alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-47322 (published 2023-02-12)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47323 (published 2023-02-12)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47324 (published 2023-02-12)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47325 (published 2023-02-12)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47326 (published 2023-02-12)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47327 (published 2023-02-12)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47328 (published 2023-02-12)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47329 (published 2023-02-12)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4733 (published 2022-12-27)
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: open-emr
Affected products: openemr
CVE-2022-47330 (published 2023-02-12)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47331 (published 2023-02-12)
In wlan driver, there is a race condition. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-362
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47332 (published 2023-02-12)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47333 (published 2023-02-12)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47334 (published 2023-05-09)
In phasecheck server, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47335 (published 2023-04-11)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47336 (published 2023-04-11)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47337 (published 2023-04-11)
In media service, there is a missing permission check. This could lead to local denial of service in media service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47338 (published 2023-04-11)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-668
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47339 (published 2023-02-12)
In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4734 (published 2022-12-27)
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-212
Affected vendors: usememos
Affected products: memos
CVE-2022-47340 (published 2023-05-09)
In h265 codec firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47341 (published 2023-02-12)
In engineermode services, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47342 (published 2023-02-12)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-129
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47343 (published 2023-02-12)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-129
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47344 (published 2023-02-12)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-129
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47345 (published 2023-02-12)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-129
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47346 (published 2023-02-12)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-129
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47347 (published 2023-02-12)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-129
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47348 (published 2023-02-12)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-129
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4735 (published 2022-12-25)
A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 24d01757a5319cc14c4aa1d8b53d1ab24d48e451. It is recommended to apply a patch to fix this issue. VDB-216766 is the identifier assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dash-live_project
Affected products: dash-live
CVE-2022-47350 (published 2023-08-07)
In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8000, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47351 (published 2023-08-07)
In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8000, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47352 (published 2023-09-04)
In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, t610, t618
CVE-2022-47353 (published 2023-09-04)
In vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of service with System execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: google, unisoc
Affected products: android, s8000, t610, t618, t760, t770, t820
CVE-2022-47354 (published 2023-02-12)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47355 (published 2023-02-12)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47356 (published 2023-02-12)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47357 (published 2023-02-12)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47358 (published 2023-02-12)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47359 (published 2023-02-12)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4736 (published 2022-12-25)
A vulnerability was found in Venganzas del Pasado and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument the_title leads to cross site scripting. The attack may be launched remotely. The name of the patch is 62339b2ec445692c710b804bdf07aef4bd247ff7. It is recommended to apply a patch to fix this issue. VDB-216770 is the identifier assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: venganzasdelpasado
Affected products: venganzas_del_pasado
CVE-2022-47360 (published 2023-02-12)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47361 (published 2023-02-12)
In firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47362 (published 2023-04-11)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47363 (published 2023-02-12)
In wlan driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47364 (published 2023-02-12)
In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47365 (published 2023-02-12)
In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47366 (published 2023-02-12)
In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47367 (published 2023-02-12)
In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47368 (published 2023-02-12)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47369 (published 2023-02-12)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4737 (published 2022-12-25)
A vulnerability was found in SourceCodester Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The identifier VDB-216773 was assigned to this vulnerability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: blood_bank_management_system_project
Affected products: blood_bank_management_system
CVE-2022-47370 (published 2023-02-12)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47371 (published 2023-02-12)
In bt driver, there is a thread competition leads to early release of resources to be accessed. This could lead to local denial of service in kernel.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-416
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-47372 (published 2023-02-15)
Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the stored XSS payload.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-352
Affected vendors: pandorafms
Affected products: pandora_fms
CVE-2022-47373 (published 2023-02-15)
Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-352
Affected vendors: pandorafms
Affected products: pandora_fms
CVE-2022-47374 (published 2023-12-12)
A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions). The affected products do not handle HTTP(S) requests to the web server correctly.

This could allow an attacker to exhaust system resources and create a denial of service condition for the device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-674
Affected vendors: siemens
Affected products: 6ag1414-3em07-7ab0, 6ag1414-3em07-7ab0_firmware, 6ag1416-3es07-7ab0, 6ag1416-3es07-7ab0_firmware, 6es7412-2ek07-0ab0, 6es7412-2ek07-0ab0_firmware, 6es7414-3em07-0ab0, 6es7414-3em07-0ab0_firmware, 6es7414-3fm07-0ab0, 6es7414-3fm07-0ab0_firmware, 6es7416-3es07-0ab0, 6es7416-3es07-0ab0_firmware, 6es7416-3fs07-0ab0, 6es7416-3fs07-0ab0_firmware, simatic_pc-station_plus, simatic_pc-station_plus_firmware, sinamics_s120, sinamics_s120_firmware
CVE-2022-47375 (published 2023-12-12)
A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions). The affected products do not handle long file names correctly.

This could allow an attacker to create a buffer overflow and create a denial of service condition for the device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-805
Affected vendors: siemens
Affected products: 6ag1414-3em07-7ab0, 6ag1414-3em07-7ab0_firmware, 6ag1416-3es07-7ab0, 6ag1416-3es07-7ab0_firmware, 6es7412-2ek07-0ab0, 6es7412-2ek07-0ab0_firmware, 6es7414-3em07-0ab0, 6es7414-3em07-0ab0_firmware, 6es7414-3fm07-0ab0, 6es7414-3fm07-0ab0_firmware, 6es7416-3es07-0ab0, 6es7416-3es07-0ab0_firmware, 6es7416-3fs07-0ab0, 6es7416-3fs07-0ab0_firmware, simatic_pc-station_plus, simatic_pc-station_plus_firmware, sinamics_s120, sinamics_s120_firmware
CVE-2022-47376 (published 2023-06-13)
The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)
Weakness: CWE-257
Affected vendors: bd
Affected products: alaris_infusion_central
CVE-2022-47377 (published 2022-12-16)
Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.13.4 as soon as possible (available in SICK Support Portal).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-306
Affected vendors: sick
Affected products: sim2000_firmware, sim2000st
CVE-2022-47378 (published 2023-05-15)
Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47379 (published 2023-05-15)
An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-4738 (published 2022-12-25)
A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index.php?page=users of the component User Registration Handler. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-216774 is the identifier assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: blood_bank_management_system_project
Affected products: blood_bank_management_system
CVE-2022-47380 (published 2023-05-15)
An authenticated remote attacker may use a stack based  out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47381 (published 2023-05-15)
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47382 (published 2023-05-15)
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47383 (published 2023-05-15)
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47384 (published 2023-05-15)
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47385 (published 2023-05-15)
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47386 (published 2023-05-15)
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47387 (published 2023-05-15)
An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47388 (published 2023-05-15)
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47389 (published 2023-05-15)
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-4739 (published 2022-12-25)
A vulnerability classified as critical was found in SourceCodester School Dormitory Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-216775.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: school_dormitory_management_system_project
Affected products: school_dormitory_management_system
CVE-2022-47390 (published 2023-05-15)
An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47391 (published 2023-05-15)
In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47392 (published 2023-05-15)
An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47393 (published 2023-05-15)
An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-119
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_\(for_beckhoff_cx\)_sl, control_rte_\(sl\), control_runtime_system_toolkit, control_win_\(sl\), development_system_v3, hmi_\(sl\), safety_sil2_psp, safety_sil2_runtime_toolkit
CVE-2022-47395 (published 2023-01-18)
Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operations and cause a denial-of-service condition.


Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H)
Weakness: CWE-352
Affected vendors: sewio
Affected products: real-time_location_system_studio
CVE-2022-4740 (published 2022-12-25)
A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216776.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: keking
Affected products: kkfileview
CVE-2022-47406 (published 2022-12-14)
An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-613
Affected vendors: change_password_for_frontend_users_project
Affected products: change_password_for_frontend_users
CVE-2022-47407 (published 2022-12-14)
An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-284
Affected vendors: master-quiz_project
Affected products: master-quiz
CVE-2022-47408 (published 2022-12-14)
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. There is a CAPTCHA bypass that can lead to subscribing many people.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-287
Affected vendors: fp_newsletter_project
Affected products: fp_newsletter
CVE-2022-47409 (published 2022-12-14)
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Attackers can unsubscribe everyone via a series of modified subscription UIDs in deleteAction operations.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-285
Affected vendors: fp_newsletter_project
Affected products: fp_newsletter
CVE-2022-4741 (published 2022-12-25)
A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-789
Affected vendors: search
Affected products: docconv
CVE-2022-47410 (published 2022-12-14)
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: fp_newsletter_project
Affected products: fp_newsletter
CVE-2022-47411 (published 2022-12-14)
An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: fp_newsletter_project
Affected products: fp_newsletter
CVE-2022-47412 (published 2023-02-07)
Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: onlyoffice
Affected products: workspace
CVE-2022-47413 (published 2023-02-07)

Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition.


Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: openkm
Affected products: openkm
CVE-2022-47414 (published 2023-02-07)

If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: openkm
Affected products: openkm
CVE-2022-47415 (published 2023-02-07)
LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messaging system (both subject and message bodies).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: logicaldoc
Affected products: logicaldoc