdbw2431r-zs-s2, ipc-hdbw2431r-zs-s2_firmware, ipc-hdbw2531e-s-s2
CVE-2022-30562 (published 2022-06-28)
If the user enables the https function on the device, an attacker can modify the user’s request data packet through a man-in-the-middle attack ,Injection of a malicious URL in the Host: header of the HTTP Request results in a 302 redirect to an attacker-controlled page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: dahuasecurity
Affected products: asi7213x, asi7213x-t1, asi7213x-t1_firmware, asi7213x_firmware, asi7223x-a, asi7223x-a-t1, asi7223x-a-t1_firmware, asi7223x-a_firmware, ipc-hdbw2230e-s-s2, ipc-hdbw2230e-s-s2_firmware, ipc-hdbw2231e-s-s2, ipc-hdbw2231e-s-s2_firmware, ipc-hdbw2231f-as-s2, ipc-hdbw2231f-as-s2_firmware, ipc-hdbw2231r-zas-s2, ipc-hdbw2231r-zas-s2_firmware, ipc-hdbw2231r-zs-s2, ipc-hdbw2231r-zs-s2_firmware, ipc-hdbw2431e-s-s2, ipc-hdbw2431e-s-s2_firmware, ipc-hdbw2431r-zas-s2, ipc-hdbw2431r-zas-s2_firmware, ipc-hdbw2431r-zs-s2, ipc-hdbw2431r-zs-s2_firmware, ipc-hdbw2531e-s-s2
CVE-2022-30563 (published 2022-06-28)
When an attacker uses a man-in-the-middle attack to sniff the request packets with success logging in through ONVIF, he can log in to the device by replaying the user's login packet.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Affected vendors: dahuasecurity
Affected products: asi7213x, asi7213x-t1, asi7213x-t1_firmware, asi7213x_firmware, asi7223x-a, asi7223x-a-t1, asi7223x-a-t1_firmware, asi7223x-a_firmware, ipc-hdbw2230e-s-s2, ipc-hdbw2230e-s-s2_firmware, ipc-hdbw2231e-s-s2, ipc-hdbw2231e-s-s2_firmware, ipc-hdbw2231f-as-s2, ipc-hdbw2231f-as-s2_firmware, ipc-hdbw2231r-zas-s2, ipc-hdbw2231r-zas-s2_firmware, ipc-hdbw2231r-zs-s2, ipc-hdbw2231r-zs-s2_firmware, ipc-hdbw2431e-s-s2, ipc-hdbw2431e-s-s2_firmware, ipc-hdbw2431r-zas-s2, ipc-hdbw2431r-zas-s2_firmware, ipc-hdbw2431r-zs-s2, ipc-hdbw2431r-zs-s2_firmware, ipc-hdbw2531e-s-s2
CVE-2022-30564 (published 2023-02-09)
Some Dahua embedded products have a vulnerability of unauthorized modification of the device timestamp. By sending a specially crafted packet to the vulnerable interface, an attacker can modify the device system time.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-284
Affected vendors: dahuasecurity
Affected products: ipc-hf5241f-ze, ipc-hf5241f-ze_firmware, ipc-hf5442f-ze, ipc-hf5442f-ze_firmware, ipc-hf5541f-ze, ipc-hf5541f-ze_firmware, ipc-hf5842f-ze, ipc-hf5842f-ze_firmware, ipc-hf71242f-z-x, ipc-hf71242f-z-x_firmware, ipc-hf7442f-z-x, ipc-hf7442f-z-x_firmware, ipc-hf7842f-z-x, ipc-hf7842f-z-x_firmware, nvr2104-i, nvr2104-i_firmware, nvr2104hs-i, nvr2104hs-i_firmware, nvr2108-i, nvr2108-i_firmware, nvr2108hs-i, nvr2108hs-i_firmware, nvr2116-i, nvr2116-i_firmware, nvr2116hs-i
CVE-2022-3057 (published 2022-09-26)
Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2022-30570 (published 2022-07-19)
The Column Based Security component of TIBCO Software Inc.'s TIBCO Data Virtualization and TIBCO Data Virtualization for AWS Marketplace contains an easily exploitable vulnerability that allows a low privileged attacker with network access to obtain read access to application information on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Data Virtualization: versions 8.5.2 and below and TIBCO Data Virtualization for AWS Marketplace: versions 8.5.2 and below.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: tibco
Affected products: data_virtualization, data_virtualization_for_aws_marketplace
CVE-2022-30571 (published 2022-08-02)
The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO iWay Service Manager: versions 8.0.6 and below.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tibco
Affected products: iway_service_manager
CVE-2022-30572 (published 2022-08-02)
The iWay Service Manager Console component of TIBCO Software Inc.'s TIBCO iWay Service Manager contains an easily exploitable Directory Traversal vulnerability that allows a low privileged attacker with network access to read arbitrary resources on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO iWay Service Manager: versions 8.0.6 and below.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: tibco
Affected products: iway_service_manager
CVE-2022-30573 (published 2022-08-09)
The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, and TIBCO FTL - Enterprise Edition contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a privilege escalation on the affected ftlserver. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO FTL - Enterprise Edition: version 6.8.0.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: tibco
Affected products: ftl
CVE-2022-30574 (published 2022-08-09)
The ftlserver component of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIBCO FTL - Developer Edition, TIBCO FTL - Enterprise Edition, TIBCO FTL - Enterprise Edition, TIBCO eFTL - Community Edition, TIBCO eFTL - Developer Edition, TIBCO eFTL - Enterprise Edition, and TIBCO eFTL - Enterprise Edition contains a difficult to exploit vulnerability that allows a low privileged attacker with local access to obtain user credentials to the affected system. Affected releases are TIBCO Software Inc.'s TIBCO FTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO FTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO FTL - Enterprise Edition: versions 6.0.0 through 6.7.3, TIBCO FTL - Enterprise Edition: version 6.8.0, TIBCO eFTL - Community Edition: versions 6.0.0 through 6.8.0, TIBCO eFTL - Developer Edition: versions 6.0.1 through 6.8.0, TIBCO eFTL - Enterprise Edition: versions 6.0.0 through 6.7.3, and TIBCO eFTL - Enterprise Edition: version 6.8.0.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: tibco
Affected products: eftl, ftl
CVE-2022-30575 (published 2022-08-16)
The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Trial contains easily exploitable Reflected Cross Site Scripting (XSS) vulnerabilities that allow a low privileged attacker with network access to execute scripts targeting the affected system or the victim's local system. Affected releases are TIBCO Software Inc.'s TIBCO Data Science - Workbench: versions 14.0.0 and below, TIBCO Statistica: versions 14.0.0 and below, TIBCO Statistica - Estore Edition: versions 14.0.0 and below, and TIBCO Statistica Trial: versions 14.0.0 and below.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tibco
Affected products: data_science_-_workbench, statistica
CVE-2022-30576 (published 2022-08-16)
The Web Console component of TIBCO Software Inc.'s TIBCO Data Science - Workbench, TIBCO Statistica, TIBCO Statistica - Estore Edition, and TIBCO Statistica Trial contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO Data Science - Workbench: versions 14.0.0 and below, TIBCO Statistica: versions 14.0.0 and below, TIBCO Statistica - Estore Edition: versions 14.0.0 and below, and TIBCO Statistica Trial: versions 14.0.0 and below.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: tibco
Affected products: data_science_-_workbench, statistica
CVE-2022-30577 (published 2022-09-21)
The Web Server component of TIBCO Software Inc.'s TIBCO EBX contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO EBX: versions 6.0.0 through 6.0.8.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: tibco
Affected products: ebx
CVE-2022-30578 (published 2022-09-21)
The Web Server component of TIBCO Software Inc.'s TIBCO EBX Add-ons contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute Stored Cross Site Scripting (XSS) on the affected system. A successful attack using this vulnerability requires human interaction from a person other than the attacker. Affected releases are TIBCO Software Inc.'s TIBCO EBX Add-ons: versions 5.4.1 and below.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: tibco
Affected products: ebx_add-ons
CVE-2022-30579 (published 2022-09-20)
The Web Player component of TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace and TIBCO Spotfire Server contains a difficult to exploit vulnerability that allows a low privileged attacker with network access to execute blind Server Side Request Forgery (SSRF) on the affected system. Affected releases are TIBCO Software Inc.'s TIBCO Spotfire Analytics Platform for AWS Marketplace: version 12.0.0 and TIBCO Spotfire Server: version 12.0.0.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L)
Weakness: CWE-918
Affected vendors: tibco
Affected products: spotfire_analytics_platform, spotfire_server
CVE-2022-3058 (published 2022-09-26)
Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: fedoraproject, google
Affected products: chrome, fedora
CVE-2022-30580 (published 2022-08-10)
Code injection in Cmd.Start in os/exec before Go 1.17.11 and Go 1.18.3 allows execution of any binaries in the working directory named either "..com" or "..exe" by calling Cmd.Run, Cmd.Start, Cmd.Output, or Cmd.CombinedOutput when Cmd.Path is unset.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: golang
Affected products: go
CVE-2022-30584 (published 2022-05-26)
Archer Platform 6.3 before 6.11 (6.11.0.0) contains an Improper Access Control Vulnerability within SSO ADFS functionality that could potentially be exploited by malicious users to compromise the affected system. 6.10 P3 (6.10.0.3) and 6.9 SP3 P4 (6.9.3.4) are also fixed releases.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: rsa
Affected products: archer
CVE-2022-30585 (published 2022-05-26)
The REST API in Archer Platform 6.x before 6.11 (6.11.0.0) contains an Authorization Bypass Vulnerability. A remote authenticated malicious user could potentially exploit this vulnerability to view sensitive information. 6.10 P3 (6.10.0.3) and 6.9 SP3 P4 (6.9.3.4) are also fixed releases.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: rsa
Affected products: archer
CVE-2022-30586 (published 2022-06-06)
Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-200
Affected vendors: gradle
Affected products: gradle
CVE-2022-30587 (published 2022-06-06)
Gradle Enterprise through 2022.2.2 has Incorrect Access Control that leads to information disclosure.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: gradle
Affected products: gradle_enterprise
CVE-2022-3059 (published 2022-10-31)

The application was vulnerable to multiple instances of SQL injection (authenticated and unauthenticated) through a vulnerable parameter. Due to the stacked query support, complex SQL commands could be crafted and injected into the vulnerable parameter and using a sleep based inferential SQL injection it was possible to extract data from the database.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-89
Affected vendors: schoolbox
Affected products: schoolbox
CVE-2022-30591 (published 2022-07-06)
quic-go through 0.27.0 allows remote attackers to cause a denial of service (CPU consumption) via a Slowloris variant in which incomplete QUIC or HTTP/3 requests are sent. This occurs because mtu_discoverer.go misparses the MTU Discovery service and consequently overflows the probe timer. NOTE: the vendor's position is that this behavior should not be listed as a vulnerability on the CVE List
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: quic-go_project
Affected products: quic-go
CVE-2022-30592 (published 2022-05-11)
liblsquic/lsquic_qenc_hdl.c in LiteSpeed QUIC (aka LSQUIC) before 3.1.0 mishandles MAX_TABLE_CAPACITY.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-476
Affected vendors: litespeedtech
Affected products: lsquic
CVE-2022-30594 (published 2022-05-12)
The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: debian, linux, netapp
Affected products: 8300, 8300_firmware, 8700, 8700_firmware, a400, a400_firmware, debian_linux, h300s, h300s_firmware, h410c, h410c_firmware, h410s, h410s_firmware, h500s, h500s_firmware, h700s, h700s_firmware, hci_compute_node, linux_kernel, solidfire\,_enterprise_sds_\&_hci_storage_node, solidfire_\&_hci_management_node
CVE-2022-30595 (published 2022-05-25)
libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: python
Affected products: pillow
CVE-2022-30596 (published 2022-05-18)
A flaw was found in moodle where ID numbers displayed when bulk allocating markers to assignments required additional sanitizing to prevent a stored XSS risk.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: fedoraproject, moodle, redhat
Affected products: enterprise_linux, fedora, moodle
CVE-2022-30597 (published 2022-05-18)
A flaw was found in moodle where the description user field was not hidden when being set as a hidden user field.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-472
Affected vendors: fedoraproject, moodle, redhat
Affected products: enterprise_linux, fedora, moodle
CVE-2022-30598 (published 2022-05-18)
A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: fedoraproject, moodle, redhat
Affected products: enterprise_linux, fedora, moodle
CVE-2022-30599 (published 2022-05-18)
A flaw was found in moodle where an SQL injection risk was identified in Badges code relating to configuring criteria.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: fedoraproject, moodle, redhat
Affected products: enterprise_linux, fedora, moodle
CVE-2022-3060 (published 2022-10-17)
Improper control of a resource identifier in Error Tracking in GitLab CE/EE affecting all versions from 12.7 allows an authenticated attacker to generate content which could cause a victim to make unintended arbitrary requests
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N)
Weakness: CWE-22
Affected vendors: gitlab
Affected products: gitlab
CVE-2022-30600 (published 2022-05-18)
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-682
Affected vendors: fedoraproject, moodle, redhat
Affected products: enterprise_linux, fedora, moodle
CVE-2022-30601 (published 2022-08-18)
Insufficiently protected credentials for Intel(R) AMT and Intel(R) Standard Manageability may allow an unauthenticated user to potentially enable information disclosure and escalation of privilege via network access.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-522
Affected vendors: intel
Affected products: active_management_technology_firmware, standard_manageability
CVE-2022-30602 (published 2022-07-11)
Operation restriction bypass in multiple applications of Cybozu Garoon 4.0.0 to 5.9.1 allows a remote authenticated attacker to alter the file information and/or delete the files.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Affected vendors: cybozu
Affected products: garoon
CVE-2022-30603 (published 2022-10-25)
An OS command injection vulnerability exists in the web interface /action/iperf functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: goabode
Affected products: iota_all-in-one_security_kit, iota_all-in-one_security_kit_firmware
CVE-2022-30604 (published 2022-08-18)
Cross-site scripting vulnerability in the specific parameters of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cybozu
Affected products: office
CVE-2022-30605 (published 2022-08-22)
A privilege escalation vulnerability exists in the session id functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to increased privileges. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-384
Affected vendors: wwbn
Affected products: avideo
CVE-2022-30607 (published 2022-06-17)
IBM Robotic Process Automation 20.10.0, 20.12.5, 21.0.0, 21.0.1, and 21.0.2 contains a vulnerability that could allow a user to obtain sensitive information due to information properly masked in the control center UI. IBM X-Force ID: 227294.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: ibm, microsoft
Affected products: robotic_process_automation, windows
CVE-2022-30608 (published 2022-11-03)
"IBM InfoSphere Information Server 11.7 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a "user that the website trusts. IBM X-Force ID: 227295.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: ibm, linux, microsoft
Affected products: aix, infosphere_information_server, linux_kernel, windows
CVE-2022-3061 (published 2022-09-01)
Found Linux Kernel flaw in the i740 driver. The Userspace program could pass any values to the driver through ioctl() interface. The driver doesn't check the value of 'pixclock', so it may cause a divide by zero error.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-369
Affected vendors: debian, linux
Affected products: debian_linux, linux_kernel
CVE-2022-30610 (published 2022-06-10)
IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 is vulnerable to reverse tabnabbing where it could allow a page linked to from within IBM Spectrum Copy Data Management to rewrite it. An administrator could enter a link to a malicious URL that another administrator could then click. Once clicked, that malicious URL could then rewrite the original page with a phishing page. IBM X-Force ID: 227363.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-269
Affected vendors: ibm, linux
Affected products: linux_kernel, spectrum_copy_data_management