rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-44594 WordPress All in One Time Clock Lite Plugin <= 1.3.320 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Codebangers All in One Time Clock Lite plugin <= 1.3.320 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Codebangers
product: All in One Time Clock Lite
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: sk4rl1ghT (Patchstack Alliance)
Published: 2023-04-23T09:02:00.078Z
CVE-2022-44595 WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerability
Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Melapress
product: WP 2FA
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Calvin Alkan / Snicco (Patchstack Alliance)
Published: 2024-03-21T17:12:32.657Z
CVE-2022-44606 
OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
Problem types: description: OS Command Injection
Affected products: vendor: UNIMO Technology Co., Ltd
product: UDR-JA1604/UDR-JA1608/UDR-JA1616
Published: 2022-12-07T00:00:00.000Z
CVE-2022-44608 
Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, which may result in a denial-of-service (DoS) condition.
Problem types: description: Uncontrolled Resource Consumption
Affected products: vendor: Cybozu, Inc.
product: Cybozu Remote Service
Published: 2022-12-07T00:00:00.000Z
CVE-2022-44610 
Improper authentication in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access.
Problem types: description: escalation of privilege
cwe_id: CWE-287
description: Improper authentication
Affected products: vendor: n/a
product: Intel(R) DCM software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.4
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: LOW
Published: 2023-05-10T13:17:13.986Z
CVE-2022-44611 
Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via adjacent access.
Problem types: description: escalation of privilege
cwe_id: CWE-20
description: Improper input validation
Affected products: vendor: n/a
product: Intel(R) Processors
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 6.9
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L
attackVector: ADJACENT_NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: CHANGED
confidentialityImpact: NONE
integrityImpact: HIGH
availabilityImpact: LOW
Published: 2023-08-11T02:37:00.887Z
CVE-2022-44612 
Use of hard-coded credentials in some Intel(R) Unison(TM) software before version 10.12 may allow an authenticated user user to potentially enable information disclosure via local access.
Problem types: description: information disclosure
cwe_id: CWE-798
description: Use of hard-coded credentials
Affected products: vendor: n/a
product: Intel(R) Unison(TM) software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 5.5
baseSeverity: MEDIUM
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
Published: 2023-08-11T02:37:21.903Z
CVE-2022-44617 
A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library.
Problem types: cwe_id: CWE-20
description: CWE-20->CWE-835
Affected products: vendor: n/a
product: libXpm
Published: 2023-02-06T00:00:00.000Z
CVE-2022-44619 
Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: escalation of privilege
cwe_id: CWE-922
description: Insecure storage of sensitive information
Affected products: vendor: n/a
product: Intel(R) DCM software
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 8.2
baseSeverity: HIGH
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
attackVector: LOCAL
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
Published: 2023-05-10T13:17:11.901Z
CVE-2022-44620 
Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
Problem types: description: Improper Authentication
Affected products: vendor: UNIMO Technology Co., Ltd
product: UDR-JA1604/UDR-JA1608/UDR-JA1616
Published: 2022-12-07T00:00:00.000Z
CVE-2022-44621 Apache Kylin: Command injection by Diagnosis Controller
Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
Problem types: description: Command injection
Affected products: vendor: Apache Software Foundation
product: Apache Kylin
default_status: unaffected
Credits: lang: en
value: Messy God <godimessy@gmail.com>
Published: 2022-12-30T10:31:52.614Z
CVE-2022-44622 
In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive
Problem types: cwe_id: CWE-284
description: CWE-284 Improper Access Control
Affected products: vendor: JetBrains
product: TeamCity
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 2.7
baseSeverity: LOW
Published: 2022-11-03T00:00:00.000Z
CVE-2022-44623 
In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings
Problem types: cwe_id: CWE-538
description: CWE-538 File and Directory Information Exposure
Affected products: vendor: JetBrains
product: TeamCity
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-11-03T00:00:00.000Z
CVE-2022-44624 
In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters
Problem types: cwe_id: CWE-532
description: CWE-532 Information Exposure Through Log Files
Affected products: vendor: JetBrains
product: TeamCity
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Published: 2022-11-03T00:00:00.000Z
CVE-2022-44625 WordPress Cyklodev WP Notify Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting') vulnerability in Zephilou Cyklodev WP Notify plugin <= 1.2.1 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Zephilou
product: Cyklodev WP Notify
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: sk4rl1ghT (Patchstack Alliance)
Published: 2023-04-13T11:29:41.873Z
CVE-2022-44626 WordPress Squirrly SEO (Peaks) plugin <= 12.1.20 - Broken Access Control vulnerability
Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.1.20.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Squirrly
product: SEO Plugin by Squirrly SEO
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 6.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Rafie Muhammad (Patchstack)
Published: 2024-03-25T11:15:37.560Z
CVE-2022-44627 WordPress Simple SEO plugin <= 1.8.12 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: David Cole
product: Simple SEO (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Mika (Patchstack Alliance)
Published: 2022-11-03T19:30:57.618Z
CVE-2022-44628 WordPress 4ECPS Web Forms plugin <= 0.2.17 - Auth. Stored Cross-Site Scripting (XSS) vulnerability
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: JumpDEMAND Inc.
product: 4ECPS Web Forms (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Hoang Van Hiep aka sk4rl1ghT (Patchstack Alliance)
Published: 2022-11-03T19:32:26.430Z
CVE-2022-44629 WordPress Catalyst Connect Zoho CRM Client Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Catalyst Connect
product: Catalyst Connect Zoho CRM Client Portal
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.9
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Hoang Van Hiep aka sk4rl1ghT (Patchstack Alliance)
Published: 2023-08-10T09:40:08.635Z
CVE-2022-44631 WordPress 1app Business Forms Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)
Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in 1app Technologies, Inc 1app Business Forms plugin <= 1.0.0 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: 1app Technologies, Inc
product: 1app Business Forms
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: sk4rl1ghT (Patchstack Alliance)
Published: 2023-04-23T08:48:09.641Z
CVE-2022-44632 WordPress Content Repeater – Custom Posts Simplified Plugin <= 1.1.13 is vulnerable to Cross Site Scripting (XSS)
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Denis Buka Content Repeater – Custom Posts Simplified plugin <= 1.1.13 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: Denis Buka
product: Content Repeater – Custom Posts Simplified
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: sk4rl1ghT (Patchstack Alliance)
Published: 2023-04-18T13:18:50.051Z
CVE-2022-44633 WordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerability
Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1.
Problem types: cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: YITH
product: YITH WooCommerce Gift Cards Premium
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Dave Jong (Patchstack)
Published: 2024-03-21T17:44:27.827Z
CVE-2022-44634 WordPress S2W – Import Shopify to WooCommerce plugin <= 1.1.12 - Auth. Arbitrary File Read vulnerability
Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress.
Problem types: description: Local File Inclusion (LFI)
Affected products: vendor: VillaTheme
product: S2W – Import Shopify to WooCommerce (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Tomasz Staszyszyn (Patchstack Alliance)
Published: 2022-11-18T21:58:16.612Z
CVE-2022-44635 Apache Fineract allowed an authenticated user to perform remote code execution due to path traversal
Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and prior versions. We recommend users to upgrade to 1.8.1.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Apache Software Foundation
product: Apache Fineract
Credits: lang: en
value: We would like to thank  Aman Sapra, co-captain of the Super Guesser CTF team & Security researcher at CRED, for reporting this issue, and the Apache Security team for their assistance.  We give kudos and karma to @Aleksandar Vidakovic for resolving this CVE. 
Published: 2022-11-29T00:00:00.000Z
CVE-2022-44636 
The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote control by pressing a button. This is fixed in xxx72510, E9172511 for 2021 models, xxxA1000, 4x2A0200 for 2022 models.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-13T00:00:00.000Z
CVE-2022-44637 
Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-44638 
In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-03T00:00:00.000Z
CVE-2022-44640 
Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-25T00:00:00.000Z
CVE-2022-44641 
In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-18T00:00:00.000Z
CVE-2022-44643 Access policy with access to all tenants and using label selectors has more access
A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not be applied when using this policy with the affected versions of the software. This issue affects: Grafana Labs Grafana Enterprise Metrics GEM 1.X versions prior to 1.7.1 on AMD64; GEM 2.X versions prior to 2.3.1 on AMD64.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 5.7
baseSeverity: MEDIUM
Published: 2022-12-21T01:21:43.830Z
CVE-2022-44644 Apache Linkis (incubating): The DatasourceManager module has a Local File Read Vulnerability
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J in the data source module, an authenticated attacker could read arbitrary local files by connecting a rogue MySQL server, By adding allowLoadLocalInfile to true in the JDBC parameter. Therefore, the parameters in the JDBC URL should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected. 

We recommend users upgrade the version of Linkis to version 1.3.1

Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Apache Software Foundation
product: Apache Linkis (incubating)
default_status: unaffected
Credits: lang: en
value: Department of Cyber Security Research (Jumbo, Unc1e), Beijing Zhiqian Technology Co., LTD
lang: en
value: s3gundo of Hundsun Tech 
Published: 2023-01-31T09:40:52.676Z
CVE-2022-44645 Apache Linkis (incubating): The DatasourceManager module has a serialization attack vulnerability
In Apache Linkis <=1.3.0 when used with the MySQL Connector/J, a deserialization vulnerability with possible remote code execution impact exists when an attacker has write access to a database and configures new datasource with a MySQL data source and malicious parameters. Therefore, the parameters in the jdbc url should be blacklisted. Versions of Apache Linkis <= 1.3.0 will be affected.

We recommend users to upgrade the version of Linkis to version 1.3.1.

Problem types: cwe_id: CWE-502
description: CWE-502 Deserialization of Untrusted Data
Affected products: vendor: Apache Software Foundation
product: Apache Linkis (incubating)
default_status: unaffected
Credits: lang: en
value: Tian Xin WU (Bearcat) , Vulnerability Researcher at Numen Cyber ​​​​Labs, Singapore.
lang: en
value: Department of Cyber Security Research (Jumbo, Unc1e)
lang: en
value: s3gundo of Hundsun Tech 
Published: 2023-01-31T09:38:07.355Z
CVE-2022-44646 
In JetBrains TeamCity version before 2022.10, no audit items were added upon editing a user's settings
Problem types: cwe_id: CWE-223
description: CWE-223: Omission of Security-relevant Information
Affected products: vendor: JetBrains
product: TeamCity
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: HIGH
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 2.2
baseSeverity: LOW
Published: 2022-11-03T00:00:00.000Z
CVE-2022-44647 
An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not the same as CVE-2022-44648.
Problem types: description: n/a
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Apex One
Published: 2022-11-21T17:55:47.486Z
CVE-2022-44648 
An Out-of-bounds read vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to disclose sensitive information on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

This is similar to, but not the same as CVE-2022-44647.
Problem types: description: n/a
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Apex One
Published: 2022-11-21T17:56:45.351Z
CVE-2022-44649 
An out-of-bounds access vulnerability in the Unauthorized Change Prevention service of Trend Micro Apex One and Apex One as a Service could allow a local attacker to elevate privileges on affected installations.

Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Problem types: description: n/a
Affected products: vendor: Trend Micro, Inc.
product: Trend Micro Apex One
Published: 2022-11-21T17:57:01.330Z