harinpurumandla/cve-severity-dataset huggingface dataset:
CVE-2022-24404 (2022)
Lack of cryptographic integrity check on TETRA air-interface encrypted traffic. Since a stream cipher is employed, this allows an active adversary to manipulate cleartext data in a bit-by-bit fashion.
CVSS v3.1 vector: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
CVE-2022-24405 (2022)
OX App Suite through 7.10.6 allows OS Command Injection via a serialized Java class to the Documentconverter API.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24406 (2022)
OX App Suite through 7.10.6 allows SSRF because multipart/form-data boundaries are predictable, and this can lead to injection into internal Documentconverter API calls.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVE-2022-24407 (2022)
In Cyrus SASL 2.1.17 through 2.1.27 before 2.1.28, plugins/sql.c does not escape the password for a SQL INSERT or UPDATE statement.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24408 (2022)
A vulnerability has been identified in SINUMERIK MC (All versions < V1.15 SP1), SINUMERIK ONE (All versions < V6.15 SP1). The sc SUID binary on affected devices provides several commands that are used to execute system commands or modify system files. A specific set of operations using sc could allow local attackers to escalate their privileges to root.
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24409 (2022)
Dell BSAFE SSL-J contains remediation for a covert timing channel vulnerability that may be exploited by malicious users to compromise the affected system. Only customers with active BSAFE maintenance contracts can receive details about this vulnerability. Public disclosure of the vulnerability details will be shared at a later date.
CVSS v3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2022-2441 (2022)
The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24410 (2022)
Dell BIOS contains an information exposure vulnerability. An unauthenticated local attacker with physical access to the system and knowledge of the system configuration could potentially exploit this vulnerability to read system information via debug interfaces.
CVSS v3.1 vector: AV:P/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H
CVE-2022-24411 (2022)
Dell PowerScale OneFS 8.2.2 and above contain an elevation of privilege vulnerability. A local attacker with ISI_PRIV_LOGIN_SSH and/or ISI_PRIV_LOGIN_CONSOLE could potentially exploit this vulnerability, leading to elevation of privilege. This could potentially allow users to circumvent PowerScale Compliance Mode guarantees.
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24412 (2022)
Dell EMC PowerScale OneFS 8.2.x - 9.3.0.x contain an improper handling of value vulnerability. An unprivileged network attacker could potentially exploit this vulnerability, leading to denial-of-service.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-24413 (2022)
Dell PowerScale OneFS, versions 8.2.2-9.3.x, contain a time-of-check-to-time-of-use vulnerability. A local user with access to the filesystem could potentially exploit this vulnerability, leading to data loss.
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
CVE-2022-24414 (2022)
Dell EMC CloudLink 7.1.3 and all earlier versions, Auth Token is exposed in GET requests. These request parameters can get logged in reverse proxies and server logs. Attackers may potentially use these tokens to access CloudLink server. Tokens should not be used in request URL to avoid such attacks.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
CVE-2022-24415 (2022)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS v3.1 vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-24416 (2022)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS v3.1 vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-24417 (2022)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS v3.1 vector: AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-24418 (2022)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS v3.1 vector: AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-24419 (2022)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS v3.1 vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-2442 (2022)
The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the   'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24420 (2022)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS v3.1 vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-24421 (2022)
Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution during SMM.
CVSS v3.1 vector: AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVE-2022-24422 (2022)
Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. A remote unauthenticated attacker may potentially exploit this vulnerability to gain access to the VNC Console.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVE-2022-24423 (2022)
Dell iDRAC8 versions prior to 2.83.83.83 contain a denial of service vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability to cause resource exhaustion in the webserver, resulting in a denial of service condition.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVE-2022-24424 (2022)
Dell EMC AppSync versions from 3.9 to 4.3 contain a path traversal vulnerability in AppSync server. A remote unauthenticated attacker may potentially exploit this vulnerability to gain unauthorized read access to the files stored on the server filesystem, with the privileges of the running web application.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24426 (2022)
Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24428 (2022)
Dell PowerScale OneFS, versions 8.2.x, 9.0.0.x, 9.1.0.x, 9.2.0.x, 9.2.1.x, and 9.3.0.x, contain an improper preservation of privileges. A remote filesystem user with a local account could potentially exploit this vulnerability, leading to an escalation of file privileges and information disclosure.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
CVE-2022-24429 (2022)
The package convert-svg-core before 0.6.3 are vulnerable to Arbitrary Code Injection when using a specially crafted SVG file. An attacker can read arbitrary files from the file system and then show the file content as a converted PNG file.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2022-2443 (2022)
The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce protection on the FreemindOptions() function found in the ~/freemind-wp-browser.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24431 (2022)
All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization.
CVSS v3.1 vector: AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24432 (2022)
Persistent cross-site scripting (XSS) in the web interface of ipDIO allows an authenticated remote attacker to introduce arbitrary JavaScript by injecting an XSS payload into specific fields. The XSS payload will be executed when a legitimate user attempts to upload, copy, download, or delete an existing configuration (Administrative Services).
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L
CVE-2022-24433 (2022)
The package simple-git before 3.3.0 are vulnerable to Command Injection via argument injection. When calling the .fetch(remote, branch, handlerFn) function, both the remote and branch parameters are passed to the git fetch subcommand. By injecting some git options it was possible to get arbitrary command execution.
CVSS v3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24434 (2022)
This affects all versions of package dicer. A malicious attacker can send a modified form to server, and crash the nodejs service. An attacker could sent the payload again and again so that the service continuously crashes.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-24435 (2022)
Cross-site scripting vulnerability in phpUploader v1.2 and earlier allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24436 (2022)
Observable behavioral in power management throttling for some Intel(R) Processors may allow an authenticated user to potentially enable information disclosure via network access.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24437 (2022)
The package git-pull-or-clone before 2.0.2 are vulnerable to Command Injection due to the use of the --upload-pack feature of git which is also supported for git clone. The source includes the use of the secure child process API spawn(). However, the outpath parameter passed to it may be a command-line argument to the git clone command and result in arbitrary command injection.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24439 (2022)
All versions of package gitpython are vulnerable to Remote Code Execution (RCE) due to improper user input validation, which makes it possible to inject a maliciously crafted remote URL into the clone command. Exploiting this vulnerability is possible because the library makes external calls to git without sufficient sanitization of input arguments.
CVSS v3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2444 (2022)
The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24440 (2022)
The package cocoapods-downloader before 1.6.0, from 1.6.2 and before 1.6.3 are vulnerable to Command Injection via git argument injection. When calling the Pod::Downloader.preprocess_options function and using git, both the git and branch parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection.
CVSS v3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24441 (2022)
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
CVSS v3.1 vector: AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
CVE-2022-24442 (2022)
JetBrains YouTrack before 2021.4.40426 was vulnerable to SSTI (Server-Side Template Injection) via FreeMarker templates.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24444 (2022)
Silverstripe silverstripe/framework through 4.10 allows Session Fixation.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVE-2022-24446 (2022)
An issue was discovered in Zoho ManageEngine Key Manager Plus 6.1.6. A user, with the level Operator, can see all SSH servers (and user information) even if no SSH server or user is associated to the operator.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE-2022-24447 (2022)
An issue was discovered in Zoho ManageEngine Key Manager Plus before 6200. A service exposed by the application allows a user, with the level Operator, to access stored SSL certificates and associated key pairs during export.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24448 (2022)
An issue was discovered in fs/nfs/dir.c in the Linux kernel before 5.16.5. If an application sets the O_DIRECTORY flag, and tries to open a regular file, nfs_atomic_open() performs a regular lookup. If a regular file is found, ENOTDIR should occur, but the server instead returns uninitialized data in the file descriptor.
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE-2022-24449 (2022)
Solar appScreener through 3.10.4, when a valid license is not present, allows XXE and SSRF attacks via a crafted XML document.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24450 (2022)
NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24454 (2022)
Windows Security Support Provider Interface Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24455 (2022)
Windows CD-ROM Driver Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24459 (2022)
Windows Fax and Scan Service Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2446 (2022)
The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24460 (2022)
Tablet Windows User Interface Application Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24461 (2022)
Microsoft Office Visio Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24462 (2022)
Microsoft Word Security Feature Bypass Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2022-24463 (2022)
Microsoft Exchange Server Spoofing Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24464 (2022)
.NET and Visual Studio Denial of Service Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-24465 (2022)
Microsoft Intune Portal for iOS Security Feature Bypass Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
CVE-2022-24466 (2022)
Windows Hyper-V Security Feature Bypass Vulnerability
CVSS v3.1 vector: AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
CVE-2022-24469 (2022)
Azure Site Recovery Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
CVE-2022-2447 (2022)
A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected.
CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24472 (2022)
Microsoft SharePoint Server Spoofing Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24474 (2022)
Windows Win32k Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24475 (2022)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVE-2022-24477 (2022)
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24479 (2022)
Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2448 (2022)
The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed.
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24480 (2022)
Outlook for Android Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:P/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24481 (2022)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24482 (2022)
Windows ALPC Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24483 (2022)
Windows Kernel Information Disclosure Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24484 (2022)
Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2022-24486 (2022)
Windows Kerberos Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24487 (2022)
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24489 (2022)
Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2449 (2022)
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2022-24490 (2022)
Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVE-2022-24491 (2022)
Windows Network File System Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24493 (2022)
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24494 (2022)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24495 (2022)
Windows Direct Show Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24496 (2022)
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24497 (2022)
Windows Network File System Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24498 (2022)
Windows iSCSI Target Service Information Disclosure Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24499 (2022)
Windows Installer Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2450 (2022)
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVE-2022-24502 (2022)
Windows HTML Platforms Security Feature Bypass Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
CVE-2022-24503 (2022)
Remote Desktop Protocol Client Information Disclosure Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
CVE-2022-24504 (2022)
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24505 (2022)
Windows ALPC Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24506 (2022)
Azure Site Recovery Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CVE-2022-24507 (2022)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24509 (2022)
Microsoft Office Visio Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24510 (2022)
Microsoft Office Visio Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24511 (2022)
Microsoft Office Word Tampering Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
CVE-2022-24512 (2022)
.NET and Visual Studio Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
CVE-2022-24515 (2022)
Azure Site Recovery Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CVE-2022-24516 (2022)
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24518 (2022)
Azure Site Recovery Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CVE-2022-24519 (2022)
Azure Site Recovery Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:H
CVE-2022-24521 (2022)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24522 (2022)
Skype Extension for Chrome Information Disclosure Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-24523 (2022)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CVE-2022-24525 (2022)
Windows Update Stack Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24527 (2022)
Microsoft Endpoint Configuration Manager Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2453 (2022)
Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV.
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24530 (2022)
Windows Installer Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24534 (2022)
Win32 Stream Enumeration Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24536 (2022)
Windows DNS Server Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24537 (2022)
Windows Hyper-V Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE-2022-24538 (2022)
Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2022-24539 (2022)
Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
CVE-2022-2454 (2022)
Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24540 (2022)
Windows ALPC Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24541 (2022)
Windows Server Service Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24542 (2022)
Windows Win32k Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24543 (2022)
Windows Upgrade Assistant Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24544 (2022)
Windows Kerberos Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24545 (2022)
Windows Kerberos Remote Code Execution Vulnerability
CVSS v3.1 vector: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24546 (2022)
Windows DWM Core Library Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24547 (2022)
Windows Digital Media Receiver Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24548 (2022)
Microsoft Defender Denial of Service Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2022-24549 (2022)
Windows AppX Package Manager Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2455 (2022)
A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allowed an authenticated and authorized user to exhaust server resources by importing a malicious project.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVE-2022-24550 (2022)
Windows Telephony Server Elevation of Privilege Vulnerability
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24551 (2022)
A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old password. An attacker could reset any local user password (including system/administrator user) using any available user This affects StarWind SAN and NAS v0.2 build 1633.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24552 (2022)
A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges. This affects StarWind SAN and NAS v0.2 build 1633.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24553 (2022)
An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2456 (2022)
An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24562 (2022)
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24563 (2022)
In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24564 (2022)
Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24565 (2022)
Checkmk <=2.0.0p19 Fixed in 2.0.0p20 and Checkmk <=1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting (XSS) vulnerability. The Alias of a site was not properly escaped when shown as condition for notifications.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24566 (2022)
In Checkmk <=2.0.0p19 fixed in 2.0.0p20 and Checkmk <=1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escaped when shown as condition, which can result in Cross Site Scripting (XSS).
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24568 (2022)
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2457 (2022)
A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24571 (2022)
Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24572 (2022)
Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit this Vulnerability, an admin views the registered user details.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24573 (2022)
A stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24574 (2022)
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2022-24575 (2022)
GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box.
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24576 (2022)
GPAC 1.0.1 is affected by Use After Free through MP4Box.
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2022-24577 (2022)
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen. (gf_utf8_wcslen is a renamed Unicode utf8_wcslen function.)
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24578 (2022)
GPAC 1.0.1 is affected by a heap-based buffer overflow in SFS_AddString () at bifs/script_dec.c.
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-2458 (2022)
XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, XML external entity injection lead to External Service interaction & Internal file read in Business Central and also Kie-Server APIs.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVE-2022-24581 (2022)
ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24582 (2022)
Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking. The parameter manage_user from User lists is vulnerable to XSS-Stored and PHPSESSID attacks. The malicious user can attack the system by using the already session which he has from inside and outside of the network.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24584 (2022)
Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credentials. When a user reprograms the OTP functionality by "writing" it on a token using the Yubico Personalization Tool, they can then upload the new configuration to Yubicos OTP validation servers. NOTE: the vendor disputes this because there is no way for a YubiKey device to prevent a user from deciding that a secret value, which is imported into the device, should also be stored elsewhere
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVE-2022-24585 (2022)
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24586 (2022)
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24587 (2022)
A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24588 (2022)
Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24589 (2022)
Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task parameter.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2022-2459 (2022)
An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was enabled.
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
CVE-2022-24590 (2022)
A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24594 (2022)
In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-24595 (2022)
Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-daemon. To exploit the vulnerability, an attacker should send a well-crafted HTTP (or WebSocket) request to the socket listened by the afb-daemon process. No credentials nor user interactions are required.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24599 (2022)
In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo function calls the copyrightstring function to get data, however, it dosn't use zero bytes to truncate the data.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVE-2022-2460 (2022)
The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24600 (2022)
Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24601 (2022)
Luocms v2.0 is affected by SQL Injection in /admin/manager/admin_mod.php. An attacker can obtain sensitive information through SQL injection statements.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2022-24602 (2022)
Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24603 (2022)
Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24604 (2022)
Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24605 (2022)
Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24606 (2022)
Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24607 (2022)
Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24608 (2022)
Luocms v2.0 is affected by Cross Site Scripting (XSS) in /admin/news/sort_add.php and /inc/function.php.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24609 (2022)
Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write an arbitrary shell file.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2461 (2022)
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVE-2022-24610 (2022)
Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVE-2022-24611 (2022)
Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wave network via crafted S0 NonceGet Z-Wave packages, utilizing included but absent NodeIDs.
CVSS v3.1 vector: AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2022-24612 (2022)
An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in a stored XSS.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24613 (2022)
metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2022-24614 (2022)
When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2022-24615 (2022)
zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVE-2022-24618 (2022)
Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer.
CVSS v3.1 vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2462 (2022)
The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2022-24620 (2022)
Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In this way, admin can steal webmaster's cookies to get the webmaster's access.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24627 (2022)
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24628 (2022)
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php.
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24629 (2022)
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to WebAdmin/admin/AudioCodes_files/ajax/.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2463 (2022)
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the software is running at the SYSTEM level, then the attacker will gain admin level privileges. User interaction is required for this exploit to be successful.
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVE-2022-24630 (2022)
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_command field that is executed.
CVSS v3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVE-2022-24631 (2022)
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is stored XSS via the ajaxTenants.php desc parameter.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24632 (2022)
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is directory traversal during file download via the BrowseFiles.php view parameter.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2022-24633 (2022)
All versions of FileCloud prior to 21.3 are vulnerable to user enumeration. The vulnerability exists in the parameter "path" passing "/SHARED/<username>". A malicious actor could identify the existence of users by requesting share information on specified share paths.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE-2022-24637 (2022)
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2022-2464 (2022)
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. Crafted malicious files can allow an attacker to traverse the file system when opened by ISaGRAF Workbench. If successfully exploited, an attacker could overwrite existing files and create additional files with the same permissions of the ISaGRAF Workbench software. User interaction is required for this exploit to be successful.
CVSS v3.1 vector: AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVE-2022-24643 (2022)
A stored cross-site scripting (XSS) issue was discovered in the OpenEMR Hospital Information Management System version 6.0.0.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVE-2022-24644 (2022)
ZZ Inc. KeyMouse Windows 3.08 and prior is affected by a remote code execution vulnerability during an unauthenticated update. To exploit this vulnerability, a user must trigger an update of an affected installation of KeyMouse.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE-2022-24647 (2022)
Cuppa CMS v1.0 was discovered to contain an arbitrary file deletion vulnerability via the unlink() function.
CVSS v3.1 vector: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CVE-2022-2465 (2022)
Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Deserialization of Untrusted Data vulnerability. ISaGRAF Workbench does not limit the objects that can be deserialized. This vulnerability allows attackers to craft a malicious serialized object that, if opened by a local user in ISaGRAF Workbench, may result in remote code execution. This vulnerability requires user interaction to be successfully exploited.
CVSS v3.1 vector: AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVE-2022-24651 (2022)
sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution through /user/upload/upload.
CVSS v3.1 vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H