alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-48335 (published 2023-06-26)
Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagVerifyProvisioning integer overflow and resultant buffer overflow.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: widevine
Affected products: trusted_application
CVE-2022-48336 (published 2023-06-26)
Widevine Trusted Application (TA) 5.0.0 through 7.1.1 has a PRDiagParseAndStoreData integer overflow and resultant buffer overflow.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: widevine
Affected products: trusted_application
CVE-2022-48337 (published 2023-02-20)
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a victim may use the "etags -u *" command (suggested in the etags documentation) in a situation where the current working directory has contents that depend on untrusted input.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: debian, gnu
Affected products: debian_linux, emacs
CVE-2022-48338 (published 2023-02-20)
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the external command gem is called through shell-command-to-string, but the feature-name parameters are not escaped. Thus, malicious Ruby source files may cause commands to be executed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: gnu
Affected products: emacs
CVE-2022-48339 (published 2023-02-20)
An issue was discovered in GNU Emacs through 28.2. htmlfontify.el has a command injection vulnerability. In the hfy-istext-command function, the parameter file and parameter srcdir come from external input, and parameters are not escaped. If a file name or directory name contains shell metacharacters, code may be executed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-116
Affected vendors: gnu
Affected products: emacs
CVE-2022-4834 (published 2023-01-30)
The CPT Bootstrap Carousel WordPress plugin through 1.12 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: cpt_bootstrap_carousel_project
Affected products: cpt_bootstrap_carousel
CVE-2022-48340 (published 2023-02-21)
In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-free.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-416
Affected vendors: gluster
Affected products: glusterfs
CVE-2022-48341 (published 2023-02-23)
ThingsBoard 3.4.1 could allow a remote authenticated attacker to achieve Vertical Privilege Escalation. A Tenant Administrator can obtain System Administrator dashboard access by modifying the scope via the scopes parameter.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: thingsboard
Affected products: thingsboard
CVE-2022-48342 (published 2023-02-23)
In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-1188
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-48343 (published 2023-02-23)
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-48344 (published 2023-02-23)
In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the group creation process.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-48345 (published 2023-02-24)
sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: paypal
Affected products: braintree\/sanitize-url
CVE-2022-48346 (published 2023-03-27)
The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48347 (published 2023-03-27)
The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48348 (published 2023-03-27)
The MediaProvider module has a vulnerability of unauthorized data read. Successful exploitation of this vulnerability may affect confidentiality and integrity.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-200
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48349 (published 2023-03-27)
The control component has a spoofing vulnerability. Successful exploitation of this vulnerability may affect confidentiality and availability.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H)
Weakness: CWE-290
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-4835 (published 2023-01-30)
The Social Sharing Toolkit WordPress plugin through 2.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: linksalpha
Affected products: social_sharing_toolkit
CVE-2022-48350 (published 2023-03-27)
The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48351 (published 2023-03-27)
The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect availability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48352 (published 2023-03-27)
Some smartphones have data initialization issues. Successful exploitation of this vulnerability may cause a system panic.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-665
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48353 (published 2023-03-27)
Some smartphones have configuration issues. Successful exploitation of this vulnerability may cause kernel privilege escalation, which results in system service exceptions.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48354 (published 2023-03-27)
The Bluetooth module has a heap out-of-bounds write vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48355 (published 2023-03-27)
The Bluetooth module has a heap out-of-bounds read vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48356 (published 2023-03-27)
The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recognition.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48357 (published 2023-03-27)
Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-770
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48358 (published 2023-03-27)
The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:H)
Weakness: CWE-601
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48359 (published 2023-03-27)
The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-915
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-4836 (published 2023-02-06)
The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: pickplugins
Affected products: breadcrumb
CVE-2022-48360 (published 2023-03-27)
The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-276
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48361 (published 2023-03-27)
The Always On Display (AOD) has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a failure in reading AOD theme resources.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-22
Affected vendors: huawei
Affected products: emui, harmonyos
CVE-2022-48362 (published 2023-02-25)
Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: zohocorp
Affected products: manageengine_desktop_central
CVE-2022-48363 (published 2023-02-26)
In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain situations involving truncated files. Eventually there is an assertion failure in libmpdclient because libqtappfw passes in a NULL pointer.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-617
Affected vendors: linuxfoundation, musicpd
Affected products: automotive_grade_linux, music_player_daemon
CVE-2022-48364 (published 2023-03-06)
The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-287
Affected vendors: joinmastodon
Affected products: mastodon
CVE-2022-48365 (published 2023-03-12)
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: ibexa
Affected products: digital_experience_platform, ez_platform, ez_platform_kernel
CVE-2022-48366 (published 2023-03-12)
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-362
Affected vendors: ibexa
Affected products: commerce, digital_experience_platform, ez_platform, ez_platform_kernel, ezplatform-page-builder, jmspaymentcorebundle, kernel
CVE-2022-48367 (published 2023-03-12)
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: ibexa
Affected products: digital_experience_platform, ez_platform_kernel, ezplatform-http-cache-fastly, fastly, kernel
CVE-2022-48368 (published 2023-05-09)
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48369 (published 2023-05-09)
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4837 (published 2023-01-30)
The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: machothemes
Affected products: cpo_companion
CVE-2022-48370 (published 2023-05-09)
In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48371 (published 2023-05-09)
In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48372 (published 2023-05-09)
In bootcp service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48373 (published 2023-05-09)
In tee service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48374 (published 2023-05-09)
In tee service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48375 (published 2023-05-09)
In contacts service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48376 (published 2023-05-09)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48377 (published 2023-05-09)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48378 (published 2023-05-09)
In engineermode service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48379 (published 2023-05-09)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4838 (published 2023-02-06)
The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: codection
Affected products: clean_login
CVE-2022-48380 (published 2023-05-09)
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48381 (published 2023-05-09)
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48382 (published 2023-05-09)
In log service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48383 (published 2023-05-09)
.In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48384 (published 2023-05-09)
In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48385 (published 2023-05-09)
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48386 (published 2023-05-09)
the apipe driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-416
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48387 (published 2023-05-09)
the apipe driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48388 (published 2023-05-09)
In powerEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48389 (published 2023-05-09)
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4839 (published 2022-12-29)
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: usememos
Affected products: memos
CVE-2022-48390 (published 2023-06-06)
In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48391 (published 2023-06-06)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48392 (published 2023-06-06)
In dialer service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4840 (published 2022-12-29)
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: usememos
Affected products: memos
CVE-2022-4841 (published 2022-12-29)
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: usememos
Affected products: memos
CVE-2022-4842 (published 2023-01-12)
A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: linux
Affected products: linux_kernel
CVE-2022-48422 (published 2023-03-19)
ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: linux, onlyoffice
Affected products: document_server, linux_kernel
CVE-2022-48423 (published 2023-03-19)
In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: linux
Affected products: linux_kernel
CVE-2022-48424 (published 2023-03-19)
In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: linux
Affected products: linux_kernel
CVE-2022-48425 (published 2023-03-19)
In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-763
Affected vendors: linux
Affected products: linux_kernel
CVE-2022-48426 (published 2023-03-27)
In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-48427 (published 2023-03-27)
In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-48428 (published 2023-03-27)
In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-48429 (published 2023-03-27)
In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jetbrains
Affected products: hub
CVE-2022-4843 (published 2022-12-29)
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: radare
Affected products: radare2
CVE-2022-48430 (published 2023-03-29)
In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: jetbrains
Affected products: intellij_idea
CVE-2022-48431 (published 2023-03-29)
In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-345
Affected vendors: jetbrains
Affected products: intellij_idea
CVE-2022-48432 (published 2023-03-29)
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Weakness: CWE-1188
Affected vendors: jetbrains
Affected products: intellij_idea
CVE-2022-48433 (published 2023-03-29)
In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-522
Affected vendors: jetbrains
Affected products: intellij_idea
CVE-2022-48434 (published 2023-03-29)
libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: ffmpeg
Affected products: ffmpeg
CVE-2022-48435 (published 2023-04-04)
In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-532
Affected vendors: jetbrains
Affected products: phpstorm
CVE-2022-48437 (published 2023-04-12)
An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors that occur during leaf certificate verification, and therefore an incorrect error is returned. This behavior occurs when there is an installed verification callback that instructs the verifier to continue upon detecting an invalid certificate.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-295
Affected vendors: openbsd
Affected products: libressl, openbsd
CVE-2022-48438 (published 2023-06-06)
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48439 (published 2023-06-06)
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4844 (published 2022-12-29)
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: usememos
Affected products: memos
CVE-2022-48440 (published 2023-06-06)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48441 (published 2023-06-06)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48442 (published 2023-06-06)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48443 (published 2023-06-06)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48444 (published 2023-06-06)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48445 (published 2023-06-06)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48446 (published 2023-06-06)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48447 (published 2023-06-06)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48448 (published 2023-06-06)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4845 (published 2022-12-29)
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Weakness: CWE-352
Affected vendors: usememos
Affected products: memos
CVE-2022-48450 (published 2023-07-12)
In bluetooth service, there is a possible missing params check.  This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48451 (published 2023-07-12)
In bluetooth service, there is a possible out of bounds write due to race condition.  This could lead to local denial of service with System execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-362
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48452 (published 2023-09-04)
In Ifaa service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48453 (published 2023-09-04)
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, sc7731e
CVE-2022-48454 (published 2023-11-01)
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48455 (published 2023-11-01)
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48456 (published 2023-11-01)
In camera driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48457 (published 2023-11-01)
In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48458 (published 2023-11-01)
In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48459 (published 2023-11-01)
In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4846 (published 2022-12-29)
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: usememos
Affected products: memos
CVE-2022-48460 (published 2023-11-01)
In setting service, there is a possible undefined behavior due to incorrect error handling. This could lead to local denial of service with no additional execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: google, unisoc
Affected products: android, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48461 (published 2023-11-01)
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48462 (published 2023-12-04)
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48463 (published 2023-12-04)
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48464 (published 2023-12-04)
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-48468 (published 2023-04-13)
protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: protobuf-c_project
Affected products: protobuf-c
CVE-2022-48469 (published 2023-06-16)
There is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers. 
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-290
Affected vendors: huawei
Affected products: b535-232a, b535-232a_firmware
CVE-2022-4847 (published 2022-12-29)
Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-941
Affected vendors: usememos
Affected products: memos
CVE-2022-48470 (published 2024-12-28)
Huawei HiLink AI Life product has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions.(Vulnerability ID:HWPSIRT-2022-42291)

This vulnerability has been assigned a (CVE)ID:CVE-2022-48470
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L)
Weakness: CWE-305
Affected vendors: huawei
Affected products: hilink_ai_life
CVE-2022-48471 (published 2023-06-16)
There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-436
Affected vendors: huawei
Affected products: bisheng-wnm, bisheng-wnm_firmware
CVE-2022-48472 (published 2023-06-16)
A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution. Affected product versions include:BiSheng-WNM versions OTA-BiSheng-FW-2.0.0.211-beta,BiSheng-WNM FW 3.0.0.325,BiSheng-WNM FW 2.0.0.211.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: huawei
Affected products: bisheng-wnm, bisheng-wnm_firmware, ota-bisheng_firmware
CVE-2022-48473 (published 2023-06-16)
There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-436
Affected vendors: huawei
Affected products: bisheng-wnm, bisheng-wnm_firmware
CVE-2022-48474 (published 2023-09-12)
Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Sending a malicious request could cause the server to check if an unrecognized component is up to date, causing a memory failure error that shuts down the process.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-400
Affected vendors: cbm
Affected products: control_de_ciber
CVE-2022-48475 (published 2023-09-12)
Buffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function. Sending a modified request by the attacker could cause a Buffer Overflow when the adminitrator tries to accept or delete the print query created by the request.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-400
Affected vendors: cbm
Affected products: control_de_ciber