alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-20951 (published 2022-11-04)
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an authenticated, remote attacker to perform a server-side request forgery (SSRF) attack on an affected device.
 This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to obtain confidential information from the BroadWorks server and other device on the network.
    
  {{value}} ["%7b%7bvalue%7d%7d"])}]]

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-918
Affected vendors: cisco
Affected products: broadworks_messaging_server
CVE-2022-20952 (published 2023-03-01)
A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance, formerly known as Cisco Web Security Appliance (WSA), could allow an unauthenticated, remote attacker to bypass a configured rule, thereby allowing traffic onto a network that should have been blocked.
 This vulnerability exists because malformed, encoded traffic is not properly detected. An attacker could exploit this vulnerability by connecting through an affected device to a malicious server and receiving malformed HTTP responses. A successful exploit could allow the attacker to bypass an explicit block rule and receive traffic that should have been rejected by the device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-20
Affected vendors: cisco
Affected products: asyncos, s195, s395, s695
CVE-2022-20953 (published 2022-10-26)
Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: cisco
Affected products: roomos, telepresence_collaboration_endpoint
CVE-2022-20954 (published 2022-10-26)
Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-200
Affected vendors: cisco
Affected products: roomos, telepresence_collaboration_endpoint
CVE-2022-20955 (published 2022-10-26)
Multiple vulnerabilities in Cisco TelePresence Collaboration Endpoint (CE) Software and Cisco RoomOS Software could allow an attacker to conduct path traversal attacks, view sensitive data, or write arbitrary files on an affected device. For more information about these vulnerabilities, see the Details section of this advisory.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-200
Affected vendors: cisco
Affected products: roomos, telepresence_collaboration_endpoint
CVE-2022-20956 (published 2022-11-04)
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to bypass authorization and access system files.
 This vulnerability is due to improper access control in the web-based management interface of an affected device. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. A successful exploit could allow the attacker to list, download, and delete certain files that they should not have access to.
 Cisco plans to release software updates that address this vulnerability.  
  https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-access-contol-EeufSUCx ["https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-ise-access-contol-EeufSUCx"]

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-648
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2022-20958 (published 2022-11-04)
A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot application could allow an unauthenticated, remote attacker to perform a server-side request forgery (SSRF) attack on an affected device.
 This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending a crafted HTTP request to the web interface. A successful exploit could allow the attacker to obtain confidential information from the BroadWorks server and other device on the network.
    
  {{value}} ["%7b%7bvalue%7d%7d"])}]]

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-36
Affected vendors: cisco
Affected products: broadworks_commpilot_application
CVE-2022-20959 (published 2022-10-26)
A vulnerability in the External RESTful Services (ERS) API of Cisco Identity Services Engine (ISE) Software could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the interface of an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by persuading an authenticated administrator of the web-based management interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2022-20960 (published 2022-11-04)
A vulnerability in Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticated remote attacker to cause a denial of service (DoS) condition on an affected device.
 This vulnerability is due to improper handling of certain TLS connections that are processed by an affected device. An attacker could exploit this vulnerability by establishing a large number of concurrent TLS connections to an affected device. A successful exploit could allow the attacker to cause the device to drop new TLS email messages that come from the associated email servers. Exploitation of this vulnerability does not cause the affected device to unexpectedly reload. The device will recover autonomously within a few hours of when the attack is halted or mitigated.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: cisco
Affected products: email_security_appliance
CVE-2022-20961 (published 2022-11-04)
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF) attack and perform arbitrary actions on an affected device.
 This vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected device. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected device with the privileges of the target user.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2022-20962 (published 2022-11-04)
A vulnerability in the Localdisk Management feature of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to make unauthorized changes to the file system of an affected device.
 This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending a crafted HTTP request with absolute path sequences. A successful exploit could allow the attacker to upload malicious files to arbitrary locations within the file system. Using this method, it is possible to access the underlying operating system and execute commands with system privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-37
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2022-20963 (published 2022-11-04)
A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of an affected device.
 This vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected device. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information. To exploit this vulnerability, the attacker would need valid credentials to access the web-based management interface of an affected device.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-87
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2022-20964 (published 2023-01-20)
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system.
 This vulnerability is due to improper validation of user input within requests as part of the web-based management interface. An attacker could exploit this vulnerability by manipulating requests to the web-based management interface to contain operating system commands. A successful exploit could allow the attacker to execute arbitrary operating system commands on the underlying operating system with the privileges of the web services user.
 Cisco has not yet released software updates that address this vulnerability. 
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2022-20965 (published 2023-01-20)
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to take privileges actions within the web-based management interface.
 This vulnerability is due to improper access control on a feature within the web-based management interface of the affected system. An attacker could exploit this vulnerability by accessing features through direct requests, bypassing checks within the application. A successful exploit could allow the attacker to take privileged actions within the web-based management interface that should be otherwise restricted.
    
  {{value}} ["%7b%7bvalue%7d%7d"])}]]

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-648
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2022-20966 (published 2023-01-20)
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface.
 This vulnerability is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this vulnerability by creating entries within the application interface that contain malicious HTML or script code. A successful exploit could allow the attacker to store malicious HTML or script code within the application interface for use in further cross-site scripting attacks.
 Cisco has not yet released software updates that address this vulnerability. 
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2022-20967 (published 2023-01-20)
A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface.
 This vulnerability is due to improper validation of input to an application feature before storage within the web-based management interface. An attacker could exploit this vulnerability by creating entries within the application interface that contain malicious HTML or script code. A successful exploit could allow the attacker to store malicious HTML or script code within the application interface for use in further cross-site scripting attacks.
 Cisco has not yet released software updates that address this vulnerability. 
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: identity_services_engine
CVE-2022-20968 (published 2022-12-12)
A vulnerability in the Cisco Discovery Protocol processing feature of Cisco IP Phone 7800 and 8800 Series firmware could allow an unauthenticated, adjacent attacker to cause a stack overflow on an affected device.

This vulnerability is due to insufficient input validation of received Cisco Discovery Protocol packets. An attacker could exploit this vulnerability by sending crafted Cisco Discovery Protocol traffic to an affected device. A successful exploit could allow the attacker to cause a stack overflow, resulting in possible remote code execution or a denial of service (DoS) condition on an affected device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: cisco
Affected products: ip_phone_7811, ip_phone_7811_firmware, ip_phone_7821, ip_phone_7821_firmware, ip_phone_7832, ip_phone_7832_firmware, ip_phone_7841, ip_phone_7841_firmware, ip_phone_7861, ip_phone_7861_firmware, ip_phone_8811, ip_phone_8811_firmware, ip_phone_8831, ip_phone_8831_firmware, ip_phone_8832, ip_phone_8832_firmware, ip_phone_8841, ip_phone_8841_firmware, ip_phone_8845, ip_phone_8845_firmware, ip_phone_8851, ip_phone_8851_firmware, ip_phone_8861, ip_phone_8861_firmware, ip_phone_8865
CVE-2022-20969 (published 2022-11-04)
A vulnerability in multiple management dashboard pages of Cisco Umbrella could allow an authenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the Cisco Umbrella dashboard.
 This vulnerability is due to unsanitized user input. An attacker could exploit this vulnerability by submitting custom JavaScript to the web application and persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the interface or access sensitive browser-based information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cisco
Affected products: umbrella
CVE-2022-2097 (published 2022-07-05)
AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances. This could reveal sixteen bytes of data that was preexisting in the memory that wasn't written. In the special case of "in place" encryption, sixteen bytes of the plaintext would be revealed. Since OpenSSL does not support OCB based cipher suites for TLS and DTLS, they are both unaffected. Fixed in OpenSSL 3.0.5 (Affected 3.0.0-3.0.4). Fixed in OpenSSL 1.1.1q (Affected 1.1.1-1.1.1p).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-327
Affected vendors: debian, fedoraproject, netapp, openssl, siemens
Affected products: active_iq_unified_manager, clustered_data_ontap_antivirus_connector, debian_linux, fedora, h300s_firmware, h410c, h410c_firmware, h410s, h410s_firmware, h500s, h500s_firmware, h700s, h700s_firmware, openssl, sinec_ins
CVE-2022-2098 (published 2022-06-16)
Weak Password Requirements in GitHub repository kromitgmbh/titra prior to 0.78.1.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-521
Affected vendors: kromit
Affected products: titra
CVE-2022-2099 (published 2022-07-17)
The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-116
Affected vendors: woocommerce
Affected products: woocommerce
CVE-2022-2100 (published 2022-07-17)
The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wpzinc
Affected products: page_generator
CVE-2022-2101 (published 2022-07-18)
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file's page that will execute whenever an administrator accesses the editor area for the injected file page.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: w3eden
Affected products: download_manager
CVE-2022-2102 (published 2022-06-24)
Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-841
Affected vendors: secheron
Affected products: sepcos_control_and_protection_relay, sepcos_control_and_protection_relay_firmware
CVE-2022-2103 (published 2022-06-24)
An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-284
Affected vendors: secheron
Affected products: sepcos_control_and_protection_relay, sepcos_control_and_protection_relay_firmware
CVE-2022-2104 (published 2022-06-24)
The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: secheron
Affected products: sepcos_control_and_protection_relay, sepcos_control_and_protection_relay_firmware
CVE-2022-2105 (published 2022-06-24)
Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-841
Affected vendors: secheron
Affected products: sepcos_control_and_protection_relay, sepcos_control_and_protection_relay_firmware
CVE-2022-2106 (published 2022-06-27)
Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-23
Affected vendors: smartics
Affected products: smartics
CVE-2022-2107 (published 2022-07-20)
The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-798
Affected vendors: micodus
Affected products: mv720, mv720_firmware
CVE-2022-2108 (published 2022-07-18)
The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-862
Affected vendors: wbcomdesigns
Affected products: buddypress_group_reviews
CVE-2022-2111 (published 2022-06-17)
Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: inventree_project
Affected products: inventree
CVE-2022-2112 (published 2022-06-17)
Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-1236
Affected vendors: inventree_project
Affected products: inventree
CVE-2022-21122 (published 2022-06-08)
The package metacalc before 0.0.2 are vulnerable to Arbitrary Code Execution when it exposes JavaScript's Math class to the v8 context. As the Math class is exposed to user-land, it can be used to get access to JavaScript's Function constructor.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: metarhia
Affected products: metacalc
CVE-2022-21123 (published 2022-06-15)
Incomplete cleanup of multi-core shared buffers for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-459
Affected vendors: debian, fedoraproject, intel, vmware, xen
Affected products: debian_linux, esxi, fedora, sgx_dcap, sgx_psw, sgx_sdk, xen
CVE-2022-21124 (published 2022-03-10)
Out-of-bounds write vulnerability in CX-Programmer v9.76.1 and earlier which is a part of CX-One (v4.60) suite allows an attacker to cause information disclosure and/or arbitrary code execution by having a user to open a specially crafted CXP file. This vulnerability is different from CVE-2022-25234.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: omron
Affected products: cx-programmer
CVE-2022-21125 (published 2022-06-15)
Incomplete cleanup of microarchitectural fill buffers on some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-459
Affected vendors: debian, fedoraproject, intel, vmware, xen
Affected products: debian_linux, esxi, fedora, sgx_dcap, sgx_psw, sgx_sdk, xen
CVE-2022-21126 (published 2022-11-29)
The package com.github.samtools:htsjdk before 3.0.1 are vulnerable to Creation of Temporary File in Directory with Insecure Permissions due to the createTempDir() function in util/IOUtil.java not checking for the existence of the temporary directory before attempting to create it.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-668
Affected vendors: samtools
Affected products: htsjdk
CVE-2022-21127 (published 2022-06-15)
Incomplete cleanup in specific special register read operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-459
Affected vendors: debian, intel, xen
Affected products: debian_linux, sgx_dcap, sgx_psw, sgx_sdk, xen
CVE-2022-21128 (published 2022-05-12)
Insufficient control flow management in the Intel(R) Advisor software before version 7.6.0.37 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: advisor
CVE-2022-21129 (published 2023-01-31)
Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function.**Note:** In order to exploit this vulnerability appium-running 0.1.3  has to be installed as one of nemo-appium dependencies. 
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: paypal
Affected products: nemo-appium
CVE-2022-2113 (published 2022-06-17)
Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: inventree_project
Affected products: inventree
CVE-2022-21131 (published 2022-05-12)
Improper access control for some Intel(R) Xeon(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: core_i9-7900x, core_i9-7900x_firmware, core_i9-7920x, core_i9-7920x_firmware, core_i9-7940x, core_i9-7940x_firmware, core_i9-7960x, core_i9-7960x_firmware, core_i9-7980xe, core_i9-7980xe_firmware, xeon_bronze_3104, xeon_bronze_3104_firmware, xeon_bronze_3106, xeon_bronze_3106_firmware, xeon_bronze_3204, xeon_bronze_3204_firmware, xeon_bronze_3206r, xeon_bronze_3206r_firmware, xeon_d-2123it, xeon_d-2123it_firmware, xeon_d-2141i, xeon_d-2141i_firmware, xeon_d-2142it, xeon_d-2142it_firmware, xeon_d-2143it
CVE-2022-21132 (published 2022-03-10)
Directory traversal vulnerability in pfSense-pkg-WireGuard pfSense-pkg-WireGuard 0.1.5 versions prior to 0.1.5_4 and pfSense-pkg-WireGuard 0.1.6 versions prior to 0.1.6_1 allows a remote authenticated attacker to lead a pfSense user to view a file outside the public folder.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: pfsense
Affected products: pfsense-pkg-wireguard
CVE-2022-21133 (published 2022-02-09)
Out-of-bounds read in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: intel
Affected products: trace_analyzer_and_collector
CVE-2022-21134 (published 2022-01-28)
A firmware update vulnerability exists in the &quot;update&quot; firmware checks functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to firmware update. An attacker can send a sequence of requests to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-347
Affected vendors: reolink
Affected products: rlc-410w, rlc-410w_firmware
CVE-2022-21136 (published 2022-05-12)
Improper input validation for some Intel(R) Xeon(R) Processors may allow a privileged user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: core_i9-7900x, core_i9-7900x_firmware, core_i9-7920x, core_i9-7920x_firmware, core_i9-7940x, core_i9-7940x_firmware, core_i9-7960x, core_i9-7960x_firmware, core_i9-7980xe, core_i9-7980xe_firmware, xeon_bronze_3104, xeon_bronze_3104_firmware, xeon_bronze_3106, xeon_bronze_3106_firmware, xeon_bronze_3204, xeon_bronze_3204_firmware, xeon_bronze_3206r, xeon_bronze_3206r_firmware, xeon_d-2123it, xeon_d-2123it_firmware, xeon_d-2141i, xeon_d-2141i_firmware, xeon_d-2142it, xeon_d-2142it_firmware, xeon_d-2143it
CVE-2022-21137 (published 2022-01-14)
Omron CX-One Versions 4.60 and prior are vulnerable to a stack-based buffer overflow while processing specific project files, which may allow an attacker to execute arbitrary code.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-121
Affected vendors: omron
Affected products: cx-one
CVE-2022-21139 (published 2022-08-18)
Inadequate encryption strength for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable escalation of privilege via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-326
Affected vendors: intel
Affected products: proset_wi-fi_6e_ax210, proset_wi-fi_6e_ax210_firmware, wi-fi_6_ax200, wi-fi_6_ax200_firmware, wi-fi_6_ax201, wi-fi_6_ax201_firmware, wi-fi_6e_ax211, wi-fi_6e_ax211_firmware, wi-fi_6e_ax411, wi-fi_6e_ax411_firmware, wireless-ac_9260, wireless-ac_9260_firmware, wireless-ac_9461, wireless-ac_9461_firmware, wireless-ac_9462, wireless-ac_9462_firmware, wireless-ac_9560, wireless-ac_9560_firmware
CVE-2022-2114 (published 2022-07-17)
The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: supsystic
Affected products: data_tables_generator
CVE-2022-21140 (published 2022-08-18)
Improper access control for some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi products may allow a privileged user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: dual_band_wireless-ac_3165, dual_band_wireless-ac_3165_firmware, dual_band_wireless-ac_3168, dual_band_wireless-ac_3168_firmware, dual_band_wireless-ac_8260, dual_band_wireless-ac_8260_firmware, dual_band_wireless-ac_8265, dual_band_wireless-ac_8265_firmware, killer_ac_1550, killer_ac_1550_firmware, killer_wi-fi_6_ax1650, killer_wi-fi_6_ax1650_firmware, killer_wi-fi_6e_ax1675, killer_wi-fi_6e_ax1675_firmware, killer_wi-fi_6e_ax1690, killer_wi-fi_6e_ax1690_firmware, proset_wi-fi_6e_ax210, proset_wi-fi_6e_ax210_firmware, wi-fi_6_ax200, wi-fi_6_ax200_firmware, wi-fi_6_ax201, wi-fi_6_ax201_firmware, wi-fi_6e_ax211, wi-fi_6e_ax211_firmware, wi-fi_6e_ax411
CVE-2022-21141 (published 2022-02-18)
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these functions and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-863
Affected vendors: airspan
Affected products: a5x, a5x_firmware, c5c, c5c_firmware, c5x, c5x_firmware, c6x, c6x_firmware, mimosa_management_platform
CVE-2022-21142 (published 2022-02-24)
Authentication bypass vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.74, Ver.2.9.x series versions prior to Ver.2.9.39, Ver.2.10.x series versions prior to Ver.2.10.43, and Ver.2.11.x series versions prior to Ver.2.11.41 allows a remote unauthenticated attacker to bypass authentication under the specific condition.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-290
Affected vendors: appleple
Affected products: a-blog_cms
CVE-2022-21143 (published 2022-02-18)
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input on several locations, which may allow an attacker to inject arbitrary commands.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: airspan
Affected products: a5x, a5x_firmware, c5c, c5c_firmware, c5x, c5x_firmware, c6x, c6x_firmware, mimosa_management_platform
CVE-2022-21144 (published 2022-05-01)
This affects all versions of package libxmljs. When invoking the libxmljs.parseXml function with a non-buffer argument the V8 code will attempt invoking the .toString method of the argument. If the argument's toString value is not a Function object V8 will crash.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: libxmljs_project
Affected products: libxmljs
CVE-2022-21145 (published 2022-04-14)
A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-80
Affected vendors: lansweeper
Affected products: lansweeper
CVE-2022-21146 (published 2022-03-10)
Persistent cross-site scripting in the web interface of ipDIO allows an unauthenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into a specific parameter. The XSS payload will be executed when a legitimate user attempts to review history.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ipcomm
Affected products: ipdio, ipdio_firmware
CVE-2022-21147 (published 2022-05-12)
An out of bounds read vulnerability exists in the malware scan functionality of ESTsoft Alyac 2.5.7.7. A specially-crafted PE file can trigger this vulnerability to cause denial of service and termination of malware scan. An attacker can provide a malicious file to trigger this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-823
Affected vendors: estsoft
Affected products: alyac
CVE-2022-21148 (published 2022-08-18)
Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: edge_insights_for_industrial
CVE-2022-21149 (published 2022-05-01)
The package s-cart/s-cart before 6.9; the package s-cart/core before 6.9 are vulnerable to Cross-site Scripting (XSS) which can lead to cookie stealing of any victim that visits the affected URL so the attacker can gain unauthorized access to that user's account through the stolen cookie.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: s-cart
Affected products: s-cart
CVE-2022-2115 (published 2022-07-25)
The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: essentialplugin
Affected products: popup_anything
CVE-2022-21151 (published 2022-05-12)
Processor optimization removal or modification of security-critical code for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: debian, intel, netapp
Affected products: celeron_j1750, celeron_j1750_firmware, celeron_j1800, celeron_j1800_firmware, celeron_j1850, celeron_j1850_firmware, celeron_j1900, celeron_j1900_firmware, celeron_j3060, celeron_j3060_firmware, celeron_j3160, celeron_j3160_firmware, celeron_j3355, celeron_j3355_firmware, celeron_j3355e, celeron_j3355e_firmware, celeron_j3455, celeron_j3455_firmware, celeron_j3455e, celeron_j3455e_firmware, celeron_j4005, celeron_j4005_firmware, celeron_j4025, celeron_j4025_firmware, celeron_j4105
CVE-2022-21152 (published 2022-08-18)
Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: edge_insights_for_industrial
CVE-2022-21153 (published 2022-02-09)
Improper access control in the Intel(R) Capital Global Summit Android application may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: capital_global_summit
CVE-2022-21154 (published 2022-04-14)
An integer overflow vulnerability exists in the fltSaveCMP functionality of Leadtools 22. A specially-crafted BMP file can lead to an integer overflow, that in turn causes a buffer overflow. An attacker can provide a malicious BMP file to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: leadtools
Affected products: leadtools
CVE-2022-21155 (published 2022-04-12)
A specially crafted packet sent to the Fernhill SCADA Server Version 3.77 and earlier may cause an exception, causing the server process (FHSvrService.exe) to exit.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: apple, fernhillsoftware, linux, microsoft
Affected products: linux_kernel, macos, scada_server, windows
CVE-2022-21156 (published 2022-02-09)
Access of uninitialized pointer in the Intel(R) Trace Analyzer and Collector before version 2021.5 may allow an authenticated user to potentially enable denial of service via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-824
Affected vendors: intel
Affected products: trace_analyzer_and_collector
CVE-2022-21157 (published 2022-02-09)
Improper access control in the Intel(R) Smart Campus Android application before version 6.1 may allow authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: intel
Affected products: smart_campus
CVE-2022-21158 (published 2022-03-10)
A stored cross-site scripting vulnerability in marktext versions prior to v0.17.0 due to improper handling of the link (with javascript: scheme) inside the document may allow an attacker to execute an arbitrary script on the PC of the user using marktext.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: marktext
Affected products: marktext
CVE-2022-21159 (published 2022-04-15)
A denial of service vulnerability exists in the parseNormalModeParameters functionality of MZ Automation GmbH libiec61850 1.5.0. A specially-crafted series of network requests can lead to denial of service. An attacker can send a sequence of malformed iec61850 messages to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-835
Affected vendors: mz-automation
Affected products: libiec61850
CVE-2022-2116 (published 2022-08-15)
The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: webacetechs
Affected products: contact_form_db_-_elementor
CVE-2022-21160 (published 2022-08-18)
Improper buffer restrictions for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of service via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: intel
Affected products: proset_wi-fi_6e_ax210, proset_wi-fi_6e_ax210_firmware, wi-fi_6_ax200, wi-fi_6_ax200_firmware, wi-fi_6_ax201, wi-fi_6_ax201_firmware, wi-fi_6e_ax211, wi-fi_6e_ax211_firmware, wi-fi_6e_ax411, wi-fi_6e_ax411_firmware, wireless-ac_9260, wireless-ac_9260_firmware, wireless-ac_9461, wireless-ac_9461_firmware, wireless-ac_9462, wireless-ac_9462_firmware, wireless-ac_9560, wireless-ac_9560_firmware
CVE-2022-21162 (published 2023-05-10)
Uncontrolled search path for the Intel(R) HDMI Firmware Update tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: intel
Affected products: nuc_hdmi_firmware_update_tool
CVE-2022-21163 (published 2023-02-16)
Improper access control in the Crypto API Toolkit for Intel(R) SGX before version 2.0 commit ID 91ee496 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: crypto_api_toolkit_for_intel_sgx
CVE-2022-21164 (published 2022-03-16)
The package node-lmdb before 0.9.7 are vulnerable to Denial of Service (DoS) when defining a non-invokable ToString value, which will cause a crash during type check.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: node-lmdb_project
Affected products: node-lmdb
CVE-2022-21165 (published 2022-08-29)
All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the child_process.exec() function.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: font_converter_project
Affected products: font_converter
CVE-2022-21166 (published 2022-06-15)
Incomplete cleanup in specific special register write operations for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-459
Affected vendors: debian, fedoraproject, intel, vmware, xen
Affected products: debian_linux, esxi, fedora, sgx_dcap, sgx_psw, sgx_sdk, xen
CVE-2022-21167 (published 2022-05-01)
All versions of package masuit.tools.core are vulnerable to Arbitrary Code Execution via the ReceiveVarData<T> function in the SocketClient.cs component. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for the BinaryFormatter.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: ldqk
Affected products: masuit.tools
CVE-2022-21168 (published 2022-04-12)
The affected product is vulnerable due to an invalid pointer initialization, which may lead to information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-824
Affected vendors: fujielectric
Affected products: alpha5_smart_loader, alpha5_smart_loader_firmware
CVE-2022-21169 (published 2022-09-26)
The package express-xss-sanitizer before 1.1.3 are vulnerable to Prototype Pollution via the allowedTags attribute, allowing the attacker to bypass xss sanitization.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-1321
Affected vendors: express_xss_sanitizer_project
Affected products: express_xss_sanitizer
CVE-2022-2117 (published 2022-07-18)
The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enabled. This functionality has been completely removed in version 2.20.2.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-200
Affected vendors: givewp
Affected products: givewp
CVE-2022-21170 (published 2022-03-10)
Improper check for certificate revocation in i-FILTER Ver.10.45R01 and earlier, i-FILTER Ver.9.50R10 and earlier, i-FILTER Browser & Cloud MultiAgent for Windows Ver.4.93R04 and earlier, and D-SPA (Ver.3 / Ver.4) using i-FILTER allows a remote unauthenticated attacker to conduct a man-in-the-middle attack and eavesdrop on an encrypted communication.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-295
Affected vendors: daj
Affected products: dspa-15000_m5, dspa-2000_m4, dspa-4000_m4, dspa-7000_m5, i-filter, i-filter_browser_\&_cloud_multiagent
CVE-2022-21172 (published 2022-08-18)
Out of bounds write for some Intel(R) PROSet/Wireless WiFi products may allow a privileged user to potentially enable escalation of privilege via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: intel
Affected products: proset_wi-fi_6e_ax210, proset_wi-fi_6e_ax210_firmware, wi-fi_6e_ax211, wi-fi_6e_ax211_firmware, wi-fi_6e_ax411, wi-fi_6e_ax411_firmware
CVE-2022-21173 (published 2022-02-08)
Hidden functionality vulnerability in ELECOM LAN routers (WRH-300BK3 firmware v1.05 and earlier, WRH-300WH3 firmware v1.05 and earlier, WRH-300BK3-S firmware v1.05 and earlier, WRH-300DR3-S firmware v1.05 and earlier, WRH-300LB3-S firmware v1.05 and earlier, WRH-300PN3-S firmware v1.05 and earlier, WRH-300WH3-S firmware v1.05 and earlier, and WRH-300YG3-S firmware v1.05 and earlier) allows an attacker on the adjacent network to execute an arbitrary OS command via unspecified vectors.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: elecom
Affected products: wrh-300bk3, wrh-300bk3-s, wrh-300bk3-s_firmware, wrh-300bk3_firmware, wrh-300dr3-s, wrh-300dr3-s_firmware, wrh-300lb3-s, wrh-300lb3-s_firmware, wrh-300pn3-s, wrh-300pn3-s_firmware, wrh-300wh3, wrh-300wh3-s, wrh-300wh3-s_firmware, wrh-300wh3_firmware, wrh-300yg3-s, wrh-300yg3-s_firmware
CVE-2022-21174 (published 2022-02-09)
Improper access control in a third-party component of Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: intel
Affected products: quartus_prime
CVE-2022-21176 (published 2022-02-18)
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input, which may allow an attacker to perform a SQL injection and obtain sensitive information.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-89
Affected vendors: airspan
Affected products: a5x, a5x_firmware, c5c, c5c_firmware, c5x, c5x_firmware, c6x, c6x_firmware, mimosa_management_platform