rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-42530 
In Pixel firmware, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-242331893References: N/A
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-42531 
In mmu_map_for_fw of gs_ldfw_load.c, there is a possible mitigation bypass due to Permissive Memory Allocation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-231500967References: N/A
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-42532 
In Pixel firmware, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-242332610References: N/A
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-42533 
In shared_metadata_init of SharedMetadata.cpp, there is a possible out of bounds write due to an integer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-239415718References: N/A
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-11-17T00:00:00.000Z
CVE-2022-42534 
In trusty_ffa_mem_reclaim of shared-mem-smcall.c, there is a possible privilege escalation due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-237838301References: N/A
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-42535 
In a query in MmsSmsProvider.java, there is a possible access to restricted tables due to SQL injection. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224770183
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-42536 
Remote code execution
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-11-29T21:29:46.076Z
CVE-2022-42537 
Remote code execution
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-11-29T21:29:46.269Z
CVE-2022-42538 
Elevation of privilege
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-11-29T21:29:46.455Z
CVE-2022-42539 
Information disclosure
Problem types: description: Information disclosure
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-11-29T21:29:46.662Z
CVE-2022-42540 
Elevation of privilege
Problem types: description: Elevation of privilege
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-11-29T21:29:46.883Z
CVE-2022-42541 
Remote code execution
Problem types: description: Remote code execution
Affected products: vendor: Google
product: Android
default_status: unaffected
Published: 2023-11-29T21:29:47.079Z
CVE-2022-42542 
In phNxpNciHal_core_initialized of phNxpNciHal.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-231445184
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-42543 
In fdt_path_offset_namelen of fdt_ro.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android kernelAndroid ID: A-249998113References: N/A
Problem types: description: Information disclosure
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-42544 
In getView of AddAppNetworksFragment.java, there is a possible way to mislead the user about network add requests due to improper input validation. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Android ID: A-224545390
Problem types: description: Elevation of privilege
Affected products: vendor: n/a
product: Android
Published: 2022-12-16T00:00:00.000Z
CVE-2022-42698 WordPress Api2Cart Bridge Connector plugin <= 1.1.0 - Arbitrary File Upload vulnerability
Unauth. Arbitrary File Upload vulnerability in WordPress Api2Cart Bridge Connector plugin <= 1.1.0 on WordPress.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: API2Cart
product: Api2Cart Bridge Connector (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Dave Jong (Patchstack)
Published: 2022-11-18T22:15:04.205Z
CVE-2022-42699 WordPress Easy WP SMTP Plugin <= 1.5.1 is vulnerable to Remote Code Execution (RCE)
Auth. Remote Code Execution vulnerability in Easy WP SMTP plugin <= 1.5.1 on WordPress.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: WPecommerce, Alexanderfoxc
product: Easy WP SMTP
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.1
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Tomasz Staszyszyn (Patchstack Alliance)
Published: 2022-12-06T22:00:55.421Z
CVE-2022-42703 
mm/rmap.c in the Linux kernel before 5.19.7 has a use-after-free related to leaf anon_vma double reuse.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-09T00:00:00.000Z
CVE-2022-42704 
A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Diego allows remote attackers to inject arbitrary web script via the Standard Ticket Conversations widget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-12T00:00:00.000Z
CVE-2022-42705 
A use-after-free in res_pjsip_pubsub.c in Sangoma Asterisk 16.28, 18.14, 19.6, and certified/18.9-cert2 may allow a remote authenticated attacker to crash Asterisk (denial of service) by performing activity on a subscription via a reliable transport at the same time that Asterisk is also performing activity on that subscription.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-05T00:00:00.000Z
CVE-2022-42706 
An issue was discovered in Sangoma Asterisk through 16.28, 17 and 18 through 18.14, 19 through 19.6, and certified through 18.9-cert1. GetConfig, via Asterisk Manager Interface, allows a connected application to access files outside of the asterisk configuration directory, aka Directory Traversal.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-05T00:00:00.000Z
CVE-2022-42707 
In Mahara 21.04 before 21.04.7, 21.10 before 21.10.5, 22.04 before 22.04.3, and 22.10 before 22.10.0, embedded images are accessible without a sufficient permission check under certain conditions.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-06T00:00:00.000Z
CVE-2022-42710 
Nice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are vulnerable to Stored Cross-Site Scripting (XSS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-01-03T00:00:00.000Z
CVE-2022-42711 
In Progress WhatsUp Gold before 22.1.0, an SNMP MIB Walker application endpoint failed to adequately sanitize malicious input. This could allow an unauthenticated attacker to execute arbitrary code in a victim's browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-12T00:00:00.000Z
CVE-2022-42715 
A reflected XSS vulnerability exists in REDCap before 12.04.18 in the Alerts & Notifications upload feature. A crafted CSV file will, when uploaded, trigger arbitrary JavaScript code execution.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-12T00:00:00.000Z
CVE-2022-42716 
An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Valhall r29p0 through r40P0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-12T00:00:00.000Z
CVE-2022-42717 
An issue was discovered in Hashicorp Packer before 2.3.1. The recommended sudoers configuration for Vagrant on Linux is insecure. If the host has been configured according to this documentation, non-privileged users on the host can leverage a wildcard in the sudoers configuration to execute arbitrary commands as root.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-11T00:00:00.000Z
CVE-2022-42718 
Incorrect default permissions in the installation folder for NI LabVIEW Command Line Interface (CLI) may allow an authenticated user to potentially enable escalation of privilege via local access.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-01T00:00:00.000Z
CVE-2022-42719 
A use-after-free in the mac80211 stack when parsing a multi-BSSID element in the Linux kernel 5.2 through 5.19.x before 5.19.16 could be used by attackers (able to inject WLAN frames) to crash the kernel and potentially execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-42720 
Various refcounting bugs in the multi-BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to trigger use-after-free conditions to potentially execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-42721 
A list management bug in BSS handling in the mac80211 stack in the Linux kernel 5.1 through 5.19.x before 5.19.16 could be used by local attackers (able to inject WLAN frames) to corrupt a linked list and, in turn, potentially execute code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-42722 
In the Linux kernel 5.8 through 5.19.x before 5.19.16, local attackers able to inject WLAN frames into the mac80211 stack could cause a NULL pointer dereference denial-of-service attack against the beacon protection of P2P devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-42724 
app/Controller/UsersController.php in MISP before 2.4.164 allows attackers to discover role names (this is information that only the site admin should have).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-10T00:00:00.000Z
CVE-2022-42725 
Warpinator through 1.2.14 allows access outside of an intended directory, as demonstrated by symbolic directory links.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-10T00:00:00.000Z
CVE-2022-42731 
mfa/FIDO2.py in django-mfa2 before 2.5.1 and 2.6.x before 2.6.1 allows a replay attack that could be used to register another device for a user. The device registration challenge is not invalidated after usage.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-11T00:00:00.000Z
CVE-2022-42732 
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.
Problem types: cwe_id: CWE-73
description: CWE-73: External Control of File Name or Path
Affected products: vendor: Siemens
product: syngo Dynamics
Published: 2022-11-17T00:00:00.000Z
CVE-2022-42733 
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper read access control that could allow files to be retrieved from any folder accessible to the account assigned to the website’s application pool.
Problem types: cwe_id: CWE-73
description: CWE-73: External Control of File Name or Path
Affected products: vendor: Siemens
product: syngo Dynamics
Published: 2022-11-17T00:00:00.000Z
CVE-2022-42734 
A vulnerability has been identified in syngo Dynamics (All versions < VA40G HF01). syngo Dynamics application server hosts a web service using an operation with improper write access control that could allow to write data in any folder accessible to the account assigned to the website’s application pool.
Problem types: cwe_id: CWE-73
description: CWE-73: External Control of File Name or Path
Affected products: vendor: Siemens
product: syngo Dynamics
Published: 2022-11-17T00:00:00.000Z
CVE-2022-42735 Apache ShenYu Admin ultra vires
Improper Privilege Management vulnerability in Apache Software Foundation Apache ShenYu.


ShenYu Admin allows low-privilege low-level administrators create users with higher privileges than their own.

This issue affects Apache ShenYu: 2.5.0.

Upgrade to Apache ShenYu 2.5.1 or apply patch  https://github.com/apache/shenyu/pull/3958 https://github.com/apache/shenyu/pull/3958 .



Problem types: cwe_id: CWE-269
description: CWE-269 Improper Privilege Management
Affected products: vendor: Apache Software Foundation
product: Apache ShenYu
default_status: unaffected
Credits: lang: en
value: xxhzz
Published: 2023-02-15T09:38:55.301Z
CVE-2022-42743 deep-parse-json 1.0.2 - Prototype Pollution
deep-parse-json version 1.0.2 allows an external attacker to edit or add new properties to an object. This is possible because the application does not correctly validate the incoming JSON keys, thus allowing the '__proto__' property to be edited.
Problem types: description: Prototype Pollution
Affected products: vendor: n/a
product: deep-parse-json
default_status: unaffected
Published: 2022-11-03T00:00:00.000Z
CVE-2022-42744 
CandidATS version 3.0.0 allows an external attacker to perform CRUD operations on the application databases. This is possible because the application does not correctly validate the entriesPerPage parameter against SQLi attacks.
Problem types: description: SQL injection
Affected products: vendor: n/a
product: CandidATS
Published: 2022-11-03T00:00:00.000Z
CVE-2022-42745 
CandidATS version 3.0.0 allows an external attacker to read arbitrary files from the server. This is possible because the application is vulnerable to XXE.
Problem types: description: XML injection (XXE)
Affected products: vendor: n/a
product: CandidATS
Published: 2022-11-03T00:00:00.000Z
CVE-2022-42746 
CandidATS version 3.0.0 on 'indexFile' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.


Problem types: description: Reflected cross-site scripting (XSS)
Affected products: vendor: n/a
product: CandidATS
default_status: unaffected
Published: 2022-11-03T00:00:00.000Z
CVE-2022-42747 
CandidATS version 3.0.0 on 'sortBy' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.


Problem types: description: Reflected cross-site scripting (XSS)
Affected products: vendor: n/a
product: CandidATS
default_status: unaffected
Published: 2022-11-03T00:00:00.000Z
CVE-2022-42748 
CandidATS version 3.0.0 on 'sortDirection' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.


Problem types: description: Reflected cross-site scripting (XSS)
Affected products: vendor: n/a
product: CandidATS
default_status: unaffected
Published: 2022-11-03T00:00:00.000Z
CVE-2022-42749 
CandidATS version 3.0.0 on 'page' of the 'ajax.php' resource, allows an external attacker to steal the cookie of arbitrary users. This is possible because the application application does not properly validate user input against XSS attacks.


Problem types: description: Reflected cross-site scripting (XSS)
Affected products: vendor: n/a
product: CandidATS
default_status: unaffected
Published: 2022-11-03T00:00:00.000Z
CVE-2022-42750 
CandidATS version 3.0.0 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the files uploaded by the user.
Problem types: description: Stored cross-site scripting (XSS)
Affected products: vendor: n/a
product: CandidATS
Published: 2022-11-03T00:00:00.000Z
CVE-2022-42751 
CandidATS version 3.0.0 allows an external attacker to elevate privileges in the application. This is possible because the application suffers from CSRF. This allows to persuade an administrator to create a new account with administrative permissions.
Problem types: description: Cross-site request forgery (CSRF)
Affected products: vendor: n/a
product: CandidATS
Published: 2022-11-03T00:00:00.000Z
CVE-2022-42753 
SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks.
Problem types: description: Reflected cross-site scripting (XSS)
Affected products: vendor: n/a
product: SalonERP
Published: 2022-11-03T00:00:00.000Z
CVE-2022-42754 
In npu driver, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-12-06T00:00:00.000Z
CVE-2022-42755 
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-787
description: cwe-787 Out-of-bounds Write
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8023
Published: 2022-12-06T00:00:00.000Z
CVE-2022-42756 
In sensor driver, there is a possible buffer overflow due to a missing bounds check. This could lead to local denial of service in kernel.
Problem types: cwe_id: CWE-120
description: CWE-120 Classic Buffer Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-12-06T00:00:00.000Z
CVE-2022-42757 
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-126
description: cwe-126 Buffer Over-read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8015
Published: 2022-12-06T00:00:00.000Z
CVE-2022-42758 
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-126
description: cwe-126 Buffer Over-read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8016
Published: 2022-12-06T00:00:00.000Z
CVE-2022-42759 
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-126
description: cwe-126 Buffer Over-read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8017
Published: 2022-12-06T00:00:00.000Z
CVE-2022-42760 
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-120
description: cwe-120 Classic Buffer Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8018
Published: 2022-12-06T00:00:00.000Z
CVE-2022-42761 
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-125
description: cwe-125 Out-of-bounds Read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8000
Published: 2022-12-06T00:00:00.000Z
CVE-2022-42762 
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-126
description: cwe-126 Buffer Over-read
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8004
Published: 2022-12-06T00:00:00.000Z
CVE-2022-42763 
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-190
description: cwe-190 Integer Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8008
Published: 2022-12-06T00:00:00.000Z
CVE-2022-42764 
In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Problem types: cwe_id: CWE-190
description: cwe-190 Integer Overflow
Affected products: vendor: Unisoc (Shanghai) Technologies Co., Ltd.
product: SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T610/T618/T606/T612/T616/T760/T770/T820/S8009
Published: 2022-12-06T00:00:00.000Z