alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-44257 (published 2022-11-23)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: totolink
Affected products: lr350, lr350_firmware
CVE-2022-44258 (published 2022-11-23)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter command in the setTracerouteCfg function.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: totolink
Affected products: lr350, lr350_firmware
CVE-2022-44259 (published 2022-11-23)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: totolink
Affected products: lr350, lr350_firmware
CVE-2022-4426 (published 2023-01-09)
The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: wpswings
Affected products: mautic_integration_for_woocommerce
CVE-2022-44260 (published 2022-11-23)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: totolink
Affected products: lr350, lr350_firmware
CVE-2022-44261 (published 2023-02-10)
Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: averydennison
Affected products: monarch_printer_m9855, monarch_printer_m9855_firmware
CVE-2022-44262 (published 2022-12-01)
ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: ff4j
Affected products: ff4j
CVE-2022-44263 (published 2023-01-26)
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: dentsplysirona
Affected products: sidexis
CVE-2022-44264 (published 2023-01-26)
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-428
Affected vendors: dentsplysirona
Affected products: sidexis
CVE-2022-44267 (published 2023-02-06)
ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-404
Affected vendors: imagemagick
Affected products: imagemagick
CVE-2022-44268 (published 2023-02-06)
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: imagemagick
Affected products: imagemagick
CVE-2022-4427 (published 2022-12-19)
Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice
This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: otrs
Affected products: otrs
CVE-2022-44276 (published 2023-06-28)
In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: tecrail
Affected products: responsive_filemanager
CVE-2022-44277 (published 2022-12-02)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sanitization_management_system_project
Affected products: sanitization_management_system
CVE-2022-44278 (published 2022-11-23)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=user/manage_user&id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sanitization_management_system_project
Affected products: sanitization_management_system
CVE-2022-44279 (published 2022-11-29)
Garage Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /garage/php_action/createBrand.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: garage_management_system_project
Affected products: garage_management_system
CVE-2022-4428 (published 2023-01-11)
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients).

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: cloudflare
Affected products: warp
CVE-2022-44280 (published 2022-11-23)
Automotive Shop Management System v1.0 is vulnerable to Delete any file via /asms/classes/Master.php?f=delete_img.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)
Weakness: CWE-22
Affected vendors: automotive_shop_management_system_project
Affected products: automotive_shop_management_system
CVE-2022-44283 (published 2022-11-28)
AVS Audio Converter 10.3 is vulnerable to Buffer Overflow.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: avs4you
Affected products: avs_audio_converter
CVE-2022-44284 (published 2022-11-28)
Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: dinstar
Affected products: dag2000-16o, dag2000-16o_firmware
CVE-2022-44289 (published 2022-12-06)
Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: thinkphp
Affected products: thinkphp
CVE-2022-4429 (published 2023-01-10)
Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issue was fixed with Avira Security version 1.1.78

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-428
Affected vendors: avira
Affected products: avira_security
CVE-2022-44290 (published 2022-12-02)
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: webtareas_project
Affected products: webtareas
CVE-2022-44291 (published 2022-12-02)
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: webtareas_project
Affected products: webtareas
CVE-2022-44294 (published 2022-11-30)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manage_service&id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sanitization_management_system_project
Affected products: sanitization_management_system
CVE-2022-44295 (published 2022-11-30)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sanitization_management_system_project
Affected products: sanitization_management_system
CVE-2022-44296 (published 2022-11-30)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manage_remark.php?id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sanitization_management_system_project
Affected products: sanitization_management_system
CVE-2022-44297 (published 2023-01-26)
SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sscms
Affected products: siteserver_cms
CVE-2022-44298 (published 2023-01-27)
SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sscms
Affected products: siteserver_cms
CVE-2022-44299 (published 2023-02-16)
SiteServerCMS 7.1.3 sscms has a file read vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-22
Affected vendors: sscms
Affected products: siteserver_cms
CVE-2022-44303 (published 2022-12-13)
Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the "{schedule_job}" or "args" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: resque-scheduler_project
Affected products: resque-scheduler
CVE-2022-4431 (published 2023-01-16)
The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: pluginus
Affected products: fox_-_currency_switcher_professional_for_woocommerce
CVE-2022-44310 (published 2023-02-24)
In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-668
Affected vendors: ecdh_project
Affected products: ecdh
CVE-2022-44311 (published 2022-11-08)
html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elm_close(tree_node_t *nodo) at procesador.c. This vulnerability allows attackers to access sensitive files or cause a Denial of Service (DoS) via a crafted html file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-125
Affected vendors: html2xhtml_project
Affected products: html2xhtml
CVE-2022-44312 (published 2022-11-08)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in expression.c when called from ExpressionInfixOperator.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: picoc_project
Affected products: picoc
CVE-2022-44313 (published 2022-11-08)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when called from ExpressionParseFunctionCall.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: picoc_project
Affected products: picoc
CVE-2022-44314 (published 2022-11-08)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunctionCall.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: picoc_project
Affected products: picoc
CVE-2022-44315 (published 2022-11-08)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCall.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: picoc_project
Affected products: picoc
CVE-2022-44316 (published 2022-11-08)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanGetToken.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: picoc_project
Affected products: picoc
CVE-2022-44317 (published 2022-11-08)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioOutPutc function in cstdlib/stdio.c when called from ExpressionParseFunctionCall.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: picoc_project
Affected products: picoc
CVE-2022-44318 (published 2022-11-08)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionCall.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: picoc_project
Affected products: picoc
CVE-2022-44319 (published 2022-11-08)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from ExpressionParseFunctionCall.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: picoc_project
Affected products: picoc
CVE-2022-4432 (published 2023-01-05)
A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-126
Affected vendors: lenovo
Affected products: thinkpad_x13s, thinkpad_x13s_firmware
CVE-2022-44320 (published 2022-11-08)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from ExpressionParseFunctionCall.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: picoc_project
Affected products: picoc
CVE-2022-44321 (published 2022-11-08)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexSkipComment function in lex.c when called from LexScanGetToken.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: picoc_project
Affected products: picoc
CVE-2022-4433 (published 2023-01-05)
A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-126
Affected vendors: lenovo
Affected products: thinkpad_x13s, thinkpad_x13s_firmware
CVE-2022-4434 (published 2023-01-05)
A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS driver that could allow a local attacker with elevated privileges to cause information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-126
Affected vendors: lenovo
Affected products: thinkpad_x13s, thinkpad_x13s_firmware
CVE-2022-44343 (published 2023-02-06)
CRMEB 4.4.4 is vulnerable to Any File download.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-552
Affected vendors: crmeb
Affected products: crmeb
CVE-2022-44345 (published 2022-12-02)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=quotes/view_quote&id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sanitization_management_system_project
Affected products: sanitization_management_system
CVE-2022-44347 (published 2022-12-02)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=inquiries/view_inquiry&id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sanitization_management_system_project
Affected products: sanitization_management_system
CVE-2022-44348 (published 2022-12-02)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sanitization_management_system_project
Affected products: sanitization_management_system
CVE-2022-44349 (published 2023-09-01)
NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50 is vulnerable to Cross Site Scripting (XSS).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: navblue
Affected products: n-ops_\&_crew
CVE-2022-4435 (published 2023-01-05)
A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoRemoteConfigUpdateDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-126
Affected vendors: lenovo
Affected products: thinkpad_x13s, thinkpad_x13s_firmware
CVE-2022-44351 (published 2022-12-07)
Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: skycaiji
Affected products: skycaiji
CVE-2022-44354 (published 2022-11-29)
SolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: contec
Affected products: solarview_compact, solarview_compact_firmware
CVE-2022-44355 (published 2022-11-29)
SolarView Compact 7.0 is vulnerable to Cross-site Scripting (XSS) via /network_test.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: contec
Affected products: solarview_compact, solarview_compact_firmware
CVE-2022-44356 (published 2022-11-29)
WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-552
Affected vendors: wavlink
Affected products: wl-wn531g3, wl-wn531g3_firmware
CVE-2022-4436 (published 2022-12-14)
Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: chrome
CVE-2022-44361 (published 2022-12-07)
An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: zzcms
Affected products: zzcms
CVE-2022-44362 (published 2022-12-02)
Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/AddSysLogRule.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: tenda
Affected products: i21, i21_firmware
CVE-2022-44363 (published 2022-12-02)
Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setSnmpInfo.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: tenda
Affected products: i21, i21_firmware
CVE-2022-44365 (published 2022-12-02)
Tenda i21 V1.0.0.14(4656) has a stack overflow vulnerability via /goform/setSysPwd.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: tenda
Affected products: i21, i21_firmware
CVE-2022-44366 (published 2022-12-02)
Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setDiagnoseInfo.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: tenda
Affected products: i21, i21_firmware
CVE-2022-44367 (published 2022-12-02)
Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setUplinkInfo.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: tenda
Affected products: i21, i21_firmware
CVE-2022-44368 (published 2023-03-29)
NASM v2.16 was discovered to contain a null pointer deference in the NASM component
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: nasm
Affected products: netwide_assembler
CVE-2022-44369 (published 2023-03-29)
NASM 2.16 (development) is vulnerable to 476: Null Pointer Dereference via output/outaout.c.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: nasm
Affected products: netwide_assembler
CVE-2022-4437 (published 2022-12-14)
Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: chrome
CVE-2022-44370 (published 2023-03-29)
NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: nasm
Affected products: netwide_assembler
CVE-2022-44371 (published 2022-12-07)
hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: hope-boot_project
Affected products: hope-boot
CVE-2022-44373 (published 2022-12-07)
A stack overflow vulnerability exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (Version v1.0R, firmware version 1.01.B01) which may result in remote code execution.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: trendnet
Affected products: tew-820ap, tew-820ap_firmware
CVE-2022-44378 (published 2022-11-18)
Automotive Shop Management System v1.0 is vulnerable to SQL via /asms/classes/Master.php?f=delete_mechanic.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: automotive_shop_management_system_project
Affected products: automotive_shop_management_system
CVE-2022-44379 (published 2022-11-18)
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_service.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: automotive_shop_management_system_project
Affected products: automotive_shop_management_system
CVE-2022-4438 (published 2022-12-14)
Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: chrome
CVE-2022-44380 (published 2022-12-25)
Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: snipeitapp
Affected products: snipe-it
CVE-2022-44381 (published 2022-12-25)
Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-203
Affected vendors: snipeitapp
Affected products: snipe-it
CVE-2022-44384 (published 2022-11-17)
An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: rconfig
Affected products: rconfig
CVE-2022-44387 (published 2022-11-14)
EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: eyoucms
Affected products: eyoucms
CVE-2022-44389 (published 2022-11-14)
EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module. This vulnerability allows attackers to arbitrarily change Administrator account information.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Weakness: CWE-352
Affected vendors: eyoucms
Affected products: eyoucms
CVE-2022-4439 (published 2022-12-14)
Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. (Chromium security severity: High)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google, microsoft
Affected products: chrome, windows
CVE-2022-44390 (published 2022-11-14)
A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Record Number text field.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: eyoucms
Affected products: eyoucms
CVE-2022-44393 (published 2022-12-07)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: sanitization_management_system_project
Affected products: sanitization_management_system
CVE-2022-44399 (published 2022-11-28)
Poultry Farm Management System v1.0 contains a SQL injection vulnerability via the del parameter at /Redcock-Farm/farm/category.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: poultry_farm_management_system_project
Affected products: poultry_farm_management_system
CVE-2022-4440 (published 2022-12-14)
Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: google
Affected products: chrome
CVE-2022-44400 (published 2022-11-28)
Purchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order/admin/?page=system_info.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: purchase_order_management_system_project
Affected products: purchase_order_management_system
CVE-2022-44401 (published 2022-11-28)
Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-434
Affected vendors: online_tours_\&_travels_management_system_project
Affected products: online_tours_\&_travels_management_system
CVE-2022-44402 (published 2022-11-17)
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_transaction.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: automotive_shop_management_system_project
Affected products: automotive_shop_management_system
CVE-2022-44403 (published 2022-11-17)
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=user/manage_user&id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: automotive_shop_management_system_project
Affected products: automotive_shop_management_system
CVE-2022-4441 (published 2023-01-31)
Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation.
This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.9.0 before 04.9.1.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-266
Affected vendors: hitachi
Affected products: storage_plug-in
CVE-2022-44411 (published 2022-11-25)
Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' passwords via a bruteforce attack.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-319
Affected vendors: web_based_quiz_system_project
Affected products: web_based_quiz_system
CVE-2022-44413 (published 2022-11-18)
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/manage_mechanic.php?id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: automotive_shop_management_system_project
Affected products: automotive_shop_management_system
CVE-2022-44414 (published 2022-11-18)
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/services/manage_service.php?id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: automotive_shop_management_system_project
Affected products: automotive_shop_management_system
CVE-2022-44415 (published 2022-11-18)
Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/view_mechanic.php?id=.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: automotive_shop_management_system_project
Affected products: automotive_shop_management_system
CVE-2022-44419 (published 2023-05-09)
In modem, there is a possible missing verification of NAS Security Mode Command Replay Attacks in LTE. This could local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4442 (published 2023-01-16)
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: cozmoslabs
Affected products: custom_post_types_and_custom_fields_creator
CVE-2022-44420 (published 2023-05-09)
In modem, there is a possible missing verification of HashMME value in Security Mode Command. This could local denial of service with no additional execution privileges.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-345
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44421 (published 2023-02-12)
In wlan driver, there is a possible missing permission check. This could lead to local In wlan driver,  information disclosure.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44422 (published 2023-01-04)
In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44423 (published 2023-01-04)
In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44424 (published 2023-01-04)
In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44425 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44426 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44427 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-122
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44428 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-122
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44429 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-122
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4443 (published 2023-01-23)
The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N)
Affected vendors: brutebank
Affected products: brutebank
CVE-2022-44430 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-122
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44431 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44432 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-190
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44433 (published 2023-05-09)
In phoneEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44434 (published 2023-01-04)
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44435 (published 2023-01-04)
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44436 (published 2023-01-04)
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44437 (published 2023-01-04)
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44438 (published 2023-01-04)
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44439 (published 2023-01-04)
In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-862
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-4444 (published 2022-12-13)
A vulnerability was found in ipti br.tag. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.13.0 is able to address this issue. The name of the patch is 7e311be22d3a0a1b53e61cb987ba13d681d85f06. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215431.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-707
Affected vendors: ipti
Affected products: tag
CVE-2022-44440 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44441 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44442 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-125
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44443 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44444 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-191
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44445 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44446 (published 2023-01-04)
In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-126
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44447 (published 2023-02-12)
In wlan driver, there is a possible null pointer dereference issue due to a missing bounds check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-476
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44448 (published 2023-02-12)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-787
Affected vendors: google, unisoc
Affected products: android, s8000, sc7731e, sc9832e, sc9863a, t310, t606, t610, t612, t616, t618, t760, t770, t820
CVE-2022-44449 (published 2022-12-21)
Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: zenphoto
Affected products: zenphoto
CVE-2022-4445 (published 2023-02-13)
The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-89
Affected vendors: armandofiore
Affected products: fl3r_feelbox
CVE-2022-44451 (published 2023-07-21)
A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-824
Affected vendors: openbabel
Affected products: open_babel
CVE-2022-44455 (published 2022-12-08)
The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation. An unprivileged malicious application would be able to gain code execution within any application installed on the device or cause application crash.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-120
Affected vendors: openatom, openharmony
Affected products: openharmony