alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-40358 (published 2022-09-23)
An issue was discovered in AjaXplorer 4.2.3, allows attackers to cause cross site scripting vulnerabilities via a crafted svg file upload.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: ajaxplorer
Affected products: ajaxplorer
CVE-2022-40359 (published 2022-09-23)
Cross site scripting (XSS) vulnerability in kfm through 1.4.7 via crafted GET request to /kfm/index.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: kfm_project
Affected products: kfm
CVE-2022-4036 (published 2022-11-29)
The Appointment Hour Booking plugin for WordPress is vulnerable to CAPTCHA bypass in versions up to, and including, 1.3.72. This is due to the use of insufficiently strong hashing algorithm on the CAPTCHA secret that is also displayed to the user via a cookie.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-804
Affected vendors: dwbooster
Affected products: appointment_hour_booking
CVE-2022-40361 (published 2024-01-11)
Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/login endpoint.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: elitecms
Affected products: elite_cms
CVE-2022-40363 (published 2022-09-29)
A buffer overflow in the component nfc_device_load_mifare_ul_data of Flipper Devices Inc., Flipper Zero before v0.65.2 allows attackers to cause a Denial of Service (DoS) via a crafted NFC file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: flipperzero
Affected products: flipper_zero, flipper_zero_firmware
CVE-2022-40365 (published 2022-09-14)
Cross site scripting (XSS) vulnerability in ouqiang gocron through 1.5.3, allows attackers to execute arbitrary code via scope.row.hostname in web/vue/src/pages/taskLog/list.vue.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: gocron_project
Affected products: gocron
CVE-2022-4037 (published 2023-01-12)
An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. A race condition can lead to verified email forgery and takeover of third-party accounts when using GitLab as an OAuth provider.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: gitlab
Affected products: gitlab
CVE-2022-40373 (published 2022-12-15)
Cross Site Scripting (XSS) vulnerability in FeehiCMS 2.1.1 allows remote attackers to run arbitrary code via upload of crafted XML file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: feehi
Affected products: feehicms
CVE-2022-4039 (published 2023-09-22)
A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-276
Affected vendors: redhat
Affected products: enterprise_linux, openshift_container_platform, openshift_container_platform_for_ibm_z, openshift_container_platform_for_linuxone, openshift_container_platform_for_power, single_sign-on
CVE-2022-40402 (published 2022-09-26)
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_assign.php.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: wedding_planner_project
Affected products: wedding_planner
CVE-2022-40403 (published 2022-09-26)
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/feature_edit.php.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: wedding_planner_project
Affected products: wedding_planner
CVE-2022-40404 (published 2022-09-26)
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/select.php.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: wedding_planner_project
Affected products: wedding_planner
CVE-2022-40405 (published 2022-11-15)
WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-89
Affected vendors: wowonder
Affected products: wowonder
CVE-2022-40407 (published 2022-09-29)
A zip slip vulnerability in the file upload function of Chamilo v1.11 allows attackers to execute arbitrary code via a crafted Zip file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: chamilo
Affected products: chamilo
CVE-2022-40408 (published 2022-09-29)
FeehiCMS v2.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted payload injected into the Comment box under the Single Page module.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: feehi
Affected products: feehicms
CVE-2022-4041 (published 2023-01-31)
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation.
This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.8.0 before 04.9.1.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-266
Affected vendors: hitachi
Affected products: storage_plug-in
CVE-2022-4042 (published 2022-12-26)
The Paytium: Mollie payment forms & donations WordPress plugin before 4.3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: paytium
Affected products: paytium
CVE-2022-40424 (published 2022-09-19)
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-networking package. The affected version of d8s-urls is 0.1.0
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: democritus_urls_project
Affected products: democritus_urls
CVE-2022-40425 (published 2022-09-19)
The d8s-html for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: d8s-html_project
Affected products: d8s-html
CVE-2022-40426 (published 2022-09-19)
The d8s-asns for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: d8s-asns_project
Affected products: d8s-asns
CVE-2022-40427 (published 2022-09-19)
The d8s-domains for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: democritus_domains_project
Affected products: democritus_domains
CVE-2022-40428 (published 2022-09-19)
The d8s-mpeg for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: d8s-mpeg_project
Affected products: d8s_mpeg
CVE-2022-40429 (published 2022-09-19)
The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: d8s-ip-addresses_project
Affected products: d8s-ip-addresses
CVE-2022-4043 (published 2023-01-09)
The WP Custom Admin Interface WordPress plugin before 7.29 unserialize user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: wp_custom_admin_interface_project
Affected products: wp_custom_admin_interface
CVE-2022-40430 (published 2022-09-19)
The d8s-utility for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: d8s-utility_project
Affected products: d8s-utility
CVE-2022-40431 (published 2022-09-19)
The d8s-pdfs for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: d8s-pdfs_project
Affected products: d8s-pdfs
CVE-2022-40432 (published 2022-09-19)
The d8s-strings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: d8s-strings_project
Affected products: d8s-strings
CVE-2022-40434 (published 2022-12-19)
Softr v2.0 was discovered to be vulnerable to HTML injection via the Name field of the Account page.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: softr
Affected products: softr
CVE-2022-40435 (published 2022-12-19)
Employee Performance Evaluation System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via adding new entries under the Departments and Designations module.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: employee_performance_evaluation_system_project
Affected products: employee_performance_evaluation_system
CVE-2022-40438 (published 2022-09-14)
Buffer overflow vulnerability in function AP4_MemoryByteStream::WritePartial in mp42aac in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a crafted file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-120
Affected vendors: axiosys
Affected products: bento4
CVE-2022-40439 (published 2022-09-14)
An memory leak issue was discovered in AP4_StdcFileByteStream::Create in mp42ts in Bento4 v1.6.0-639, allows attackers to cause a denial of service via a crafted file.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-401
Affected vendors: axiosys
Affected products: bento4
CVE-2022-4044 (published 2022-11-23)
A denial-of-service vulnerability in Mattermost allows an authenticated user to crash the server via multiple large autoresponder messages.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: mattermost
Affected products: mattermost
CVE-2022-40440 (published 2022-10-12)
mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jgraph
Affected products: mxgraph
CVE-2022-40443 (published 2022-09-22)
An absolute path traversal vulnerability in ZZCMS 2022 allows attackers to obtain sensitive information via a crafted GET request sent to /one/siteinfo.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-22
Affected vendors: zzcms
Affected products: zzcms
CVE-2022-40444 (published 2022-09-22)
ZZCMS 2022 was discovered to contain a full path disclosure vulnerability via the page /admin/index.PHP? _server.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-22
Affected vendors: zzcms
Affected products: zzcms
CVE-2022-40446 (published 2022-09-22)
ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the component /admin/sendmailto.php?tomail=&groupid=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: zzcms
Affected products: zzcms
CVE-2022-40447 (published 2022-09-22)
ZZCMS 2022 was discovered to contain a SQL injection vulnerability via the keyword parameter at /admin/baojia_list.php.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: zzcms
Affected products: zzcms
CVE-2022-4045 (published 2022-11-23)
A denial-of-service vulnerability in the Mattermost allows an authenticated user to crash the server via multiple requests to one of the API endpoints which could fetch a large amount of data. 

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: mattermost
Affected products: mattermost
CVE-2022-4046 (published 2023-08-03)
In CODESYS Control in multiple versions a improper restriction of operations within the bounds of a memory buffer allow an remote attacker with user privileges to gain full access of the device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-119
Affected vendors: codesys
Affected products: control_for_beaglebone_sl, control_for_empc-a\/imx6_sl, control_for_iot2000_sl, control_for_linux_sl, control_for_pfc100_sl, control_for_pfc200_sl, control_for_plcnext_sl, control_for_raspberry_pi_sl, control_for_wago_touch_panels_600_sl, control_rte_sl, control_rte_sl_\(for_beckhoff_cx\), control_runtime_system_toolkit, control_win_sl, hmi_sl
CVE-2022-40468 (published 2022-09-19)
Potential leak of left-over heap data if custom error page templates containing special non-standard variables are used. Tinyproxy commit 84f203f and earlier use uninitialized buffers in process_request() function.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-1188
Affected vendors: tinyproxy_project
Affected products: tinyproxy
CVE-2022-40469 (published 2022-10-12)
iKuai OS v3.6.7 was discovered to contain an authenticated remote code execution (RCE) vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: ikuai8
Affected products: ikuaios
CVE-2022-4047 (published 2022-12-26)
The Return Refund and Exchange For WooCommerce WordPress plugin before 4.0.9 does not validate attachment files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files such as PHP and lead to RCE
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: wpswings
Affected products: return_refund_and_exchange_for_woocommerce
CVE-2022-40470 (published 2022-11-21)
Phpgurukul Blood Donor Management System 1.0 allows Cross Site Scripting via Add Blood Group Name Feature.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: phpgurukul
Affected products: blood_donor_management_system
CVE-2022-40471 (published 2022-10-31)
Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: oretnom23
Affected products: clinic\'s_patient_management_system
CVE-2022-40472 (published 2022-09-29)
ZKTeco Xiamen Information Technology ZKBio Time 8.0.7 Build: 20220721.14829 was discovered to contain a CSV injection vulnerability. This vulnerability allows attackers to execute arbitrary code via a crafted payload injected into the Content text field of the Add New Message module.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-1236
Affected vendors: zktec
Affected products: zkbio_time
CVE-2022-40475 (published 2022-09-29)
TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: totolink
Affected products: a860r, a860r_firmware
CVE-2022-40476 (published 2022-09-14)
A null pointer dereference issue was discovered in fs/io_uring.c in the Linux kernel before 5.15.62. A local user could use this flaw to crash the system or potentially cause a denial of service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: linux
Affected products: linux_kernel
CVE-2022-4048 (published 2023-05-15)
Inadequate Encryption Strength in CODESYS Development System V3 versions prior to V3.5.18.40 allows an unauthenticated local attacker to access and manipulate code of the encrypted boot application.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-326
Affected vendors: codesys
Affected products: development_system_v3
CVE-2022-40480 (published 2023-02-08)
Nordic Semiconductor, Microchip Technology NRF5340-DK DT100112 was discovered to contain an issue which allows attackers to cause a Denial of Service (DoS) via a crafted ConReq packet.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: microchip, nordicsemi
Affected products: dt100112, dt100112_firmware, nrf5340-dk, nrf5340-dk_firmware
CVE-2022-40482 (published 2023-04-25)
The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing attacks with HTTP/2 multiplexing. This is caused by the early return inside the hasValidCredentials method in the Illuminate\Auth\SessionGuard class when a user is found to not exist.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-203
Affected vendors: laravel
Affected products: framework
CVE-2022-40483 (published 2022-09-26)
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /wedding_details.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: wedding_planner_project
Affected products: wedding_planner
CVE-2022-40484 (published 2022-09-26)
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the booking parameter at /admin/client_edit.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: wedding_planner_project
Affected products: wedding_planner
CVE-2022-40485 (published 2022-09-26)
Wedding Planner v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /package_detail.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: wedding_planner_project
Affected products: wedding_planner
CVE-2022-40486 (published 2022-09-28)
TP Link Archer AX10 V1 Firmware Version 1.3.1 Build 20220401 Rel. 57450(5553) was discovered to allow authenticated attackers to execute arbitrary code via a crafted backup file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: tp-link
Affected products: archer_ax10_v1, archer_ax10_v1_firmware
CVE-2022-40487 (published 2022-10-31)
ProcessWire v3.0.200 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Search Users and Search Pages function. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via injection of a crafted payload.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: processwire
Affected products: processwire
CVE-2022-40488 (published 2022-10-31)
ProcessWire v3.0.200 was discovered to contain a Cross-Site Request Forgery (CSRF).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: processwire
Affected products: processwire
CVE-2022-40489 (published 2022-12-01)
ThinkCMF version 6.0.7 is affected by a Cross Site Request Forgery (CSRF) vulnerability that allows a Super Administrator user to be injected into administrative users.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: thinkcmf
Affected products: thinkcmf
CVE-2022-4049 (published 2023-01-02)
The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: wp_user_project
Affected products: wp_user
CVE-2022-40494 (published 2022-10-06)
NPS before v0.26.10 was discovered to contain an authentication bypass vulnerability via constantly generating and sending the Auth key and Timestamp parameters.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: ehang-io
Affected products: nps
CVE-2022-40497 (published 2022-09-28)
Wazuh v3.6.1 - v3.13.5, v4.0.0 - v4.2.7, and v4.3.0 - v4.3.7 were discovered to contain an authenticated remote code execution (RCE) vulnerability via the Active Response endpoint.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: wazuh
Affected products: wazuh
CVE-2022-4050 (published 2022-12-19)
The JoomSport WordPress plugin before 5.2.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: beardev
Affected products: joomsport
CVE-2022-40502 (published 2023-02-12)
Transient DOS due to improper input validation in WLAN Host.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: qualcomm
Affected products: csr8811, csr8811_firmware, ipq5010, ipq5010_firmware, ipq5018, ipq5018_firmware, ipq5028, ipq5028_firmware, ipq6000, ipq6000_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028, ipq6028_firmware, ipq8070a, ipq8070a_firmware, ipq8071a, ipq8071a_firmware, ipq8072a, ipq8072a_firmware, ipq8074a, ipq8074a_firmware, ipq8076
CVE-2022-40503 (published 2023-04-13)
Information disclosure due to buffer over-read in Bluetooth Host while A2DP streaming.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-126
Affected vendors: qualcomm
Affected products: 8905, 8905_firmware, 8909, 8909_firmware, 8953, 8953_firmware, 8953pro, 8953pro_firmware, 9206_lte_modem, 9206_lte_modem_firmware, apq5053-aa, apq5053-aa_firmware, apq8017, apq8017_firmware, apq8053-aa, apq8053-aa_firmware, apq8053-ac, apq8053-ac_firmware, apq8053-lite, apq8053-lite_firmware, apq8064au, apq8064au_firmware, aqt1000, aqt1000_firmware, ar8031
CVE-2022-40504 (published 2023-05-02)
Transient DOS due to reachable assertion in Modem when UE received Downlink Data Indication message from the network.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: qualcomm
Affected products: 315_5g_iot_modem, 315_5g_iot_modem_firmware, 8905, 8905_firmware, 8909, 8909_firmware, 8917, 8917_firmware, 8920, 8920_firmware, 8940, 8940_firmware, 8953, 8953_firmware, 8953pro, 8953pro_firmware, apq5053-aa, apq5053-aa_firmware, apq8017, apq8017_firmware, apq8053-aa, apq8053-aa_firmware, apq8053-ac, apq8053-ac_firmware, aqt1000
CVE-2022-40505 (published 2023-05-02)
Information disclosure due to buffer over-read in Modem while parsing DNS hostname.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-126
Affected vendors: qualcomm
Affected products: 9205_lte_modem, 9205_lte_modem_firmware, 9206_lte_modem, 9206_lte_modem_firmware, 9207_lte_modem, 9207_lte_modem_firmware, mdm8207, mdm8207_firmware, qca4004, qca4004_firmware, qca4010, qca4010_firmware, qts110, qts110_firmware, snapdragon_1100_wearable_platform, snapdragon_1100_wearable_platform_firmware, snapdragon_1200_wearable_platform, snapdragon_1200_wearable_platform_firmware, snapdragon_wear_1300_platform, snapdragon_wear_1300_platform_firmware, snapdragon_x5_lte_modem, snapdragon_x5_lte_modem_firmware, wcd9306, wcd9306_firmware, wcd9330
CVE-2022-40507 (published 2023-06-06)
Memory corruption due to double free in Core while mapping HLOS address to the list.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-415
Affected vendors: qualcomm
Affected products: 315_5g_iot_modem, 315_5g_iot_modem_firmware, 9205_lte_modem, 9205_lte_modem_firmware, 9206_lte_modem, 9206_lte_modem_firmware, 9207_lte_modem, 9207_lte_modem_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, c-v2x_9150, c-v2x_9150_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10056, fsm10056_firmware, home_hub_100_platform
CVE-2022-40508 (published 2023-05-02)
Transient DOS due to reachable assertion in Modem while processing config related to cross carrier scheduling, which is not supported.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: qualcomm
Affected products: 315_5g_iot_modem, 315_5g_iot_modem_firmware, aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696
CVE-2022-4051 (published 2022-11-17)
A vulnerability has been found in Hostel Searching Project and classified as critical. This vulnerability affects unknown code of the file view-property.php. The manipulation of the argument property_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213844.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-707
Affected vendors: hostel_searching_project
Affected products: hostel_searching_project
CVE-2022-40510 (published 2023-08-08)
Memory corruption due to buffer copy without checking size of input in Audio while voice call with EVS vocoder.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-457
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8037, apq8037_firmware, apq8064au, apq8064au_firmware, apq8076, apq8076_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024
CVE-2022-40512 (published 2023-02-12)
Transient DOS in WLAN Firmware due to buffer over-read while processing probe response or beacon.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8064au, apq8064au_firmware, apq8076, apq8076_firmware, apq8092, apq8092_firmware, apq8094, apq8094_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr8811, csr8811_firmware, csra6620
CVE-2022-40513 (published 2023-02-12)
Transient DOS due to uncontrolled resource consumption in WLAN firmware when peer is freed in non qos state.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: qualcomm
Affected products: csr8811, csr8811_firmware, ipq5010, ipq5010_firmware, ipq5018, ipq5018_firmware, ipq5028, ipq5028_firmware, ipq6000, ipq6000_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028, ipq6028_firmware, ipq8070a, ipq8070a_firmware, ipq8071a, ipq8071a_firmware, ipq8072a, ipq8072a_firmware, ipq8074a, ipq8074a_firmware, ipq8076
CVE-2022-40514 (published 2023-02-12)
Memory corruption due to buffer copy without checking the size of input in WLAN Firmware while processing CCKM IE in reassoc response frame.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, ipq5010, ipq5010_firmware, ipq5018, ipq5018_firmware, ipq5028, ipq5028_firmware, ipq6000, ipq6000_firmware, ipq6010
CVE-2022-40515 (published 2023-03-10)
Memory corruption in Video due to double free while playing 3gp clip with invalid metadata atoms.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-415
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8009w, apq8009w_firmware, apq8052, apq8052_firmware, apq8056, apq8056_firmware, apq8064au, apq8064au_firmware, apq8076, apq8076_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, mdm9150, mdm9150_firmware, mdm9206
CVE-2022-40516 (published 2023-01-09)
Memory corruption in Core due to stack-based buffer overflow.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10056, fsm10056_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028
CVE-2022-40517 (published 2023-01-09)
Memory corruption in core due to stack-based buffer overflow
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10056, fsm10056_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028
CVE-2022-40518 (published 2023-01-09)
Information disclosure due to buffer overread in Core
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10056, fsm10056_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, qam8295p, qam8295p_firmware, qca4004, qca4004_firmware, qca6174a, qca6174a_firmware, qca6310
CVE-2022-40519 (published 2023-01-09)
Information disclosure due to buffer overread in Core
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, fsm10056, fsm10056_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028
CVE-2022-4052 (published 2022-11-17)
A vulnerability was found in Student Attendance Management System and classified as critical. This issue affects some unknown processing of the file /Admin/createClass.php. The manipulation of the argument Id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213845 was assigned to this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-707
Affected vendors: student_attendance_management_system_project
Affected products: student_attendance_management_system
CVE-2022-40520 (published 2023-01-09)
Memory corruption due to stack-based buffer overflow in Core
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: qualcomm
Affected products: apq8064au, apq8064au_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8035, ar8035_firmware, csrb31024, csrb31024_firmware, fsm10056, fsm10056_firmware, mdm9150, mdm9150_firmware, mdm9205, mdm9205_firmware, mdm9640, mdm9640_firmware, mdm9650, mdm9650_firmware, msm8996au, msm8996au_firmware, qam8295p, qam8295p_firmware, qca4004
CVE-2022-40521 (published 2023-06-06)
Transient DOS due to improper authorization in Modem
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-285
Affected vendors: qualcomm
Affected products: 315_5g_iot_modem, 315_5g_iot_modem_firmware, 8953pro, 8953pro_firmware, 9205_lte_modem, 9205_lte_modem_firmware, 9206_lte_modem, 9206_lte_modem_firmware, 9207_lte_modem, 9207_lte_modem_firmware, apq5053-aa, apq5053-aa_firmware, apq8017, apq8017_firmware, apq8037, apq8037_firmware, apq8053-aa, apq8053-aa_firmware, apq8053-ac, apq8053-ac_firmware, aqt1000, aqt1000_firmware, ar6003, ar6003_firmware, ar8035
CVE-2022-40522 (published 2023-06-06)
Memory corruption in Linux Networking due to double free while handling a hyp-assign.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-415
Affected vendors: qualcomm
Affected products: csr8811, csr8811_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028, ipq6028_firmware, ipq9008, ipq9008_firmware, ipq9574, ipq9574_firmware, qca4024, qca4024_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696
CVE-2022-40523 (published 2023-06-06)
Information disclosure in Kernel due to indirect branch misprediction.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: qualcomm
Affected products: 9205_lte_modem, 9205_lte_modem_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, flight_rb5_5g_platform, flight_rb5_5g_platform_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8650p, qam8650p_firmware, qam8775p, qam8775p_firmware, qca4004, qca4004_firmware, qca6174a
CVE-2022-40524 (published 2023-09-05)
Memory corruption due to buffer over-read in Modem while processing SetNativeHandle RTP service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-126
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6420, qca6420_firmware, qca6426, qca6426_firmware, qca6430, qca6430_firmware, qca6436, qca6436_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qcc5100, qcc5100_firmware, sa6145p, sa6145p_firmware, sa6150p
CVE-2022-40525 (published 2023-06-06)
Information disclosure in Linux Networking Firmware due to unauthorized information leak during side channel analysis.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: qualcomm
Affected products: csr8811, csr8811_firmware, ipq6000, ipq6000_firmware, ipq6005, ipq6005_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028, ipq6028_firmware, ipq9008, ipq9008_firmware, ipq9574, ipq9574_firmware, qca4024, qca4024_firmware, qca8072, qca8072_firmware, qca8075, qca8075_firmware, qca8081, qca8081_firmware, qca8082
CVE-2022-40527 (published 2023-03-10)
Transient DOS due to reachable assertion in WLAN while processing PEER ID populated by TQM.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, csr8811, csr8811_firmware, ipq5010, ipq5010_firmware, ipq5018, ipq5018_firmware, ipq5028, ipq5028_firmware, ipq6000, ipq6000_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028, ipq6028_firmware, ipq8070, ipq8070_firmware, ipq8070a, ipq8070a_firmware, ipq8071a, ipq8071a_firmware, ipq8072a
CVE-2022-40529 (published 2023-06-06)
Memory corruption due to improper access control in kernel while processing a mapping request from root process.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, c-v2x_9150, c-v2x_9150_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, flight_rb5_5g_platform, flight_rb5_5g_platform_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8650p, qam8650p_firmware, qam8775p, qam8775p_firmware, qca6174a, qca6174a_firmware, qca6310
CVE-2022-4053 (published 2022-11-17)
A vulnerability was found in Student Attendance Management System. It has been classified as problematic. Affected is an unknown function of the file createClass.php. The manipulation of the argument className leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-213846 is the identifier assigned to this vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-707
Affected vendors: student_attendance_management_system_project
Affected products: student_attendance_management_system
CVE-2022-40530 (published 2023-03-10)
Memory corruption in WLAN due to integer overflow to buffer overflow in WLAN during initialization phase.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-680
Affected vendors: qualcomm
Affected products: aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, ipq5018, ipq5018_firmware, ipq6010, ipq6010_firmware, ipq6018, ipq6018_firmware, ipq6028, ipq6028_firmware, ipq8070, ipq8070_firmware, ipq8070a
CVE-2022-40531 (published 2023-03-10)
Memory corruption in WLAN due to incorrect type cast while sending WMI_SCAN_SCH_PRIO_TBL_CMDID message.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-704
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8017, apq8017_firmware, apq8076, apq8076_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, ar8035, ar8035_firmware, ar9380, ar9380_firmware, csr8811, csr8811_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, csrb31024, csrb31024_firmware, ipq4018
CVE-2022-40532 (published 2023-04-13)
Memory corruption due to integer overflow or wraparound in WLAN while sending WMI cmd from host to target.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: qualcomm
Affected products: 315_5g_iot_modem, 315_5g_iot_modem_firmware, 8905, 8905_firmware, 8909, 8909_firmware, 8917, 8917_firmware, 8920, 8920_firmware, 8937, 8937_firmware, 8940, 8940_firmware, 8953, 8953_firmware, 8953pro, 8953pro_firmware, 8976, 8976_firmware, 8992, 8992_firmware, 8994, 8994_firmware, 8996
CVE-2022-40533 (published 2023-06-06)
Transient DOS due to untrusted Pointer Dereference in core while sending USB QMI request.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-822
Affected vendors: qualcomm
Affected products: csra6620, csra6620_firmware, csra6640, csra6640_firmware, flight_rb5_5g_platform, flight_rb5_5g_platform_firmware, qam8255p, qam8255p_firmware, qam8295p, qam8295p_firmware, qam8650p, qam8650p_firmware, qam8775p, qam8775p_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6431, qca6431_firmware, qca6436
CVE-2022-40534 (published 2023-09-05)
Memory corruption due to improper validation of array index in Audio.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: snapdragon_w5\+_gen_1_wearable_platform, snapdragon_w5\+_gen_1_wearable_platform_firmware, sw5100, sw5100_firmware, sw5100p, sw5100p_firmware, sxr2230p, sxr2230p_firmware, wcd9380, wcd9380_firmware, wcd9385, wcd9385_firmware, wcn685x-1, wcn685x-1_firmware, wcn685x-5, wcn685x-5_firmware, wcn785x-1, wcn785x-1_firmware, wcn785x-5, wcn785x-5_firmware, wsa8830, wsa8830_firmware, wsa8832, wsa8832_firmware, wsa8835
CVE-2022-40535 (published 2023-03-10)
Transient DOS due to buffer over-read in WLAN while sending a packet to device.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: qualcomm
Affected products: csr8811, csr8811_firmware, ipq8070a, ipq8070a_firmware, ipq8071a, ipq8071a_firmware, ipq8072a, ipq8072a_firmware, ipq8074a, ipq8074a_firmware, ipq8076, ipq8076_firmware, ipq8076a, ipq8076a_firmware, ipq8078, ipq8078_firmware, ipq8078a, ipq8078a_firmware, ipq8173, ipq8173_firmware, ipq8174, ipq8174_firmware, ipq9008, ipq9008_firmware, ipq9574
CVE-2022-40536 (published 2023-06-06)
Transient DOS due to improper authentication in modem while receiving plain TLB OTA request message from network.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-285
Affected vendors: qualcomm
Affected products: 315_5g_iot_modem, 315_5g_iot_modem_firmware, ar8035, ar8035_firmware, qca6390, qca6390_firmware, qca6391, qca6391_firmware, qca6421, qca6421_firmware, qca6426, qca6426_firmware, qca6431, qca6431_firmware, qca6436, qca6436_firmware, qca6574a, qca6574a_firmware, qca6574au, qca6574au_firmware, qca6595au, qca6595au_firmware, qca6696, qca6696_firmware, qca6698aq
CVE-2022-40537 (published 2023-03-10)
Memory corruption in Bluetooth HOST while processing the AVRC_PDU_GET_PLAYER_APP_VALUE_TEXT AVRCP response.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-129
Affected vendors: qualcomm
Affected products: apq8009, apq8009_firmware, apq8009w, apq8009w_firmware, apq8017, apq8017_firmware, apq8064au, apq8064au_firmware, apq8096au, apq8096au_firmware, aqt1000, aqt1000_firmware, ar8031, ar8031_firmware, csra6620, csra6620_firmware, csra6640, csra6640_firmware, mdm9150, mdm9150_firmware, mdm9250, mdm9250_firmware, mdm9607, mdm9607_firmware, mdm9628
CVE-2022-40538 (published 2023-06-06)
Transient DOS due to reachable assertion in modem while processing sib with incorrect values from network.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: qualcomm
Affected products: ar8035, ar8035_firmware, qca8081, qca8081_firmware, qca8337, qca8337_firmware, qcn6024, qcn6024_firmware, qcn9024, qcn9024_firmware, qcs8550, qcs8550_firmware, snapdragon_x65_5g_modem-rf_system, snapdragon_x65_5g_modem-rf_system_firmware, snapdragon_x70_modem-rf_system, snapdragon_x70_modem-rf_system_firmware, wcd9380, wcd9380_firmware, wcn685x-1, wcn685x-1_firmware, wcn685x-5, wcn685x-5_firmware, wcn785x-1, wcn785x-1_firmware, wcn785x-5
CVE-2022-40539 (published 2023-03-10)
Memory corruption in Automotive Android OS due to improper validation of array index.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: qualcomm
Affected products: qam8295p, qam8295p_firmware, qca6574au, qca6574au_firmware, qca6696, qca6696_firmware, qcc5100, qcc5100_firmware, qcs410, qcs410_firmware, qcs610, qcs610_firmware, sa6145p, sa6145p_firmware, sa6150p, sa6150p_firmware, sa6155p, sa6155p_firmware, sa8145p, sa8145p_firmware, sa8150p, sa8150p_firmware, sa8155p, sa8155p_firmware, sa8195p
CVE-2022-4054 (published 2023-01-26)
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible for a project maintainer to leak a webhook secret token by changing the webhook URL to an endpoint that allows them to capture request headers.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N)
Weakness: CWE-200
Affected vendors: gitlab
Affected products: gitlab
CVE-2022-40540 (published 2023-03-10)
Memory corruption due to buffer copy without checking the size of input while loading firmware in Linux Kernel.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: qualcomm
Affected products: sd888_5g, sd888_5g_firmware, sd_8_gen1_5g_firmware, sm8475, sw5100, sw5100_firmware, sw5100p, sw5100p_firmware, wcd9380, wcd9380_firmware, wcd9385, wcd9385_firmware, wcn3980, wcn3980_firmware, wcn3988, wcn3988_firmware, wcn6850, wcn6850_firmware, wcn6851, wcn6851_firmware, wcn6855, wcn6855_firmware, wcn6856, wcn6856_firmware, wcn7850
CVE-2022-4055 (published 2022-11-19)
When xdg-mail is configured to use thunderbird for mailto URLs, improper parsing of the URL can lead to additional headers being passed to thunderbird that should not be included per RFC 2368. An attacker can use this method to create a mailto URL that looks safe to users, but will actually attach files when clicked.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N)
Weakness: CWE-146
Affected vendors: freedesktop
Affected products: xdg-utils
CVE-2022-4057 (published 2023-01-02)
The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-425
Affected vendors: optimizingmatters
Affected products: autooptimize
CVE-2022-4058 (published 2022-12-19)
The Photo Gallery by 10Web WordPress plugin before 1.8.3 does not validate and escape some parameters before outputting them back in in JS code later on in another page, which could lead to Stored XSS issue when an attacker makes a logged in admin open a malicious URL or page under their control.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: 10web
Affected products: photo_gallery