saikiranpennam/new_cves_pps huggingface dataset:
Explain the vulnerability: CVE-2022-44563
Description:There is a race condition vulnerability in SD upgrade mode. Successful exploitation of this vulnerability may affect data confidentiality.
Explain the vulnerability: CVE-2022-44426
Description:In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-44719
Description:An issue was discovered in Weblib Ucopia before 6.0.13. The SSH Server has Insecure Permissions.
Explain the vulnerability: CVE-2022-44575
Description:A vulnerability has been identified in PLM Help Server V4.2 (All versions). A reflected cross-site scripting (XSS) vulnerability exists in the web interface of the affected application that could allow an attacker to execute malicious javascript code by tricking users into accessing a malicious link.
Explain the vulnerability: CVE-2022-44430
Description:In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-44172
Description:Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler.
Explain the vulnerability: CVE-2022-44467
Description:Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Explain the vulnerability: CVE-2022-44037
Description:An access control issue in APsystems ENERGY COMMUNICATION UNIT (ECU-C) Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights without authenticating allows him to perform multiple attacks, such as attacking wireless network in the product's range.
Explain the vulnerability: CVE-2022-44670
Description:Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-44365
Description:Tenda i21 V1.0.0.14(4656) has a stack overflow vulnerability via /goform/setSysPwd.
Explain the vulnerability: CVE-2022-44735
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gus Sevilla WP Clictracker plugin <= 1.0.5 versions.
Explain the vulnerability: CVE-2022-44559
Description:The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
Explain the vulnerability: CVE-2022-44109
Description:pdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream::makeFilter(char*, Stream*, Object*, int).
Explain the vulnerability: CVE-2022-44627
Description:Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps.
Explain the vulnerability: CVE-2022-44277
Description:Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product.
Explain the vulnerability: CVE-2022-44298
Description:SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
Explain the vulnerability: CVE-2022-44261
Description:Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).
Explain the vulnerability: CVE-2022-44631
Description:Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in 1app Technologies, Inc 1app Business Forms plugin <= 1.0.0 versions.
Explain the vulnerability: CVE-2022-44236
Description:Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability.
Explain the vulnerability: CVE-2022-44373
Description:A stack overflow vulnerability exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (Version v1.0R, firmware version 1.01.B01) which may result in remote code execution.
Explain the vulnerability: CVE-2022-44959
Description:webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /meetings/listmeetings.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
Explain the vulnerability: CVE-2022-44667
Description:Windows Media Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-44688
Description:Microsoft Edge (Chromium-based) Spoofing Vulnerability
Explain the vulnerability: CVE-2022-44149
Description:The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required
Explain the vulnerability: CVE-2022-44260
Description:TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function.
Explain the vulnerability: CVE-2022-44299
Description:SiteServerCMS 7.1.3 sscms has a file read vulnerability.
Explain the vulnerability: CVE-2022-44558
Description:The AMS module has a vulnerability of serialization/deserialization mismatch. Successful exploitation of this vulnerability may cause privilege escalation.
Explain the vulnerability: CVE-2022-44108
Description:pdftojson commit 94204bb was discovered to contain a stack overflow via the component Object::copy(Object*):Object.cc.
Explain the vulnerability: CVE-2022-44671
Description:Windows Graphics Component Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2022-44734
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in BestWebSoft Car Rental by BestWebSoft plugin <= 1.1.2 versions.
Explain the vulnerability: CVE-2022-44036
Description:In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for admins, leading to command execution. NOTE: the vendor's position is that this is "very obviously a feature not an issue and if you don't like that feature it is very obvious how to disable it."
Explain the vulnerability: CVE-2022-44574
Description:An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port.
Explain the vulnerability: CVE-2022-44431
Description:In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-44718
Description:An issue was discovered in NetScout nGeniusONE 6.3.2 build 904. Open Redirection can occur (issue 2 of 2). After successful login, an attacker must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host. The attack vector is Network, and the Attack Complexity required is High. Privileges required are administrator, User Interaction is required, and Scope is unchanged. The user must visit the vulnerable parameter and inject a crafted payload to successfully redirect to an unknown host.
Explain the vulnerability: CVE-2022-44348
Description:Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.
Explain the vulnerability: CVE-2022-44427
Description:In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-44020
Description:An issue was discovered in OpenStack Sushy-Tools through 0.21.0 and VirtualBMC through 2.2.2. Changing the boot device configuration with these packages removes password protection from the managed libvirt XML domain. NOTE: this only affects an "unsupported, production-like configuration."
Explain the vulnerability: CVE-2022-44470
Description:Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Explain the vulnerability: CVE-2022-44684
Description:Windows Local Session Manager (LSM) Denial of Service Vulnerability
Explain the vulnerability: CVE-2022-44954
Description:webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name field after clicking "Add".
Explain the vulnerability: CVE-2022-44542
Description:lesspipe before 2.06 allows attackers to execute code via Perl Storable (pst) files, because of deserialized object destructor execution via a key/value pair in a hash.
Explain the vulnerability: CVE-2022-44796
Description:An issue was discovered in Object First Ootbi BETA build 1.0.7.712. The authorization service has a flow that allows getting access to the Web UI without knowing credentials. For signing, the JWT token uses a secret key that is generated through a function that doesn't produce cryptographically strong sequences. An attacker can predict these sequences and generate a JWT token. As a result, an attacker can get access to the Web UI. This is fixed in Object First Ootbi BETA build 1.0.13.1611.
Explain the vulnerability: CVE-2022-44283
Description:AVS Audio Converter 10.3 is vulnerable to Buffer Overflow.
Explain the vulnerability: CVE-2022-44000
Description:An issue was discovered in BACKCLICK Professional 5.9.63. Due to an exposed internal communications interface, it is possible to execute arbitrary system commands on the server.
Explain the vulnerability: CVE-2022-44295
Description:Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=.
Explain the vulnerability: CVE-2022-44446
Description:In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-44016
Description:An issue was discovered in Simmeth Lieferantenmanager before 5.6. An attacker can download arbitrary files from the web server by abusing an API call: /DS/LM_API/api/ConfigurationService/GetImages with an '"ImagesPath":"C:\\"' value.
Explain the vulnerability: CVE-2022-44153
Description:Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).
Explain the vulnerability: CVE-2022-44387
Description:EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module.
Explain the vulnerability: CVE-2022-44738
Description:Improper Neutralization of Formula Elements in a CSV File vulnerability in Patrick Robrecht Posts and Users Stats.This issue affects Posts and Users Stats: from n/a through 1.1.3.
Explain the vulnerability: CVE-2022-44368
Description:NASM v2.16 was discovered to contain a null pointer deference in the NASM component
Explain the vulnerability: CVE-2022-44692
Description:Microsoft Office Graphics Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-44411
Description:Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' passwords via a bruteforce attack.
Explain the vulnerability: CVE-2022-44942
Description:Casdoor before v1.126.1 was discovered to contain an arbitrary file deletion vulnerability via the uploadFile function.
Explain the vulnerability: CVE-2022-44807
Description:D-Link DIR-882 1.10B02 and 1.20B06 is vulnerable to Buffer Overflow via webGetVarString.
Explain the vulnerability: CVE-2022-44554
Description:The power module has a vulnerability in permission verification. Successful exploitation of this vulnerability may cause abnormal status of a module on the device.
Explain the vulnerability: CVE-2022-44313
Description:PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when called from ExpressionParseFunctionCall.
Explain the vulnerability: CVE-2022-44606
Description:OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings.
Explain the vulnerability: CVE-2022-44256
Description:TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function.
Explain the vulnerability: CVE-2022-44190
Description:Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable_band_steering.
Explain the vulnerability: CVE-2022-44201
Description:D-Link DIR823G 1.02B05 is vulnerable to Commad Injection.
Explain the vulnerability: CVE-2022-44702
Description:Windows Terminal Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-44755
Description:HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.  This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44751.  This vulnerability applies to software previously licensed by IBM.
Explain the vulnerability: CVE-2022-44610
Description:Improper authentication in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access.
Explain the vulnerability: CVE-2022-44169
Description:Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer.
Explain the vulnerability: CVE-2022-44186
Description:Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_pri.
Explain the vulnerability: CVE-2022-44532
Description:An authenticated path traversal vulnerability exists in the Aruba EdgeConnect Enterprise command line interface. Successful exploitation of this vulnerability results in the ability to read arbitrary files on the underlying operating system, including sensitive system files in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below.
Explain the vulnerability: CVE-2022-44027
Description:An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 4 of 6.
Explain the vulnerability: CVE-2022-44420
Description:In modem, there is a possible missing verification of HashMME value in Security Mode Command. This could local denial of service with no additional execution privileges.
Explain the vulnerability: CVE-2022-44070
Description:Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via News articles.
Explain the vulnerability: CVE-2022-44089
Description:ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE.
Explain the vulnerability: CVE-2022-44436
Description:In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-44748
Description:A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Server since 4.3.0 can result in arbitrary files being overwritten on the server's file system. This vulnerability is also known as 'Zip-Slip'.





An attacker can create a KNIME workflow that, when being uploaded, can overwrite arbitrary files that the operating system user running the KNIME Server process has write access to. The user must be authenticated and have permissions to upload files to KNIME Server.


This can impact data integrity (file contents are changed) or cause errors in other software (vital files being corrupted). It can even lead to remote code execution if executable files are being replaced and subsequently executed by the KNIME Server process user. In all cases the attacker has to know the location of files on the server's file system, though.

Note that users that have permissions to upload workflows usually also have permissions to run them on the KNIME Server and can therefore already execute arbitrary code in the context of the KNIME Executor's operating system user.

There is no workaround to prevent this vulnerability from being exploited. Updates to fixed versions 4.13.6, 4.14.3, or 4.15.3 are advised.
Explain the vulnerability: CVE-2022-44877
Description:login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
Explain the vulnerability: CVE-2022-44174
Description:Tenda AC18 V15.03.05.05 is vulnerable to Buffer Overflow via function formSetDeviceName.
Explain the vulnerability: CVE-2022-44031
Description:Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization of the blockquote syntax in Textile-formatted fields.
Explain the vulnerability: CVE-2022-44932
Description:An access control issue in Tenda A18 v15.13.07.09 allows unauthenticated attackers to access the Telnet service.
Explain the vulnerability: CVE-2022-44676
Description:Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-44733
Description:Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39900.
Explain the vulnerability: CVE-2022-44949
Description:Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Short Name field.
Explain the vulnerability: CVE-2022-44158
Description:Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.
Explain the vulnerability: CVE-2022-44267
Description:ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.
Explain the vulnerability: CVE-2022-44637
Description:Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user.
Explain the vulnerability: CVE-2022-44725
Description:OPC Foundation Local Discovery Server (LDS) through 1.04.403.478 uses a hard-coded file path to a configuration file. This allows a normal user to create a malicious file that is loaded by LDS (running as a high-privilege user).
Explain the vulnerability: CVE-2022-44549
Description:The LBS module has a vulnerability in geofencing API access. Successful exploitation of this vulnerability may cause third-party apps to access the geofencing APIs without authorization, affecting user confidentiality.
Explain the vulnerability: CVE-2022-44928
Description:D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.
Explain the vulnerability: CVE-2022-44752
Description:HCL Domino is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView.  This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file.  This vulnerability applies to software previously licensed by IBM.
Explain the vulnerability: CVE-2022-44139
Description:Apartment Visitor Management System v1.0 is vulnerable to SQL Injection via /avms/index.php.
Explain the vulnerability: CVE-2022-44569
Description:A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.
Explain the vulnerability: CVE-2022-44355
Description:SolarView Compact 7.0 is vulnerable to Cross-site Scripting (XSS) via /network_test.php.
Explain the vulnerability: CVE-2022-44640
Description:Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
Explain the vulnerability: CVE-2022-44590
Description:Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2 on WordPress.
Explain the vulnerability: CVE-2022-44343
Description:CRMEB 4.4.4 is vulnerable to Any File download.
Explain the vulnerability: CVE-2022-44713
Description:Microsoft Outlook for Mac Spoofing Vulnerability
Explain the vulnerability: CVE-2022-44197
Description:Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_server_ip.
Explain the vulnerability: CVE-2022-44744
Description:Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Explain the vulnerability: CVE-2022-44314
Description:PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunctionCall.
Explain the vulnerability: CVE-2022-44251
Description:TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function.
Explain the vulnerability: CVE-2022-44945
Description:Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the heading_field_id parameter.
Explain the vulnerability: CVE-2022-44380
Description:Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
Explain the vulnerability: CVE-2022-44695
Description:Microsoft Office Visio Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-44441
Description:In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-44011
Description:An issue was discovered in ClickHouse before 22.9.1.2603. An authenticated user (with the ability to load data) could cause a heap buffer overflow and crash the server by inserting a malformed CapnProto object. The fixed versions are 22.9.1.2603, 22.8.2.11, 22.7.4.16, 22.6.6.16, and 22.3.12.19.
Explain the vulnerability: CVE-2022-44007
Description:An issue was discovered in BACKCLICK Professional 5.9.63. Due to an unsafe implementation of session tracking, it is possible for an attacker to trick users into opening an authenticated user session for a session identifier known to the attacker, aka Session Fixation.
Explain the vulnerability: CVE-2022-44284
Description:Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).
Explain the vulnerability: CVE-2022-44400
Description:Purchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order/admin/?page=system_info.
Explain the vulnerability: CVE-2022-44050
Description:The d8s-networking for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-json package. The affected version of d8s-htm is 0.1.0.
Explain the vulnerability: CVE-2022-44379
Description:Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_service.
Explain the vulnerability: CVE-2022-44683
Description:Windows Kernel Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2022-44729
Description:Server-Side Request Forgery (SSRF) vulnerability in Apache Software Foundation Apache XML Graphics Batik.This issue affects Apache XML Graphics Batik: 1.16.

On version 1.16, a malicious SVG could trigger loading external resources by default, causing resource consumption or in some cases even information disclosure. Users are recommended to upgrade to version 1.17 or later.
Explain the vulnerability: CVE-2022-44378
Description:Automotive Shop Management System v1.0 is vulnerable to SQL via /asms/classes/Master.php?f=delete_mechanic.
Explain the vulnerability: CVE-2022-44682
Description:Windows Hyper-V Denial of Service Vulnerability
Explain the vulnerability: CVE-2022-44401
Description:Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php.
Explain the vulnerability: CVE-2022-44051
Description:The d8s-stats for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-math package. The affected version of d8s-htm is 0.1.0.
Explain the vulnerability: CVE-2022-44952
Description:Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking "Add".
Explain the vulnerability: CVE-2022-44006
Description:An issue was discovered in BACKCLICK Professional 5.9.63. Due to improper validation or sanitization of upload filenames, an externally reachable, unauthenticated update function permits writing files outside the intended target location. Achieving remote code execution is possible, e.g., by uploading an executable file.
Explain the vulnerability: CVE-2022-44840
Description:Heap buffer overflow vulnerability in binutils readelf before 2.40 via function find_section_in_set in file readelf.c.
Explain the vulnerability: CVE-2022-44786
Description:An issue was discovered in Appalti & Contratti 9.12.2. The target web applications allow Local File Inclusion in any page relying on the href parameter to specify the JSP page to be rendered. This affects ApriPagina.do POST and GET requests to each application.
Explain the vulnerability: CVE-2022-44694
Description:Microsoft Office Visio Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-44944
Description:Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Announcement function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.
Explain the vulnerability: CVE-2022-44552
Description:The lock screen module has defects introduced in the design process. Successful exploitation of this vulnerability may affect system availability.
Explain the vulnerability: CVE-2022-44801
Description:D-Link DIR-878 1.02B05 is vulnerable to Incorrect Access Control.
Explain the vulnerability: CVE-2022-44745
Description:Sensitive information leak through log files. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Explain the vulnerability: CVE-2022-44315
Description:PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCall.
Explain the vulnerability: CVE-2022-44250
Description:TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function.
Explain the vulnerability: CVE-2022-44704
Description:Microsoft Windows System Monitor (Sysmon) Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2022-44641
Description:In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service.
Explain the vulnerability: CVE-2022-44211
Description:In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings.
Explain the vulnerability: CVE-2022-44303
Description:Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the "{schedule_job}" or "args" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.
Explain the vulnerability: CVE-2022-44753
Description:HCL Notes is susceptible to a stack based buffer overflow vulnerability in wp6sr.dll in Micro Focus KeyView.  This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted WordPerfect file.  This vulnerability applies to software previously licensed by IBM.
Explain the vulnerability: CVE-2022-44180
Description:Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.
Explain the vulnerability: CVE-2022-44929
Description:An access control issue in D-Link DVG-G5402SP GE_1.03 allows unauthenticated attackers to escalate privileges via arbitrarily editing VoIP SIB profiles.
Explain the vulnerability: CVE-2022-44118
Description:dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.
Explain the vulnerability: CVE-2022-44636
Description:The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote control by pressing a button. This is fixed in xxx72510, E9172511 for 2021 models, xxxA1000, 4x2A0200 for 2022 models.
Explain the vulnerability: CVE-2022-44289
Description:Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
Explain the vulnerability: CVE-2022-44948
Description:Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Entities Group feature at/index.php?module=entities/entities_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".
Explain the vulnerability: CVE-2022-44362
Description:Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/AddSysLogRule.
Explain the vulnerability: CVE-2022-44175
Description:Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
Explain the vulnerability: CVE-2022-44030
Description:Redmine 5.x before 5.0.4 allows downloading of file attachments of any Issue or any Wiki page due to insufficient permission checks. Depending on the configuration, this may require login as a registered user.
Explain the vulnerability: CVE-2022-44749
Description:A directory traversal vulnerability in the ZIP archive extraction routines of KNIME Analytics Platform 3.2.0 and above can result in arbitrary files being overwritten on the user's system. This vulnerability is also known as 'Zip-Slip'.





An attacker can create a KNIME workflow that, when being opened by a user, can overwrite arbitrary files that the user has write access to. It's not necessary to execute the workflow, opening the workflow is sufficient. The user will notice that something is wrong because an error is being reported but only after the files have already been written.

This can impact data integrity (file contents are changed) or cause errors in other software (vital files being corrupted). It can even lead to remote code execution if executable files are being replaced and subsequently executed by the user. In all cases the attacker has to know the location of files on the user's system, though.
Explain the vulnerability: CVE-2022-44572
Description:A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.
Explain the vulnerability: CVE-2022-44088
Description:ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION.
Explain the vulnerability: CVE-2022-44437
Description:In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-44071
Description:Zenario CMS 9.3.57186 is is vulnerable to Cross Site Scripting (XSS) via profile.
Explain the vulnerability: CVE-2022-44708
Description:Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2022-44499
Description:Adobe Illustrator versions 26.5.1 (and earlier), and 27.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Explain the vulnerability: CVE-2022-44533
Description:A vulnerability in the Aruba EdgeConnect Enterprise web management interface allows remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlying operating system leading to complete system compromise in Aruba EdgeConnect Enterprise Software version(s): ECOS 9.2.1.0 and below; ECOS 9.1.3.0 and below; ECOS 9.0.7.0 and below; ECOS 8.3.7.1 and below.
Explain the vulnerability: CVE-2022-44860
Description:Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/transactions/update_status.php.
Explain the vulnerability: CVE-2022-44026
Description:An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 3 of 6.
Explain the vulnerability: CVE-2022-44727
Description:The EU Cookie Law GDPR (Banner + Blocker) module before 2.1.3 for PrestaShop allows SQL Injection via a cookie ( lgcookieslaw or __lglaw ).
Explain the vulnerability: CVE-2022-44009
Description:Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information.
Explain the vulnerability: CVE-2022-44320
Description:PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from ExpressionParseFunctionCall.
Explain the vulnerability: CVE-2022-44623
Description:In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings
Explain the vulnerability: CVE-2022-44789
Description:A logical issue in O_getOwnPropertyDescriptor() in Artifex MuJS 1.0.0 through 1.3.x before 1.3.2 allows an attacker to achieve Remote Code Execution through memory corruption, via the loading of a crafted JavaScript file.
Explain the vulnerability: CVE-2022-44361
Description:An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php.
Explain the vulnerability: CVE-2022-44731
Description:A vulnerability has been identified in SIMATIC WinCC OA V3.15 (All versions < V3.15 P038), SIMATIC WinCC OA V3.16 (All versions < V3.16 P035), SIMATIC WinCC OA V3.17 (All versions < V3.17 P024), SIMATIC WinCC OA V3.18 (All versions < V3.18 P014). The affected component allows to inject custom arguments to the Ultralight Client backend application under certain circumstances.

This could allow an authenticated remote attacker to inject arbitrary parameters when starting the client via the web interface (e.g., open attacker chosen panels with the attacker's credentials or start a Ctrl script).
Explain the vulnerability: CVE-2022-44930
Description:D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.
Explain the vulnerability: CVE-2022-44463
Description:Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Explain the vulnerability: CVE-2022-44199
Description:Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_server_ip.
Explain the vulnerability: CVE-2022-44033
Description:An issue was discovered in the Linux kernel through 6.0.6. drivers/char/pcmcia/cm4040_cs.c has a race condition and resultant use-after-free if a physically proximate attacker removes a PCMCIA device while calling open(), aka a race condition between cm4040_open() and reader_detach().
Explain the vulnerability: CVE-2022-44176
Description:Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function fromSetRouteStatic.
Explain the vulnerability: CVE-2022-44571
Description:There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted.
Explain the vulnerability: CVE-2022-44422
Description:In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-44588
Description:Unauth. SQL Injection vulnerability in Cryptocurrency Widgets Pack Plugin <=1.8.1 on WordPress.
Explain the vulnerability: CVE-2022-44567
Description:A command injection vulnerability exists in Rocket.Chat-Desktop <3.8.14 that could allow an attacker to pass a malicious url of openInternalVideoChatWindow to shell.openExternal(), which may lead to remote code execution (internalVideoChatWindow.ts#L17). To exploit the vulnerability, the internal video chat window must be disabled or a Mac App Store build must be used (internalVideoChatWindow.ts#L14). The vulnerability may be exploited by an XSS attack because the function openInternalVideoChatWindow is exposed in the Rocket.Chat-Desktop-API.
Explain the vulnerability: CVE-2022-44137
Description:SourceCodester Sanitization Management System 1.0 is vulnerable to SQL Injection.
Explain the vulnerability: CVE-2022-44025
Description:An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 2 of 6.
Explain the vulnerability: CVE-2022-44619
Description:Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Explain the vulnerability: CVE-2022-44681
Description:Windows Print Spooler Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2022-44547
Description:The Display Service module has a UAF vulnerability. Successful exploitation of this vulnerability may affect the display service availability.
Explain the vulnerability: CVE-2022-44052
Description:The d8s-dates for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. A potential code execution backdoor inserted by third parties is the democritus-timezones package. The affected version of d8s-htm is 0.1.0.
Explain the vulnerability: CVE-2022-44793
Description:handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service.
Explain the vulnerability: CVE-2022-44843
Description:TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the port parameter in the setting/setOpenVpnClientCfg function.
Explain the vulnerability: CVE-2022-44140
Description:Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.
Explain the vulnerability: CVE-2022-44290
Description:webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
Explain the vulnerability: CVE-2022-44785
Description:An issue was discovered in Appalti & Contratti 9.12.2. The target web applications are subject to multiple SQL Injection vulnerabilities, some of which executable even by unauthenticated users, as demonstrated by the GetListaEnti.do cfamm parameter.
Explain the vulnerability: CVE-2022-44156
Description:Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind.
Explain the vulnerability: CVE-2022-44443
Description:In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-44697
Description:Windows Graphics Component Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2022-44551
Description:The iaware module has a vulnerability in thread security. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availability.
Explain the vulnerability: CVE-2022-44947
Description:Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Highlight Row feature at /index.php?module=entities/listing_types&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Note field after clicking "Add".
Explain the vulnerability: CVE-2022-44746
Description:Sensitive information disclosure due to insecure folder permissions. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Explain the vulnerability: CVE-2022-44316
Description:PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanGetToken.
Explain the vulnerability: CVE-2022-44204
Description:D-Link DIR3060 DIR3060A1_FW111B04.bin is vulnerable to Buffer Overflow.
Explain the vulnerability: CVE-2022-44654
Description:Affected builds of Trend Micro Apex One and Apex One as a Service contain a monitor engine component that is complied without the /SAFESEH memory protection mechanism which helps to monitor for malicious payloads. The affected component's memory protection mechanism has been updated to enhance product security.
Explain the vulnerability: CVE-2022-44438
Description:In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-44212
Description:In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.
Explain the vulnerability: CVE-2022-44707
Description:Windows Kernel Denial of Service Vulnerability
Explain the vulnerability: CVE-2022-44584
Description:Unauth. Arbitrary File Deletion vulnerability in WatchTowerHQ plugin <= 3.6.15 on WordPress.
Explain the vulnerability: CVE-2022-44838
Description:Automotive Shop Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /services/view_service.php.
Explain the vulnerability: CVE-2022-44750
Description:HCL Domino is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.  This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44754.  This vulnerability applies to software previously licensed by IBM.
Explain the vulnerability: CVE-2022-44183
Description:Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic.
Explain the vulnerability: CVE-2022-44028
Description:An issue was discovered in NetScout nGeniusONE 6.3.2 before P10. It allows Reflected Cross-Site Scripting (XSS), issue 5 of 6.
Explain the vulnerability: CVE-2022-44751
Description:HCL Notes is susceptible to a stack based buffer overflow vulnerability in lasr.dll in Micro Focus KeyView.  This could allow a remote unauthenticated attacker to crash the application or execute arbitrary code via a crafted Lotus Ami Pro file. This is different from the vulnerability described in CVE-2022-44755.  This vulnerability applies to software previously licensed by IBM.
Explain the vulnerability: CVE-2022-44585
Description:Cross-Site Request Forgery (CSRF) vulnerability in Magneticlab Sàrl Homepage Pop-up plugin <= 1.2.5 versions.
Explain the vulnerability: CVE-2022-44643
Description:A vulnerability in the label-based access control of Grafana Labs Grafana Enterprise Metrics allows an attacker more access than intended. If an access policy which has label selector restrictions also has been granted access to all tenants in the system, the label selector restrictions will not be applied when using this policy with the affected versions of the software. This issue affects: Grafana Labs Grafana Enterprise Metrics GEM 1.X versions prior to 1.7.1 on AMD64; GEM 2.X versions prior to 2.3.1 on AMD64.
Explain the vulnerability: CVE-2022-44213
Description:ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).
Explain the vulnerability: CVE-2022-44356
Description:WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.
Explain the vulnerability: CVE-2022-44069
Description:Zenario CMS 9.3.57186 is vulnerable to Cross Site Scripting (XSS) via the Nest library module.
Explain the vulnerability: CVE-2022-44710
Description:DirectX Graphics Kernel Elevation of Privilege Vulnerability
Explain the vulnerability: CVE-2022-44194
Description:Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode_dns1_pri and apmode_dns1_sec.
Explain the vulnerability: CVE-2022-44252
Description:TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function.
Explain the vulnerability: CVE-2022-44747
Description:Local privilege escalation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40107.
Explain the vulnerability: CVE-2022-44550
Description:The graphics display module has a UAF vulnerability when traversing graphic layers. Successful exploitation of this vulnerability may affect system availability.
Explain the vulnerability: CVE-2022-44415
Description:Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/view_mechanic.php?id=.
Explain the vulnerability: CVE-2022-44946
Description:Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add Page function at /index.php?module=help_pages/pages&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field.
Explain the vulnerability: CVE-2022-44696
Description:Microsoft Office Visio Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-44679
Description:Windows Graphics Component Information Disclosure Vulnerability
Explain the vulnerability: CVE-2022-44442
Description:In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-44012
Description:An issue was discovered in /DS/LM_API/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. An attacker can execute JavaScript code in the browser of the victim if a site is loaded. The victim's encrypted password can be stolen and most likely be decrypted.