alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-47983 (published 2023-02-01)
IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  243161.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ibm, linux, microsoft
Affected products: aix, infosphere_information_server, linux_kernel, windows
CVE-2022-47984 (published 2023-05-19)
IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.  IBM X-Force ID:  243163.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: ibm, linux, microsoft
Affected products: aix, infosphere_information_server, linux_kernel, windows
CVE-2022-47986 (published 2023-02-17)
IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: ibm, linux, microsoft
Affected products: aspera_faspex, linux_kernel, windows
Added to CISA KEV catalog: 2023-02-21
KEV required action: Apply updates per vendor instructions.
CVE-2022-4799 (published 2022-12-28)
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Weakness: CWE-639
Affected vendors: usememos
Affected products: memos
CVE-2022-47990 (published 2023-01-18)

IBM AIX 7.1, 7.2, 7.3 and VIOS , 3.1 could allow a non-privileged local user to exploit a vulnerability in X11 to cause a buffer overflow that could result in a denial of service or arbitrary code execution. IBM X-Force ID: 243556.

 
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: ibm
Affected products: aix, vios
CVE-2022-4800 (published 2022-12-28)
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-940
Affected vendors: usememos
Affected products: memos
CVE-2022-48006 (published 2023-01-30)
An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploited via manipulation of the upext variable at /include/Model/Upload.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: taogogo
Affected products: taocms
CVE-2022-48007 (published 2023-01-27)
A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: piwigo
Affected products: piwigo
CVE-2022-48008 (published 2023-01-27)
An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: limesurvey
Affected products: limesurvey
CVE-2022-4801 (published 2022-12-28)
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-1220
Affected vendors: usememos
Affected products: memos
CVE-2022-48010 (published 2023-01-27)
LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. NOTE: the vendor indicates that this is not a vulnerability because the manipulation requires Superadministrator privileges, and Superadministrators are already allowed to customize surveys with JavaScript as they wish.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: limesurvey
Affected products: limesurvey
CVE-2022-48011 (published 2023-01-27)
Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: opencats
Affected products: opencats
CVE-2022-48012 (published 2023-01-27)
Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: opencats
Affected products: opencats
CVE-2022-48013 (published 2023-01-27)
Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: opencats
Affected products: opencats
CVE-2022-48019 (published 2023-02-06)
The components wfshbr64.sys and wfshbr32.sys in Another Eden before v3.0.20 and before v2.14.200 allows attackers to perform privilege escalation via a crafted payload.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: wfs
Affected products: another_eden
CVE-2022-4802 (published 2022-12-28)
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-639
Affected vendors: usememos
Affected products: memos
CVE-2022-48020 (published 2023-05-12)
Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. This vulnerability allows attackers to inject arbitrary code which will be executed by the victim user's browser.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: vinteo
Affected products: video_core
CVE-2022-48021 (published 2023-02-03)
A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: zammad
Affected products: zammad
CVE-2022-48022 (published 2023-02-03)
An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: zammad
Affected products: zammad
CVE-2022-48023 (published 2023-02-03)
Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. This is now corrected in v5.3.1 so that only agents with write permissions may change ticket tags.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Affected vendors: zammad
Affected products: zammad
CVE-2022-4803 (published 2022-12-28)
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-639
Affected vendors: usememos
Affected products: memos
CVE-2022-4804 (published 2022-12-28)
Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-285
Affected vendors: usememos
Affected products: memos
CVE-2022-4805 (published 2022-12-28)
Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-648
Affected vendors: usememos
Affected products: memos
CVE-2022-4806 (published 2022-12-28)
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-639
Affected vendors: usememos
Affected products: memos
CVE-2022-48063 (published 2023-08-22)
GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: gnu
Affected products: binutils
CVE-2022-48064 (published 2023-08-22)
GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: fedoraproject, gnu, netapp
Affected products: binutils, fedora, ontap_select_deploy_administration_utility
CVE-2022-48065 (published 2023-08-22)
GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: fedoraproject, gnu, netapp
Affected products: binutils, fedora, ontap_select_deploy_administration_utility
CVE-2022-48066 (published 2023-01-27)
An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: totolink
Affected products: a830r, a830r_firmware
CVE-2022-48067 (published 2023-01-27)
An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-798
Affected vendors: totolink
Affected products: a830r, a830r_firmware
CVE-2022-48069 (published 2023-01-27)
Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-78
Affected vendors: totolink
Affected products: a830r, a830r_firmware
CVE-2022-4807 (published 2022-12-28)
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-284
Affected vendors: usememos
Affected products: memos
CVE-2022-48070 (published 2023-01-27)
Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: phicomm
Affected products: k2, k2_firmware
CVE-2022-48071 (published 2023-01-27)
Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-312
Affected vendors: phicomm
Affected products: k2, k2_firmware
CVE-2022-48072 (published 2023-01-27)
Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: phicomm
Affected products: k2, k2_firmware
CVE-2022-48073 (published 2023-01-27)
Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-312
Affected vendors: phicomm
Affected products: k2, k2_firmware
CVE-2022-48074 (published 2023-02-03)
An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Affected vendors: nomachine
Affected products: nomachine
CVE-2022-48077 (published 2023-02-13)
Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: genymotion
Affected products: genymotion_desktop
CVE-2022-48078 (published 2023-02-06)
pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: pycdc_project
Affected products: pycdc
CVE-2022-48079 (published 2023-02-02)
Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: mengnai
Affected products: aapanel_host_system
CVE-2022-4808 (published 2022-12-28)
Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: usememos
Affected products: memos
CVE-2022-48082 (published 2023-02-02)
Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: easyone
Affected products: easyone_crm
CVE-2022-48085 (published 2023-02-06)
Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: softr
Affected products: softr
CVE-2022-4809 (published 2022-12-28)
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: usememos
Affected products: memos
CVE-2022-48090 (published 2023-01-13)
Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-89
Affected vendors: hotel_management_system_project
Affected products: hotel_management_system
CVE-2022-48091 (published 2023-01-13)
Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hotel_management_system_project
Affected products: hotel_management_system
CVE-2022-48093 (published 2023-02-01)
Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: seacms
Affected products: seacms
CVE-2022-48094 (published 2023-02-01)
lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-552
Affected vendors: lmxcms
Affected products: lmxcms
CVE-2022-4810 (published 2022-12-28)
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-284
Affected vendors: usememos
Affected products: memos
CVE-2022-48107 (published 2023-01-27)
D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: dlink
Affected products: dir_878, dir_878_firmware
CVE-2022-48108 (published 2023-01-27)
D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: dlink
Affected products: dir_878, dir_878_firmware
CVE-2022-4811 (published 2022-12-28)
Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-639
Affected vendors: usememos
Affected products: memos
CVE-2022-48110 (published 2023-02-13)
CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ckeditor
Affected products: ckeditor
CVE-2022-48111 (published 2023-03-10)
A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: siri-informatica
Affected products: wi400
CVE-2022-48113 (published 2023-02-02)
A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: totolink
Affected products: n200re-v5, n200re-v5_firmware
CVE-2022-48114 (published 2023-02-02)
RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: ruoyi
Affected products: ruoyi
CVE-2022-48115 (published 2023-02-17)
The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jspreadsheet
Affected products: jspreadsheet
CVE-2022-48116 (published 2023-01-27)
AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: ayacms_project
Affected products: ayacms
CVE-2022-48118 (published 2023-01-27)
Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jorani
Affected products: jorani
CVE-2022-4812 (published 2022-12-28)
Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-639
Affected vendors: usememos
Affected products: memos
CVE-2022-48120 (published 2023-01-20)
SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers to execute arbitrary commands via the contact and doctor parameters to /search.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: hospital_management_system_project
Affected products: hospital_management_system
CVE-2022-48121 (published 2023-01-20)
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: totolink
Affected products: a7100ru, a7100ru_firmware
CVE-2022-48122 (published 2023-01-20)
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: totolink
Affected products: a7100ru, a7100ru_firmware
CVE-2022-48123 (published 2023-01-20)
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: totolink
Affected products: a7100ru, a7100ru_firmware
CVE-2022-48124 (published 2023-01-20)
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: totolink
Affected products: a7100ru, a7100ru_firmware
CVE-2022-48125 (published 2023-01-20)
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: totolink
Affected products: a7100ru, a7100ru_firmware
CVE-2022-48126 (published 2023-01-20)
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: totolink
Affected products: a7100ru, a7100ru_firmware
CVE-2022-4813 (published 2022-12-28)
Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-1220
Affected vendors: usememos
Affected products: memos
CVE-2022-48130 (published 2023-02-02)
Tenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNet, staticRouteMask, staticRouteGateway, staticRouteWAN.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: tenda
Affected products: w20e, w20e_firmware
CVE-2022-4814 (published 2022-12-28)
Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-284
Affected vendors: usememos
Affected products: memos
CVE-2022-48140 (published 2023-02-02)
DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dedecms
Affected products: dedecms
CVE-2022-48149 (published 2023-02-22)
Online Student Admission System in PHP Free Source Code 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: online_student_admission_system_project
Affected products: online_student_admission_system
CVE-2022-4815 (published 2023-05-24)

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods. 


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: hitachi
Affected products: vantara_pentaho, vantara_pentaho_business_analytics_server
CVE-2022-48150 (published 2023-04-21)
Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: shopware
Affected products: shopware
CVE-2022-48152 (published 2023-01-20)
SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicines/profile.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: remoteclinic
Affected products: remote_clinic
CVE-2022-4816 (published 2023-01-23)
A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: lenovo
Affected products: safecenter
CVE-2022-48161 (published 2023-02-01)
Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-552
Affected vendors: easy_images_project
Affected products: easy_images
CVE-2022-48164 (published 2023-02-06)
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: wavlink
Affected products: wl-wn533a8, wl-wn533a8_firmware
CVE-2022-48165 (published 2023-02-03)
An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: wavlink
Affected products: wl-wn530h4, wl-wn530h4_firmware
CVE-2022-48166 (published 2023-02-06)
An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: wavlink
Affected products: wl-wn530hg4, wl-wn530hg4_firmware
CVE-2022-4817 (published 2022-12-28)
A vulnerability was found in centic9 jgit-cookbook. It has been declared as problematic. This vulnerability affects unknown code. The manipulation leads to insecure temporary file. The attack can be initiated remotely. The name of the patch is b8cb29b43dc704708d598c60ac1881db7cf8e9c3. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216988.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-377
Affected vendors: jgit-cookbook_project
Affected products: jgit-cookbook
CVE-2022-48174 (published 2023-08-22)
There is a stack overflow vulnerability in ash.c:6030 in busybox before 1.35. In the environment of Internet of Vehicles, this vulnerability can be executed from command to arbitrary code execution.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: busybox, debian
Affected products: busybox, debian_linux
CVE-2022-48175 (published 2023-01-30)
Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: rukovoditel
Affected products: rukovoditel
CVE-2022-48176 (published 2023-01-31)
Netgear routers R7000P before v1.3.3.154, R6900P before v1.3.3.154, R7960P before v1.4.4.94, and R8000P before v1.4.4.94 were discovered to contain a pre-authentication stack overflow.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: netgear
Affected products: mr60, mr60_firmware, ms60, ms60_firmware, r6900p, r6900p_firmware, r7000p, r7000p_firmware, r7960p, r7960p_firmware, r8000p, r8000p_firmware
CVE-2022-48177 (published 2023-04-15)
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importModels Import Records Model field (model parameter). This vulnerability allows attackers to create malicious JavaScript that will be executed by the victim user's browser.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: x2engine
Affected products: x2crm
CVE-2022-48178 (published 2023-04-15)
X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action function, aka an index.php/actions/update URI.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: x2engine
Affected products: x2crm
CVE-2022-4818 (published 2022-12-28)
A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file org.talend.mdm.core/src/com/amalto/core/storage/SystemStorageWrapper.java. The manipulation leads to xml external entity reference. Upgrading to version 20221220_1938 is able to address this issue. The name of the patch is 95590db2ad6a582c371273ceab1a73ad6ed47853. It is recommended to upgrade the affected component. The identifier VDB-216997 was assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-611
Affected vendors: talend
Affected products: open_studio_for_mdm
CVE-2022-48181 (published 2023-06-05)
An ErrorMessage driver stack-based buffer overflow vulnerability in BIOS of some ThinkPad models could allow an attacker with local access to elevate their privileges and execute arbitrary code.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: lenovo
Affected products: ideacentre_3-07ada05, ideacentre_3-07ada05_firmware, ideacentre_3-07imb05, ideacentre_3-07imb05_firmware, ideacentre_3_07ach7, ideacentre_3_07ach7_firmware, ideacentre_3_07iab7, ideacentre_3_07iab7_firmware, ideacentre_5-14acn6, ideacentre_5-14acn6_firmware, ideacentre_5-14are05, ideacentre_5-14are05_firmware, ideacentre_5-14imb05, ideacentre_5-14imb05_firmware, ideacentre_5-14iob6, ideacentre_5-14iob6_firmware, ideacentre_510s-07icb, ideacentre_510s-07icb_firmware, ideacentre_510s-07ick, ideacentre_510s-07ick_firmware, ideacentre_5_14iab7, ideacentre_5_14iab7_firmware, ideacentre_720-18apr, ideacentre_720-18apr_firmware, ideacentre_aio_3-22imb05
CVE-2022-48182 (published 2023-10-09)

A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. 


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1263
Affected vendors: lenovo, linux, microsoft
Affected products: linux_kernel, thinkpad_t14s_gen_3, thinkpad_t14s_gen_3_firmware, thinkpad_x13_gen_3, thinkpad_x13_gen_3_firmware, windows
CVE-2022-48183 (published 2023-10-09)

A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under specific circumstances which could allow unauthorized access. 


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1263
Affected vendors: lenovo, linux, microsoft
Affected products: linux_kernel, thinkpad_t14s_gen_3, thinkpad_t14s_gen_3_firmware, thinkpad_x13_gen_3, thinkpad_x13_gen_3_firmware, windows
CVE-2022-48186 (published 2023-05-01)
A certificate validation vulnerability exists in the Baiying Android application which could lead to information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-295
Affected vendors: lenovo
Affected products: baiying
CVE-2022-48188 (published 2023-06-05)
A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: lenovo
Affected products: ideacentre_510s-07icb, ideacentre_510s-07icb_firmware, ideacentre_510s-07ick, ideacentre_510s-07ick_firmware, ideacentre_720-18apr, ideacentre_720-18apr_firmware, ideacentre_aio_3-22itl6, ideacentre_aio_3-22itl6_firmware, ideacentre_aio_3-24itl6, ideacentre_aio_3-24itl6_firmware, ideacentre_aio_3-27itl6, ideacentre_aio_3-27itl6_firmware, ideacentre_aio_3_21itl7, ideacentre_aio_3_21itl7_firmware, thinkcentre_m720e, thinkcentre_m720e_firmware, thinkcentre_m720q, thinkcentre_m720q_firmware, thinkcentre_m720s, thinkcentre_m720s_firmware, thinkcentre_m720t, thinkcentre_m720t_firmware, thinkcentre_m725s, thinkcentre_m725s_firmware, thinkcentre_m75s_gen_2
CVE-2022-48189 (published 2023-10-30)
An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code. 
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: lenovo
Affected products: thinkpad_e14, thinkpad_e14_firmware, thinkpad_e14_gen_2, thinkpad_e14_gen_2_firmware, thinkpad_e14_gen_4, thinkpad_e14_gen_4_firmware, thinkpad_e15, thinkpad_e15_firmware, thinkpad_e15_gen_2, thinkpad_e15_gen_2_firmware, thinkpad_e15_gen_4, thinkpad_e15_gen_4_firmware, thinkpad_e490, thinkpad_e490_firmware, thinkpad_e490s, thinkpad_e490s_firmware, thinkpad_e590, thinkpad_e590_firmware, thinkpad_l13_gen_3, thinkpad_l13_gen_3_firmware, thinkpad_l13_yoga_gen_3, thinkpad_l13_yoga_gen_3_firmware, thinkpad_l14, thinkpad_l14_firmware, thinkpad_l15
CVE-2022-4819 (published 2022-12-28)
A vulnerability was found in HotCRP. It has been rated as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. The name of the patch is d4ffdb0ef806453c54ddca7fdda3e5c60356285c. It is recommended to apply a patch to fix this issue. VDB-216998 is the identifier assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: hotcrp
Affected products: hotcrp
CVE-2022-48191 (published 2023-01-20)
A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known malicious executable to a specific location and in the process of removal and restoral an attacker could replace an original folder with a mount point to an arbitrary location, allowing a escalation of privileges on an affected system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: microsoft, trendmicro
Affected products: maximum_security_2022, windows
CVE-2022-48192 (published 2023-11-06)
Cross-site Scripting vulnerability in Softing smartLink SW-HT before 1.30, which allows an attacker to execute a dynamic script (JavaScript, VBScript) in the context of the application.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: softing
Affected products: smartlink_sw-ht
CVE-2022-48193 (published 2023-11-06)
Weak ciphers in Softing smartLink SW-HT before 1.30 are enabled during secure communication (SSL).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-326
Affected vendors: softing
Affected products: smartlink_sw-ht
CVE-2022-48194 (published 2022-12-30)
TP-Link TL-WR902AC devices through V3 0.9.1 allow remote authenticated attackers to execute arbitrary code or cause a Denial of Service (DoS) by uploading a crafted firmware update because the signature check is inadequate.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: tp-link
Affected products: tl-wr902ac, tl-wr902ac_firmware
CVE-2022-48195 (published 2022-12-31)
An issue was discovered in Mellium mellium.im/sasl before 0.3.1. When performing SCRAM-based SASL authentication, if the remote end advertises support for channel binding, no random nonce is generated (instead, the nonce is empty). This causes authentication to fail in the best case, but (if paired with a remote end that does not validate the length of the nonce) could lead to insufficient randomness being used during authentication.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: mellium
Affected products: sasl
CVE-2022-48196 (published 2022-12-30)
Certain NETGEAR devices are affected by a buffer overflow by an unauthenticated attacker. This affects RAX40 before 1.0.2.60, RAX35 before 1.0.2.60, R6400v2 before 1.0.4.122, R6700v3 before 1.0.4.122, R6900P before 1.3.3.152, R7000P before 1.3.3.152, R7000 before 1.0.11.136, R7960P before 1.4.4.94, and R8000P before 1.4.4.94.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: netgear
Affected products: r6400v2, r6400v2_firmware, r6700v3, r6700v3_firmware, r6900p, r6900p_firmware, r7000, r7000_firmware, r7000p, r7000p_firmware, r7960p, r7960p_firmware, r8000p, r8000p_firmware, rax35, rax35_firmware, rax40, rax40_firmware
CVE-2022-48197 (published 2023-01-02)
Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository. The download distributions, TreeView component and the YUI Javascript library overall are not affected. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: yui_project
Affected products: yui
CVE-2022-48198 (published 2023-01-01)
The ntpd_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled time_ref_topic parameter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-668
Affected vendors: ntpd_driver_project, openrobotics
Affected products: ntpd_driver, robot_operating_system
CVE-2022-48199 (published 2023-01-26)
SoftPerfect NetWorx 7.1.1 on Windows allows an attacker to execute a malicious binary with potentially higher privileges via a low-privileged user account that abuses the Notifications function. The Notifications function allows for arbitrary binary execution and can be modified by any user. The resulting binary execution will occur in the context of any user running NetWorx. If an attacker modifies the Notifications function to execute a malicious binary, the binary will be executed by every user running NetWorx on that system.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: microsoft, softperfect
Affected products: networx, windows
CVE-2022-4820 (published 2022-12-28)
A vulnerability classified as problematic has been found in FlatPress. This affects an unknown part of the file admin/panels/entry/admin.entry.list.php of the component Admin Area. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is 229752b51025e678370298284d42f8ebb231f67f. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216999.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: flatpress
Affected products: flatpress
CVE-2022-4821 (published 2022-12-28)
A vulnerability classified as problematic was found in FlatPress. This vulnerability affects the function onupload of the file admin/panels/uploader/admin.uploader.php of the component XML File Handler/MD File Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 3cc223dec5260e533a84b5cf5780d3a4fbf21241. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-217000.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: flatpress
Affected products: flatpress
CVE-2022-48216 (published 2023-01-04)
Uniswap Universal Router before 1.1.0 mishandles reentrancy. This would have allowed theft of funds.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-667
Affected vendors: uniswap
Affected products: universal_router, universal_router_firmware
CVE-2022-48217 (published 2023-01-04)
The tf_remapper_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in the same ROS application, to change a robot's behavior. This occurs because a topic name depends on the attacker-controlled old_tf_topic_name and/or new_tf_topic_name parameter. NOTE: the vendor's position is "it is the responsibility of the programmer to make sure that only known and required parameters are set and unexpected parameters are not."
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-75
Affected vendors: tradr-project
Affected products: tf_remapper
CVE-2022-48219 (published 2024-02-14)
Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these potential vulnerabilities.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)
Weakness: CWE-693
Affected vendors: hp
Affected products: elite_mini_600_g9, elite_mini_600_g9_firmware, elite_mini_800_g9, elite_mini_800_g9_firmware, elite_sff_600_g9, elite_sff_600_g9_firmware, elite_sff_800_g9, elite_sff_800_g9_firmware, elite_tower_600_g9, elite_tower_600_g9_firmware, elite_tower_680_g9, elite_tower_680_g9_firmware, elite_tower_800_g9, elite_tower_800_g9_firmware, elite_tower_880_g9, elite_tower_880_g9_firmware, elitedesk_800_g8_desktop_mini, elitedesk_800_g8_desktop_mini_firmware, elitedesk_800_g8_small_form_factor, elitedesk_800_g8_small_form_factor_firmware, elitedesk_800_g8_tower, elitedesk_800_g8_tower_firmware, elitedesk_880_g8_tower, elitedesk_880_g8_tower_firmware, eliteone_800_g8_24_all-in-one
CVE-2022-4822 (published 2022-12-28)
A vulnerability, which was classified as problematic, has been found in FlatPress. This issue affects some unknown processing of the file setup/lib/main.lib.php of the component Setup. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 5f23b4c2eac294cc0ba5e541f83a6f8a26f9fed1. It is recommended to apply a patch to fix this issue. The identifier VDB-217001 was assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: flatpress
Affected products: flatpress
CVE-2022-48220 (published 2024-02-14)
Potential vulnerabilities have been identified in certain HP Desktop PC products using the HP TamperLock feature, which might allow intrusion detection bypass via a physical attack. HP is releasing firmware and guidance to mitigate these potential vulnerabilities.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)
Weakness: CWE-203
Affected vendors: hp
Affected products: elite_mini_600_g9, elite_mini_600_g9_firmware, elite_mini_800_g9, elite_mini_800_g9_firmware, elite_sff_600_g9, elite_sff_600_g9_firmware, elite_sff_800_g9, elite_sff_800_g9_firmware, elite_tower_600_g9, elite_tower_600_g9_firmware, elite_tower_680_g9, elite_tower_680_g9_firmware, elite_tower_800_g9, elite_tower_800_g9_firmware, elite_tower_880_g9, elite_tower_880_g9_firmware, elitedesk_800_g8_desktop_mini, elitedesk_800_g8_desktop_mini_firmware, elitedesk_800_g8_small_form_factor, elitedesk_800_g8_small_form_factor_firmware, elitedesk_800_g8_tower, elitedesk_800_g8_tower_firmware, elitedesk_880_g8_tower, elitedesk_880_g8_tower_firmware, eliteone_800_g8_24_all-in-one
CVE-2022-48221 (published 2023-04-04)
An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. Multiple MSI's get executed out of a standard-user writable directory. Through a race condition and OpLock manipulation, these files can be overwritten by a standard user. They then get executed by the elevated installer. This gives a standard user full SYSTEM code execution (elevation of privileges).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: gbgplc
Affected products: acuant_acufill_sdk
CVE-2022-48222 (published 2023-04-04)
An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK installation, certutil.exe is called by the Acuant installer to install certificates. This window is not hidden, and is running with elevated privileges. A standard user can break out of this window, obtaining a full SYSTEM command prompt window. This results in complete compromise via arbitrary SYSTEM code execution (elevation of privileges).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: gbgplc
Affected products: acuant_acufill_sdk