rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-38791 
In MariaDB before 10.9.2, compress_write in extra/mariabackup/ds_compress.cc does not release data_mutex upon a stream write failure, which allows local users to trigger a deadlock.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-27T00:00:00.000Z
CVE-2022-38792 
The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-27T19:56:51.000Z
CVE-2022-38794 
Zaver through 2020-12-15 allows directory traversal via the GET /.. substring.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-27T20:26:02.000Z
CVE-2022-38795 
In Gitea through 1.17.1, repo cloning can occur in the migration function.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-08-07T00:00:00.000Z
CVE-2022-38796 
A Host Header Injection vulnerability in Feehi CMS 2.1.1 may allow an attacker to spoof a particular header. This can be exploited by abusing password reset emails.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-14T14:18:09.000Z
CVE-2022-38801 
In Zkteco BioTime < 8.5.3 Build:20200816.447, an employee can hijack an administrator session and cookies using blind cross-site scripting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-30T00:00:00.000Z
CVE-2022-38802 
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via resign, private message, manual log, time interval, attshift, and holiday. An authenticated administrator can read local files by exploiting XSS into a pdf generator when exporting data as a PDF
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-30T00:00:00.000Z
CVE-2022-38803 
Zkteco BioTime < 8.5.3 Build:20200816.447 is vulnerable to Incorrect Access Control via Leave, overtime, Manual log. An authenticated employee can read local files by exploiting XSS into a pdf generator when exporting data as a PDF
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-30T00:00:00.000Z
CVE-2022-38808 
ywoa v6.1 is vulnerable to SQL Injection via backend/oa/visual/exportExcel.do interface.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T13:39:22.000Z
CVE-2022-38812 
AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-31T17:52:27.000Z
CVE-2022-38813 
PHPGurukul Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete the users, add and manage Blood Group, and Submit Report.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-25T00:00:00.000Z
CVE-2022-38814 
A stored cross-site scripting (XSS) vulnerability in the auth_settings component of FiberHome AN5506-02-B vRP2521 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the sncfg_loid text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T19:34:38.000Z
CVE-2022-38817 
Dapr Dashboard v0.1.0 through v0.10.0 is vulnerable to Incorrect Access Control that allows attackers to obtain sensitive data.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-03T12:32:19.000Z
CVE-2022-38823 
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is a hard coded password for root in /etc/shadow.sample.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:23:06.000Z
CVE-2022-38826 
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:15:56.000Z
CVE-2022-38827 
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:09:09.000Z
CVE-2022-38828 
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:07:28.000Z
CVE-2022-38829 
Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/setMacFilterCfg.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:37:40.000Z
CVE-2022-38830 
Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/setIPv6Status.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:36:48.000Z
CVE-2022-38831 
Tenda RX9_Pro V22.03.02.10 is vulnerable to Buffer Overflow via httpd/SetNetControlList
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:35:43.000Z
CVE-2022-38832 
School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/department/index.php?view=edit&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:56:24.000Z
CVE-2022-38833 
School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/modstudent/index.php?view=view&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T14:55:18.000Z
CVE-2022-38840 
cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to local file disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-38841 
Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-16T00:00:00.000Z
CVE-2022-38843 
EspoCRM version 7.1.8 is vulnerable to Unrestricted File Upload allowing attackers to upload malicious file with any extension to the server. Attacker may execute these malicious files to run unintended code on the server to compromise the server.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T13:26:44.000Z
CVE-2022-38844 
CSV Injection in Create Contacts in EspoCRM 7.1.8 allows remote authenticated users to run system commands via creating contacts with payloads capable of executing system commands. Admin user exporting contacts in CSV file may end up executing the malicious system commands on his system.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T13:25:42.000Z
CVE-2022-38845 
Cross Site Scripting in Import feature in EspoCRM 7.1.8 allows remote users to run malicious JavaScript in victim s browser via sending crafted csv file containing malicious JavaScript to authenticated user. Any authenticated user importing the crafted CSV file may end up running the malicious JavaScripting in the browser.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T13:24:36.000Z
CVE-2022-38846 
EspoCRM version 7.1.8 is vulnerable to Missing Secure Flag allowing the browser to send plain text cookies over an insecure channel (HTTP). An attacker may capture the cookie from the insecure channel using MITM attack.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T13:15:24.000Z
CVE-2022-38850 
The MPlayer Project mencoder SVN-r38374-13.0.1 is vulnerable to Divide By Zero via the function config () of llibmpcodecs/vf_scale.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T00:00:00.000Z
CVE-2022-38851 
Certain The MPlayer Project products are vulnerable to Out-of-bounds Read via function read_meta_record() of mplayer/libmpdemux/asfheader.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T00:00:00.000Z
CVE-2022-38853 
Certain The MPlayer Project products are vulnerable to Buffer Overflow via function asf_init_audio_stream() of libmpdemux/asfheader.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T14:57:26.000Z
CVE-2022-38855 
Certain The MPlayer Project products are vulnerable to Buffer Overflow via function gen_sh_video () of mplayer/libmpdemux/demux_mov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T00:00:00.000Z
CVE-2022-38856 
Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov_build_index() of libmpdemux/demux_mov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T14:51:09.000Z
CVE-2022-38858 
Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mov_build_index() of libmpdemux/demux_mov.c. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T00:00:00.000Z
CVE-2022-38860 
Certain The MPlayer Project products are vulnerable to Divide By Zero via function demux_open_avi() of libmpdemux/demux_avi.c which affects mencoder. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T00:00:00.000Z
CVE-2022-38861 
The MPlayer Project mplayer SVN-r38374-13.0.1 is vulnerable to memory corruption via function free_mp_image() of libmpcodecs/mp_image.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T00:00:00.000Z
CVE-2022-38862 
Certain The MPlayer Project products are vulnerable to Buffer Overflow via function play() of libaf/af.c:639. This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T14:37:51.000Z
CVE-2022-38863 
Certain The MPlayer Project products are vulnerable to Buffer Overflow via function mp_getbits() of libmpdemux/mpeg_hdr.c which affects mencoder and mplayer. This affects mecoder SVN-r38374-13.0.1 and mplayer SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T00:00:00.000Z
CVE-2022-38864 
Certain The MPlayer Project products are vulnerable to Buffer Overflow via the function mp_unescape03() of libmpdemux/mpeg_hdr.c. This affects mencoder SVN-r38374-13.0.1 and mplayer SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T00:00:00.000Z
CVE-2022-38865 
Certain The MPlayer Project products are vulnerable to Divide By Zero via the function demux_avi_read_packet of libmpdemux/demux_avi.c. This affects mplyer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T00:00:00.000Z
CVE-2022-38866 
Certain The MPlayer Project products are vulnerable to Buffer Overflow via read_avi_header() of libmpdemux/aviheader.c . This affects mplayer SVN-r38374-13.0.1 and mencoder SVN-r38374-13.0.1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T00:00:00.000Z
CVE-2022-38867 
SQL Injection vulnerability in rttys versions 4.0.0, 4.0.1, 4.0.2, and 4.4.x in api.go, allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-15T00:00:00.000Z
CVE-2022-38868 
SQL Injection vulnerability in Ehoney version 2.0.0 in models/protocol.go and models/images.go, allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-15T00:00:00.000Z
CVE-2022-38870 
Free5gc v3.2.1 is vulnerable to Information disclosure.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-25T00:00:00.000Z
CVE-2022-38871 
In Free5gc v3.0.5, the AMF breaks due to malformed NAS messages.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-18T00:00:00.000Z
CVE-2022-38873 
D-Link devices DAP-2310 v2.10rc036 and earlier, DAP-2330 v1.06rc020 and earlier, DAP-2360 v2.10rc050 and earlier, DAP-2553 v3.10rc031 and earlier, DAP-2660 v1.15rc093 and earlier, DAP-2690 v3.20rc106 and earlier, DAP-2695 v1.20rc119_beta31 and earlier, DAP-3320 v1.05rc027 beta and earlier, DAP-3662 v1.05rc047 and earlier allows attackers to cause a Denial of Service (DoS) via uploading a crafted firmware after modifying the firmware header.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-12-20T00:00:00.000Z
CVE-2022-38877 
Garage Management System v1.0 is vulnerable to Arbitrary code execution via ip/garage/php_action/editProductImage.php?id=1.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T15:03:30.000Z
CVE-2022-38878 
School Activity Updates with SMS Notification v1.0 is vulnerable to SQL Injection via /activity/admin/modules/event/index.php?view=edit&id=.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-16T15:00:45.000Z
CVE-2022-38880 
The d8s-urls for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T13:56:39.000Z
CVE-2022-38881 
The d8s-archives for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:26:55.000Z
CVE-2022-38882 
The d8s-json for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:28:52.000Z
CVE-2022-38883 
The d8s-math for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:30:57.000Z
CVE-2022-38884 
The d8s-grammars for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:32:10.000Z
CVE-2022-38885 
The d8s-netstrings for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:34:02.000Z
CVE-2022-38886 
The d8s-xml for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-strings package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:35:42.000Z
CVE-2022-38887 
The d8s-python for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The democritus-strings package. The affected version is 0.1.0.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-19T15:38:43.000Z
CVE-2022-38890 
Nginx NJS v0.7.7 was discovered to contain a segmentation violation via njs_utf8_next at src/njs_utf8.h
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-15T15:28:36.000Z
CVE-2022-38900 
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-11-28T00:00:00.000Z
CVE-2022-38901 
A Cross-site scripting (XSS) vulnerability in the Document and Media module - file upload functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the description field of uploaded svg file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-19T00:00:00.000Z
CVE-2022-38902 
A Cross-site scripting (XSS) vulnerability in the Blog module - add new topic functionality in Liferay Digital Experience Platform 7.3.10 SP3 allows remote attackers to inject arbitrary JS script or HTML into the name field of newly created topic.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-10-13T00:00:00.000Z
CVE-2022-38916 
A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T16:09:40.000Z
CVE-2022-38922 
BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'users-cookie-settings' token using a Time-based blind SLEEP payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-03T00:00:00.000Z
CVE-2022-38923 
BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' field using a Time-based blind SLEEP payload.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-04-03T00:00:00.000Z
CVE-2022-38928 
XPDF 4.04 is vulnerable to Null Pointer Dereference in FoFiType1C.cc:2393.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-21T12:57:51.000Z
CVE-2022-38931 
A Server-Side Request Forgery (SSRF) in fetch_net_file_upload function of baijiacmsV4 v4.1.4 allows remote attackers to force the application to make arbitrary requests via injection of arbitrary URLs into the url parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T19:58:59.000Z
CVE-2022-38932 
readelf in ToaruOS 2.0.1 has a global overflow allowing RCE when parsing a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-27T17:52:45.000Z
CVE-2022-38934 
readelf in ToaruOS 2.0.1 has some arbitrary address read vulnerabilities when parsing a crafted ELF file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-28T16:30:55.000Z
CVE-2022-38935 
An issue was discovered in NiterForum version 2.5.0-beta in /src/main/java/cn/niter/forum/api/SsoApi.java and /src/main/java/cn/niter/forum/controller/AdminController.java, allows attackers to gain escalated privileges.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2023-02-15T00:00:00.000Z
CVE-2022-38936 
An issue has been found in PBC through 2022-8-27. A SEGV issue detected in the function pbc_wmessage_integer in src/wmessage.c:137.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-23T10:49:03.000Z
CVE-2022-38946 
Arbitrary File Upload vulnerability in Doctor-Appointment version 1.0 in /Frontend/signup_com.php, allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-09T00:00:00.000Z
CVE-2022-38947 
SQL Injection vulnerability in Flipkart-Clone-PHP version 1.0 in entry.php in product_title parameter, allows attackers to execute arbitrary code.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-12-09T00:00:00.000Z
CVE-2022-38955 
An exploitable firmware modification vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to modify the user-uploaded firmware image and bypass the CRC check. A successful attack can either introduce a backdoor to the device or make the device DoS. This affects Firmware Version: 1.1.1_1.1.9.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T17:47:27.000Z
CVE-2022-38956 
An exploitable firmware downgrade vulnerability was discovered on the Netgear WPN824EXT WiFi Range Extender. An attacker can conduct a MITM attack to replace the user-uploaded firmware image with an original old firmware image. This affects Firmware 1.1.1_1.1.9 and earlier.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-20T17:46:22.000Z
CVE-2022-38970 
ieGeek IG20 hipcam RealServer V1.0 is vulnerable to Incorrect Access Control. The algorithm used to generate device IDs (UIDs) for devices that utilize Shenzhen Yunni Technology iLnkP2P suffers from a predictability flaw that allows remote attackers to establish direct connections to arbitrary devices.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-09-26T10:21:58.000Z
CVE-2022-38971 WordPress BuddyForms Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS)
Stored Cross-Site Scripting (XSS) vulnerability in ThemeKraft Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions plugin <= 2.7.5 versions.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: ThemeKraft
product: Post Form – Registration Form – Profile Form for User Profiles and Content Forms for User Submissions
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.7
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: thiennv (Patchstack Alliance)
Published: 2023-03-16T08:49:16.146Z
CVE-2022-38972 
Cross-site scripting vulnerability in Movable Type plugin A-Form versions prior to 4.1.1 (for Movable Type 7 Series) and versions prior to 3.9.1 (for Movable Type 6 Series) allows a remote unauthenticated attacker to inject an arbitrary script.
Problem types: description: Cross-site scripting
Affected products: vendor: ARK-Web co., ltd.
product: A-Form
Published: 2022-09-12T01:50:14.000Z
CVE-2022-38973 
Improper access control for some Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition sold between October of 2022 and December of 2022 may allow an authenticated user to potentially enable denial of service or infomation disclosure via local access.
Problem types: description: denial of service
cwe_id: CWE-284
description: Improper access control
Affected products: vendor: n/a
product: Intel(R) Arc(TM) graphics cards A770 and A750 Limited Edition
default_status: unaffected
CVSS v3.1: version: 3.1
baseScore: 3.3
baseSeverity: LOW
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:L
attackVector: LOCAL
attackComplexity: HIGH
privilegesRequired: LOW
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: NONE
availabilityImpact: LOW
Published: 2023-08-11T02:36:59.521Z