alirezaaminzadeh/cve-riskrank huggingface dataset:
CVE-2022-44610 (published 2023-05-10)
Improper authentication in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: intel
Affected products: data_center_manager
CVE-2022-44611 (published 2023-08-11)
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via adjacent access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-20
Affected vendors: intel
Affected products: atom_x6200fe, atom_x6200fe_firmware, atom_x6211e, atom_x6211e_firmware, atom_x6212re, atom_x6212re_firmware, atom_x6413e, atom_x6413e_firmware, atom_x6414re, atom_x6414re_firmware, atom_x6425e, atom_x6425e_firmware, atom_x6425re, atom_x6425re_firmware, atom_x6427fe, atom_x6427fe_firmware, celeron_j6413, celeron_j6413_firmware, celeron_n6211, celeron_n6211_firmware, core_i3-1000g1, core_i3-1000g1_firmware, core_i3-1000g4, core_i3-1000g4_firmware, core_i3-1005g1
CVE-2022-44612 (published 2023-08-11)
Use of hard-coded credentials in some Intel(R) Unison(TM) software before version 10.12 may allow an authenticated user user to potentially enable information disclosure via local access.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-798
Affected vendors: intel
Affected products: unison
CVE-2022-44617 (published 2023-02-06)
A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-20
Affected vendors: x.org
Affected products: libxpm
CVE-2022-44619 (published 2023-05-10)
Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-922
Affected vendors: intel
Affected products: data_center_manager
CVE-2022-4462 (published 2023-03-09)
An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. This vulnerability could allow a user to unmask the Discord Webhook URL through viewing the raw API response.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Affected vendors: gitlab
Affected products: gitlab
CVE-2022-44620 (published 2022-12-07)
Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-287
Affected vendors: unimo
Affected products: udr-ja1604, udr-ja1604_firmware, udr-ja1608, udr-ja1608_firmware, udr-ja1616, udr-ja1616_firmware
CVE-2022-44621 (published 2022-12-30)
Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-77
Affected vendors: apache
Affected products: kylin
CVE-2022-44622 (published 2022-11-03)
In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Weakness: CWE-284
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-44623 (published 2022-11-03)
In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-538
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-44624 (published 2022-11-03)
In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-532
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-44625 (published 2023-04-13)
Auth. (admin+) Stored Cross-Site Scripting') vulnerability in Zephilou Cyklodev WP Notify plugin <= 1.2.1 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: cyclodev
Affected products: wp_notify
CVE-2022-44626 (published 2024-03-25)
Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.1.20.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
Weakness: CWE-862
Affected vendors: squirrly
Affected products: seo_plugin_by_squirrly_seo
CVE-2022-44627 (published 2022-11-03)
Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
Weakness: CWE-352
Affected vendors: coleds
Affected products: simple_seo
CVE-2022-44628 (published 2022-11-03)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: jumpdemand
Affected products: 4ecps_web_forms
CVE-2022-44629 (published 2023-08-10)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: catalystconnect
Affected products: catalyst_connect_zoho_crm_client_portal
CVE-2022-44631 (published 2023-04-23)
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in 1app Technologies, Inc 1app Business Forms plugin <= 1.0.0 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: 1app
Affected products: 1app_business_forms
CVE-2022-44632 (published 2023-04-18)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Denis Buka Content Repeater – Custom Posts Simplified plugin <= 1.1.13 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: content-repeater_project
Affected products: content-repeater
CVE-2022-44633 (published 2024-04-11)
Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-862
CVE-2022-44634 (published 2022-11-18)
Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-552
Affected vendors: villatheme
Affected products: s2w_-_import_shopify_to_woocommerce
CVE-2022-44635 (published 2022-11-29)
Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and prior versions. We recommend users to upgrade to 1.8.1.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: apache
Affected products: fineract
CVE-2022-44636 (published 2022-12-13)
The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote control by pressing a button. This is fixed in xxx72510, E9172511 for 2021 models, xxxA1000, 4x2A0200 for 2022 models.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-290
Affected vendors: samsung
Affected products: t-ksu2eakuc, t-ksu2eakuc_firmware, t-ksu2edeuc, t-ksu2edeuc_firmware, t-ksu2euab, t-ksu2euab_firmware, t-nklakuc, t-nklakuc_firmware, t-nkldeuc, t-nkldeuc_firmware, t-nkluabc, t-nkluabc_firmware, t-nkm2akuc, t-nkm2akuc_firmware, t-nkm2deuc, t-nkm2deuc_firmware, t-nkm2uabc, t-nkm2uabc_firmware, t-oscpakuc, t-oscpakuc_firmware, t-oscpdeuc, t-oscpdeuc_firmware, t-oscpuabc, t-oscpuabc_firmware, t-ptmakuc
CVE-2022-44637 (published 2022-12-12)
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: redmine
Affected products: redmine
CVE-2022-44638 (published 2022-11-03)
In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-190
Affected vendors: debian, fedoraproject, pixman
Affected products: debian_linux, fedora, pixman
CVE-2022-4464 (published 2023-01-16)
Themify Portfolio Post WordPress plugin before 1.2.1 does not validate and escapes some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privileged users such as admin.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: themify
Affected products: portfolio_post
CVE-2022-44640 (published 2022-12-25)
Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-415
Affected vendors: heimdal_project, samba
Affected products: heimdal, samba
CVE-2022-44641 (published 2022-11-18)
In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-776
Affected vendors: debian, linaro
Affected products: debian_linux, lava
CVE-2022-44643 (published 2022-12-20)
A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not be applied when using this policy with the affected versions of the software. This issue affects: Grafana Labs Grafana Enterprise Metrics GEM 1.X versions prior to 1.7.1 on AMD64; GEM 2.X versions prior to 2.3.1 on AMD64.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-284
Affected vendors: amd, grafana
Affected products: amd64, enterprise_metrics
CVE-2022-44644 (published 2023-01-31)
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. 

We recommend users upgrade the version of Linkis to version 1.3.1

Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-20
Affected vendors: apache
Affected products: linkis
CVE-2022-44645 (published 2023-01-31)
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected.

We recommend users to upgrade the version of Linkis to version 1.3.1.

Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-502
Affected vendors: apache
Affected products: linkis
CVE-2022-44646 (published 2022-11-03)
In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Weakness: CWE-223
Affected vendors: jetbrains
Affected products: teamcity
CVE-2022-44647 (published 2022-12-12)
An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not the same as CVE-2022-44648.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: microsoft, trendmicro
Affected products: apex_one, windows
CVE-2022-44648 (published 2022-12-12)
An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not the same as CVE-2022-44647.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-125
Affected vendors: microsoft, trendmicro
Affected products: apex_one, windows
CVE-2022-44649 (published 2022-12-12)
An out-of-bounds access vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attacker to elevate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: microsoft, trendmicro
Affected products: apex_one, windows
CVE-2022-4465 (published 2023-01-16)
The WP Video Lightbox WordPress plugin before 1.9.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: tipsandtricks-hq
Affected products: wp_video_lightbox
CVE-2022-44650 (published 2022-12-12)
A memory corruption vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attacker to elevate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-787
Affected vendors: microsoft, trendmicro
Affected products: apex_one, windows
CVE-2022-44651 (published 2022-12-12)
A Time-of-Check Time-Of-Use vulnerability in the Trend Micro Apex One and Apex One as a Service agent could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: trendmicro
Affected products: apex_one
CVE-2022-44652 (published 2022-12-12)
An improper handling of exceptional conditions vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-755
Affected vendors: trendmicro
Affected products: apex_one
CVE-2022-44653 (published 2022-12-12)
A security agent directory traversal vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: trendmicro
Affected products: apex_one
CVE-2022-44654 (published 2022-12-12)
Affected builds of Trend Micro Apex One and Apex One as a Service contain a monitor engine component that is complied without the /SAFESEH memory protection mechanism which helps to monitor for malicious payloads. The affected component's memory protection mechanism has been updated to enhance product security.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Weakness: CWE-122
Affected vendors: trendmicro
Affected products: apex_one
CVE-2022-4466 (published 2023-03-13)
The WordPress Infinite Scroll WordPress plugin before 5.6.0.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: connekthq
Affected products: ajax_load_more
CVE-2022-44666 (published 2022-12-13)
Windows Contacts Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44667 (published 2022-12-13)
Windows Media Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44668 (published 2022-12-13)
Windows Media Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44669 (published 2022-12-13)
Windows Error Reporting Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022
CVE-2022-4467 (published 2023-01-23)
The Search & Filter WordPress plugin before 1.2.16 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: codeamp
Affected products: search_\&_filter
CVE-2022-44670 (published 2022-12-13)
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-367
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44671 (published 2022-12-13)
Windows Graphics Component Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022
CVE-2022-44673 (published 2022-12-13)
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_7, windows_8.1, windows_server_2008
CVE-2022-44674 (published 2022-12-13)
Windows Bluetooth Driver Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44675 (published 2022-12-13)
Windows Bluetooth Driver Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44676 (published 2022-12-13)
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-362
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44677 (published 2022-12-13)
Windows Projected File System Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022
CVE-2022-44678 (published 2022-12-13)
Windows Print Spooler Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44679 (published 2022-12-13)
Windows Graphics Component Information Disclosure Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-4468 (published 2023-01-09)
The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: bootstrapped
Affected products: wp_recipe_maker
CVE-2022-44680 (published 2022-12-13)
Windows Graphics Component Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44681 (published 2022-12-13)
Windows Print Spooler Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44682 (published 2022-12-13)
Windows Hyper-V Denial of Service Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_11_22h2, windows_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44683 (published 2022-12-13)
Windows Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-416
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44684 (published 2023-12-20)
Windows Local Session Manager (LSM) Denial of Service Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10_20h2, windows_10_21h1, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_11_22h2, windows_server_2022
CVE-2022-44687 (published 2022-12-13)
Raw Image Extension Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: raw_image_extension, windows_10, windows_11
CVE-2022-44688 (published 2022-12-13)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Affected vendors: microsoft
Affected products: edge_chromium
CVE-2022-44689 (published 2022-12-13)
Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_server_2019, windows_server_2022, windows_subsystem_for_linux
CVE-2022-4469 (published 2023-01-16)
The Simple Membership WordPress plugin before 4.2.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: simple-membership-plugin
Affected products: simple_membership
CVE-2022-44690 (published 2022-12-13)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: sharepoint_foundation, sharepoint_server
CVE-2022-44691 (published 2022-12-13)
Microsoft Office OneNote Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-44692 (published 2022-12-13)
Microsoft Office Graphics Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-44693 (published 2022-12-13)
Microsoft SharePoint Server Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: sharepoint_enterprise_server, sharepoint_foundation, sharepoint_server
CVE-2022-44694 (published 2022-12-13)
Microsoft Office Visio Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-44695 (published 2022-12-13)
Microsoft Office Visio Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel, visio
CVE-2022-44696 (published 2022-12-13)
Microsoft Office Visio Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: 365_apps, office, office_long_term_servicing_channel
CVE-2022-44697 (published 2022-12-13)
Windows Graphics Component Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_7, windows_8.1, windows_rt_8.1, windows_server_2008, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44698 (published 2022-12-13)
Windows SmartScreen Security Feature Bypass Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
Affected vendors: microsoft
Affected products: windows_10_1607, windows_10_1809, windows_10_20h2, windows_10_21h1, windows_10_21h2, windows_10_22h2, windows_11_21h2, windows_server_2016, windows_server_2019, windows_server_2022
Added to CISA KEV catalog: 2022-12-13
KEV required action: Apply updates per vendor instructions.
CVE-2022-44699 (published 2022-12-13)
Azure Network Watcher Agent Security Feature Bypass Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Affected vendors: microsoft
Affected products: azure_network_watcher_agent
CVE-2022-4470 (published 2023-01-30)
The Widgets for Google Reviews WordPress plugin before 9.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: trustindex
Affected products: widgets_for_google_reviews
CVE-2022-44702 (published 2022-12-13)
Windows Terminal Remote Code Execution Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-94
Affected vendors: microsoft
Affected products: terminal, windows_10, windows_11
CVE-2022-44704 (published 2022-12-13)
Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_sysmon
CVE-2022-44707 (published 2022-12-13)
Windows Kernel Denial of Service Vulnerability
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Affected vendors: microsoft
Affected products: windows_10, windows_11, windows_8.1, windows_rt_8.1, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022
CVE-2022-44708 (published 2022-12-13)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: edge, edge_chromium
CVE-2022-4471 (published 2023-02-13)
The YARPP WordPress plugin before 5.30.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: yarpp
Affected products: yet_another_related_posts_plugin
CVE-2022-44710 (published 2022-12-13)
DirectX Graphics Kernel Elevation of Privilege Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H)
Affected vendors: microsoft
Affected products: windows_11
CVE-2022-44713 (published 2022-12-13)
Microsoft Outlook for Mac Spoofing Vulnerability
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Weakness: CWE-290
Affected vendors: microsoft
Affected products: office, office_long_term_servicing_channel
CVE-2022-44715 (published 2023-01-27)
Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: netscout
Affected products: ngeniusone
CVE-2022-44717 (published 2023-01-27)
An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 1 of 2). After successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host. The attack vector is Network, and the Attack Complexity required is High. Privileges required are administrator, User Interaction is required, and Scope is unchanged. The user must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: netscout
Affected products: ngeniusone
CVE-2022-44718 (published 2023-01-27)
An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host. The attack vector is Network, and the Attack Complexity required is High. Privileges required are administrator, User Interaction is required, and Scope is unchanged. The user must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host.
Severity: LOW (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-601
Affected vendors: netscout
Affected products: ngeniusone
CVE-2022-44719 (published 2023-06-29)
An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-732
Affected vendors: ucopia
Affected products: wireless_appliance, wireless_appliance_firmware
CVE-2022-4472 (published 2023-01-30)
The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: simple_sitemap_project
Affected products: simple_sitemap
CVE-2022-44720 (published 2023-06-29)
An issue was discovered in Weblib Ucopia before 6.0.13. OS Command Injection injection can occur, related to chroot.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-78
Affected vendors: ucopia
Affected products: wireless_appliance, wireless_appliance_firmware
CVE-2022-44724 (published 2022-11-04)
The Handy Tip macro in Stiltsoft Handy Macros for Confluence Server/Data Center 3.x before 3.5.5 allows remote attackers to inject arbitrary HTML or JavaScript via a Cross-Site Scripting (XSS) vulnerability.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: stiltsoft
Affected products: handy_macros_for_confluence
CVE-2022-44725 (published 2022-11-17)
OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is loaded by LDS (running as a high-privilege user).
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-732
Affected vendors: opcfoundation
Affected products: local_discovery_server
CVE-2022-44726 (published 2023-04-17)
The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: timesheets-for-jira
Affected products: timesheet_tracking
CVE-2022-44727 (published 2022-11-10)
The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Weakness: CWE-89
Affected vendors: lineagrafica
Affected products: eu_cookie_law_gdpr
CVE-2022-44729 (published 2023-08-22)
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H)
Weakness: CWE-918
Affected vendors: apache, debian
Affected products: debian_linux, xml_graphics_batik
CVE-2022-4473 (published 2023-02-13)
The Widget Shortcode WordPress plugin through 0.3.5 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: widget_shortcode_project
Affected products: widget_shortcode
CVE-2022-44730 (published 2023-08-22)
Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

A malicious SVG can probe user profile / data and send it directly as parameter to a URL.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N)
Weakness: CWE-918
Affected vendors: apache, debian
Affected products: debian_linux, xml_graphics_batik
CVE-2022-44731 (published 2022-12-13)
A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024), SIMATIC WinCC OA V3.18 (All versions < V3.18 P014). The affected component allows to inject custom arguments to the Ultralight Client backend application under certain circumstances.

This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script).
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Weakness: CWE-88
Affected vendors: siemens
Affected products: simatic_wincc_oa
CVE-2022-44732 (published 2022-11-07)
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: acronis
Affected products: cyber_protect_home_office
CVE-2022-44733 (published 2022-11-07)
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-269
Affected vendors: acronis
Affected products: cyber_protect_home_office
CVE-2022-44734 (published 2023-04-16)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: bestwebsoft
Affected products: car_rental
CVE-2022-44735 (published 2023-04-18)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gus Sevilla WP Clictracker plugin <= 1.0.5 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: wp_clictracker_project
Affected products: wp_clictracker
CVE-2022-44736 (published 2022-11-17)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Chameleon plugin <= 1.4.3 on WordPress.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: chameleon_project
Affected products: chameleon
CVE-2022-44737 (published 2022-11-22)
Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security (AIOS) – Security and Firewall (WordPress plugin) <= 5.1.0 on WordPress.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: tipsandtricks-hq
Affected products: all_in_one_wp_security_\&_firewall
CVE-2022-44738 (published 2023-11-07)
Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-1236
Affected vendors: patrickrobrecht
Affected products: posts_and_users_stats
CVE-2022-44739 (published 2023-05-22)
Cross-Site Request Forgery (CSRF) vulnerability in ThingsForRestaurants Quick Restaurant Reservations plugin <= 1.5.4 versions.
Severity: CRITICAL (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: thingsforrestaurants
Affected products: quick_restaurant_reservations
CVE-2022-4474 (published 2023-01-23)
The Easy Social Feed WordPress plugin before 6.4.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Affected vendors: easysocialfeed
Affected products: easy_social_feed
CVE-2022-44740 (published 2022-11-18)
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Creative Mail plugin <= 1.5.4 on WordPress.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-352
Affected vendors: constantcontact
Affected products: creative_mail
CVE-2022-44741 (published 2022-11-08)
Cross-Site Request Forgery (CSRF) vulnerability leading to Cross-Site Scripting (XSS) in David Anderson Testimonial Slider plugin <= 1.3.1 on WordPress.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-79
Affected vendors: slidervilla
Affected products: testimonial_slider
CVE-2022-44742 (published 2023-03-23)
Auth. (admin+) Stored Cross-Site Scripting vulnerability in Yannick Lefebvre Community Events plugin <= 1.4.8 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: community_events_project
Affected products: community_events
CVE-2022-44743 (published 2023-04-23)
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in BlueGlass Jobs for WordPress plugin <= 2.5.11.2 versions.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N)
Weakness: CWE-79
Affected vendors: blueglass
Affected products: jobs_for_wordpress
CVE-2022-44744 (published 2022-11-07)
Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Weakness: CWE-427
Affected vendors: acronis
Affected products: cyber_protect_home_office
CVE-2022-44745 (published 2022-11-07)
Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-532
Affected vendors: acronis
Affected products: cyber_protect_home_office
CVE-2022-44746 (published 2022-11-07)
Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Severity: MEDIUM (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Weakness: CWE-200
Affected vendors: acronis
Affected products: cyber_protect_home_office
CVE-2022-44747 (published 2022-11-07)
Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-610
Affected vendors: acronis
Affected products: cyber_protect_home_office
CVE-2022-44748 (published 2022-11-24)
A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'.





An attacker can create a KNIME workflow that, when being uploaded, can overwrite arbitrary files that the operating system user running the KNIME Server process has write access to. The user must be authenticated and have permissions to upload files to KNIME Server.


This can impact data integrity (file contents are changed) or cause errors in other software (vital files being corrupted). It can even lead to remote code execution if executable files are being replaced and subsequently executed by the KNIME Server process user. In all cases the attacker has to know the location of files on the server's file system, though.

Note that users that have permissions to upload workflows usually also have permissions to run them on the KNIME Server and can therefore already execute arbitrary code in the context of the KNIME Executor's operating system user.

There is no workaround to prevent this vulnerability from being exploited. Updates to fixed versions 4.13.6, 4.14.3, or 4.15.3 are advised.



Severity: HIGH (CVSS 3.1 vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Weakness: CWE-22
Affected vendors: knime
Affected products: knime_server