saikiranpennam/new_cves_pps huggingface dataset:
Explain the vulnerability: CVE-2022-47476
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47134
Description:Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <= 1.5 versions.
Explain the vulnerability: CVE-2022-47071
Description:In NVS365 V01, the background network test function can trigger command execution.
Explain the vulnerability: CVE-2022-47088
Description:GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow.
Explain the vulnerability: CVE-2022-47122
Description:Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd_5g parameter at /goform/WifiBasicSet.
Explain the vulnerability: CVE-2022-47437
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Branko Borilovic WSB Brands plugin <= 1.1.8 versions.
Explain the vulnerability: CVE-2022-47876
Description:The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts.
Explain the vulnerability: CVE-2022-47460
Description:In gpu device, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel.
Explain the vulnerability: CVE-2022-47933
Description:Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFSRedirectWork() in ipfs_redirect_network_delegate_helper.cc.
Explain the vulnerability: CVE-2022-47102
Description:A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
Explain the vulnerability: CVE-2022-47440
Description:Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin <= 1.9.10 versions.
Explain the vulnerability: CVE-2022-47155
Description:Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Slider by Supsystic plugin <= 1.8.5 versions.
Explain the vulnerability: CVE-2022-47505
Description:The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges.
Explain the vulnerability: CVE-2022-47769
Description:An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious files in the web root of the application to gain access to the server via the web shell.
Explain the vulnerability: CVE-2022-47456
Description:In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-47143
Description:Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin – MPG plugin <= 3.3.9 versions.
Explain the vulnerability: CVE-2022-47790
Description:Sourcecodester Dynamic Transaction Queuing System v1.0 is vulnerable to SQL Injection via /queuing/index.php?page=display&id=.
Explain the vulnerability: CVE-2022-47952
Description:lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist.
Explain the vulnerability: CVE-2022-47544
Description:An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed.
Explain the vulnerability: CVE-2022-47378
Description:Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.
Explain the vulnerability: CVE-2022-47495
Description:In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-47180
Description:Cross-Site Request Forgery (CSRF) vulnerability in Kopa Theme Kopa Framework plugin <= 1.3.5 versions.
Explain the vulnerability: CVE-2022-47616
Description:Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an administrator, can use the management page to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.
Explain the vulnerability: CVE-2022-47092
Description:GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is contains an Integer overflow vulnerability in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8316
Explain the vulnerability: CVE-2022-47138
Description:Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <= 2.1 versions.
Explain the vulnerability: CVE-2022-47354
Description:In log service, there is a missing permission check. This could lead to local denial of service in log service.
Explain the vulnerability: CVE-2022-47211
Description:Microsoft Office Graphics Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-47591
Description:Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin <= 3.2.1 versions.
Explain the vulnerability: CVE-2022-47968
Description:Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.
Explain the vulnerability: CVE-2022-47342
Description:In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Explain the vulnerability: CVE-2022-47657
Description:GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function hevc_parse_vps_extension of media_tools/av_parsers.c:7662
Explain the vulnerability: CVE-2022-47483
Description:In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47179
Description:Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <= 5.6.11 leads to post duplication as a draft.
Explain the vulnerability: CVE-2022-47196
Description:An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_head` for a post.
Explain the vulnerability: CVE-2022-47745
Description:ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a special request and sending it to function importNotice.
Explain the vulnerability: CVE-2022-47600
Description:Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Mass Email To users plugin <= 1.1.4 versions.
Explain the vulnerability: CVE-2022-47488
Description:In spipe drive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-47172
Description:Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.6.2 versions.
Explain the vulnerability: CVE-2022-47522
Description:The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
Explain the vulnerability: CVE-2022-47467
Description:In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Explain the vulnerability: CVE-2022-47125
Description:Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasicSet.
Explain the vulnerability: CVE-2022-47076
Description:An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx.
Explain the vulnerability: CVE-2022-47426
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Neshan Maps Platform Neshan Maps neshan-maps allows SQL Injection.This issue affects Neshan Maps: from n/a through 1.1.4.
Explain the vulnerability: CVE-2022-47164
Description:Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions.
Explain the vulnerability: CVE-2022-47471
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47021
Description:A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.
Explain the vulnerability: CVE-2022-47758
Description:Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.
Explain the vulnerability: CVE-2022-47373
Description:Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.
Explain the vulnerability: CVE-2022-47148
Description:Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss.
Explain the vulnerability: CVE-2022-47518
Description:An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.
Explain the vulnerability: CVE-2022-47631
Description:Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if it detects malicious DLLs in this directory, attackers can exploit a race condition and replace a valid DLL (i.e., a copy of a legitimate Razer DLL) with a malicious DLL after the service has already checked the file. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows.
Explain the vulnerability: CVE-2022-47324
Description:In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Explain the vulnerability: CVE-2022-47332
Description:In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Explain the vulnerability: CVE-2022-47762
Description:In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.
Explain the vulnerability: CVE-2022-47559
Description:Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity.
Explain the vulnerability: CVE-2022-47365
Description:In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-47607
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Usersnap plugin <= 4.16 versions.
Explain the vulnerability: CVE-2022-47484
Description:In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47191
Description:Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges.
Explain the vulnerability: CVE-2022-47892
Description:All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials.
Explain the vulnerability: CVE-2022-47938
Description:An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT.
Explain the vulnerability: CVE-2022-47715
Description:In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.
Explain the vulnerability: CVE-2022-47345
Description:In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Explain the vulnerability: CVE-2022-47129
Description:PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.
Explain the vulnerability: CVE-2022-47083
Description:Spitfire CMS 1.0.475 is vulnerable to PHP Object Injection.
Explain the vulnerability: CVE-2022-47353
Description:In vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of service with System execution privileges needed
Explain the vulnerability: CVE-2022-47703
Description:TIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5.0_LCD_20200513, Firmware Version MV8.003, and Hardware Version CPF906-V5.0_LCD_20200513.
Explain the vulnerability: CVE-2022-47095
Description:GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer overflow in hevc_parse_vps_extension function of media_tools/av_parsers.c
Explain the vulnerability: CVE-2022-47611
Description:Cross-Site Request Forgery (CSRF) vulnerability in Julian Weinert // cs&m Hover Image plugin <= 1.4.1 versions.
Explain the vulnerability: CVE-2022-47492
Description:In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Explain the vulnerability: CVE-2022-47187
Description:There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file.
Explain the vulnerability: CVE-2022-47390
Description:An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Explain the vulnerability: CVE-2022-47328
Description:In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Explain the vulnerability: CVE-2022-47514
Description:An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.
Explain the vulnerability: CVE-2022-47144
Description:Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic – Media Library Folders plugin <= 2.8.1 versions.
Explain the vulnerability: CVE-2022-47152
Description:Cross-Site Request Forgery (CSRF) vulnerability in Etison, LLC ClickFunnels plugin <= 3.1.1 versions.
Explain the vulnerability: CVE-2022-47502
Description:Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose.


Links can be activated by clicks, or by automatic document events.

The execution of such links must be subject to user approval.

In the affected versions of OpenOffice, approval for certain links is not   requested; when activated, such links could therefore result in arbitrary script execution.
Explain the vulnerability: CVE-2022-47386
Description:An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Explain the vulnerability: CVE-2022-47369
Description:In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-47410
Description:An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.
Explain the vulnerability: CVE-2022-47040
Description:An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command after placing a crafted file in the /tmp directory and sending crafted packets through port 80.
Explain the vulnerability: CVE-2022-47943
Description:An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a large length in the zero DataOffset case.
Explain the vulnerability: CVE-2022-47555
Description:Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.
Explain the vulnerability: CVE-2022-47105
Description:Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.
Explain the vulnerability: CVE-2022-47411
Description:An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations.
Explain the vulnerability: CVE-2022-47942
Description:An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE command.
Explain the vulnerability: CVE-2022-47554
Description:Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server.
Explain the vulnerability: CVE-2022-47387
Description:An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Explain the vulnerability: CVE-2022-47368
Description:In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-47446
Description:Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin <= 3.98.7 versions.
Explain the vulnerability: CVE-2022-47503
Description:SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
Explain the vulnerability: CVE-2022-47450
Description:In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Explain the vulnerability: CVE-2022-47515
Description:An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to std::length_error.
Explain the vulnerability: CVE-2022-47145
Description:Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments – Blockonomics plugin <= 3.5.7 versions.
Explain the vulnerability: CVE-2022-47329
Description:In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Explain the vulnerability: CVE-2022-47542
Description:Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privileges.
Explain the vulnerability: CVE-2022-47391
Description:In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.
Explain the vulnerability: CVE-2022-47493
Description:In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Explain the vulnerability: CVE-2022-47169
Description:Cross-Site Request Forgery (CSRF) vulnerability in StaxWP Visibility Logic for Elementor plugin <= 2.3.4 versions.
Explain the vulnerability: CVE-2022-47610
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mr Digital Simple Image Popup plugin <= 1.3.6 versions.
Explain the vulnerability: CVE-2022-47094
Description:GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Null pointer dereference via filters/dmx_m2ts.c:343 in m2tsdmx_declare_pid
Explain the vulnerability: CVE-2022-47581
Description:Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request.
Explain the vulnerability: CVE-2022-47352
Description:In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Explain the vulnerability: CVE-2022-47128
Description:Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet.
Explain the vulnerability: CVE-2022-47597
Description:Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1.
Explain the vulnerability: CVE-2022-47714
Description:Last Yard 22.09.8-1 does not enforce HSTS headers
Explain the vulnerability: CVE-2022-47190
Description:Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root.
Explain the vulnerability: CVE-2022-47939
Description:An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after-free and OOPS for SMB2_TREE_DISCONNECT.
Explain the vulnerability: CVE-2022-47364
Description:In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-47558
Description:Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors.
Explain the vulnerability: CVE-2022-47630
Description:Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.
Explain the vulnerability: CVE-2022-47325
Description:In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Explain the vulnerability: CVE-2022-47149
Description:Cross-Site Request Forgery (CSRF) vulnerability in Pretty Links plugin <= 3.4.0 versions.
Explain the vulnerability: CVE-2022-47519
Description:An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.
Explain the vulnerability: CVE-2022-47866
Description:Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php.
Explain the vulnerability: CVE-2022-47165
Description:Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule plugin <= 3.3.8 versions.
Explain the vulnerability: CVE-2022-47470
Description:In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-47132
Description:A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.
Explain the vulnerability: CVE-2022-47562
Description:Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition.
Explain the vulnerability: CVE-2022-47974
Description:The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the Bluetooth process to restart.
Explain the vulnerability: CVE-2022-47348
Description:In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Explain the vulnerability: CVE-2022-47124
Description:Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey4 parameter at /goform/WifiBasicSet.
Explain the vulnerability: CVE-2022-47431
Description:Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <= 2.0.14 versions.
Explain the vulnerability: CVE-2022-47489
Description:In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-47173
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nasirahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration plugin <= 1.62.0 versions.
Explain the vulnerability: CVE-2022-47523
Description:Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.
Explain the vulnerability: CVE-2022-47870
Description:A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows remote attackers to inject arbitrary web Script or HTML via the returnUrl parameter.
Explain the vulnerability: CVE-2022-47466
Description:In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Explain the vulnerability: CVE-2022-47367
Description:In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47388
Description:An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Explain the vulnerability: CVE-2022-47330
Description:In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Explain the vulnerability: CVE-2022-47449
Description:Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RexTheme Cart Lift – Abandoned Cart Recovery for WooCommerce and EDD plugin <= 3.1.5 versions.
Explain the vulnerability: CVE-2022-47326
Description:In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Explain the vulnerability: CVE-2022-47633
Description:An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations are available for impacted releases.
Explain the vulnerability: CVE-2022-47371
Description:In bt driver, there is a thread competition leads to early release of resources to be accessed. This could lead to local denial of service in kernel.
Explain the vulnerability: CVE-2022-47664
Description:Libde265 1.0.9 is vulnerable to Buffer Overflow in ff_hevc_put_hevc_qpel_pixels_8_sse
Explain the vulnerability: CVE-2022-47408
Description:An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. There is a CAPTCHA bypass that can lead to subscribing many people.
Explain the vulnerability: CVE-2022-47473
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47166
Description:Cross-Site Request Forgery (CSRF) vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.1.1 versions.
Explain the vulnerability: CVE-2022-47865
Description:Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php.
Explain the vulnerability: CVE-2022-47648
Description:An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publicly available B420 product using valid credentials, an insider attacker can gain access to the same panel without requiring any sort of authorization. The B420 module was already obsolete at the time this vulnerability was found (The End of Life announcement was made in 2013).
Explain the vulnerability: CVE-2022-47977
Description:A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0). The affected application contains a memory corruption vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
Explain the vulnerability: CVE-2022-47131
Description:A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.
Explain the vulnerability: CVE-2022-47561
Description:The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious actions.
Explain the vulnerability: CVE-2022-47432
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB allows SQL Injection.This issue affects Shortcode IMDB: from n/a through 6.0.8.
Explain the vulnerability: CVE-2022-47598
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Plugins Pro WP Super Popup plugin <= 1.1.2 versions.
Explain the vulnerability: CVE-2022-47577
Description:An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by making use of a virtual machine (VM). This allows a file to be exchanged outside the laptop/system. VMs can be created by any user (even without admin rights). The data exfiltration can occur without any record in the audit trail of Windows events on the host machine. NOTE: the vendor's position is "it's not a vulnerability in our product."
Explain the vulnerability: CVE-2022-47127
Description:Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd parameter at /goform/WifiBasicSet.
Explain the vulnerability: CVE-2022-47609
Description:Cross-Site Request Forgery (CSRF) vulnerability in Nicearma DNUI plugin <= 2.8.1 versions.
Explain the vulnerability: CVE-2022-47035
Description:Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /CPE endpoint.
Explain the vulnerability: CVE-2022-47465
Description:In vdsp service, there is a missing permission check. This could lead to local denial of service in vdsp service.
Explain the vulnerability: CVE-2022-47936
Description:A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.1 (All versions < V35.1.150). The affected application contains a stack overflow vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
Explain the vulnerability: CVE-2022-47873
Description:Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).
Explain the vulnerability: CVE-2022-47170
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.48 versions.
Explain the vulnerability: CVE-2022-47520
Description:An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.
Explain the vulnerability: CVE-2022-47557
Description:Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequently gain access to the system to perform malicious actions.
Explain the vulnerability: CVE-2022-47941
Description:An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate error conditions, aka a memory leak.
Explain the vulnerability: CVE-2022-47042
Description:MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
Explain the vulnerability: CVE-2022-47384
Description:An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Explain the vulnerability: CVE-2022-47853
Description:TOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell through a specially constructed payload.
Explain the vulnerability: CVE-2022-47500
Description:URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4.



Solution: removed the the forward component since it was improper designed for UI embedding.

 User please upgrade to 1.1.0 to fix this issue.
Explain the vulnerability: CVE-2022-47015
Description:MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.
Explain the vulnerability: CVE-2022-47445
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Web-X Be POPIA Compliant be-popia-compliant allows SQL Injection.This issue affects Be POPIA Compliant: from n/a through 1.2.0.
Explain the vulnerability: CVE-2022-47146
Description:Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <= 3.3.1 versions.
Explain the vulnerability: CVE-2022-47453
Description:In wcn service, there is a possible missing params check. This could lead to local denial of service in wcn service.
Explain the vulnerability: CVE-2022-47003
Description:A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.
Explain the vulnerability: CVE-2022-47392
Description:An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can lead to a denial-of-service condition.
Explain the vulnerability: CVE-2022-47185
Description:Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
Explain the vulnerability: CVE-2022-47490
Description:In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Explain the vulnerability: CVE-2022-47613
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud AI ChatBot plugin <= 4.3.0 versions.
Explain the vulnerability: CVE-2022-47428
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System allows SQL Injection.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.7.
Explain the vulnerability: CVE-2022-47351
Description:In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Explain the vulnerability: CVE-2022-47701
Description:COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS).
Explain the vulnerability: CVE-2022-47717
Description:Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).
Explain the vulnerability: CVE-2022-47347
Description:In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Explain the vulnerability: CVE-2022-47469
Description:In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-47486
Description:In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-47605
Description:Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions.
Explain the vulnerability: CVE-2022-47740
Description:Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.
Explain the vulnerability: CVE-2022-47311
Description:A proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the username and password; it also contains the configuration data for the user specified. If the user does not exist, then it sends a value for username and password, which allows successful authentication for a connection.
Explain the vulnerability: CVE-2022-47891
Description:All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery function.
Explain the vulnerability: CVE-2022-47192
Description:Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password.
Explain the vulnerability: CVE-2022-47468
Description:In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Explain the vulnerability: CVE-2022-47487
Description:In thermal service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service local denial of service with no additional execution privileges.
Explain the vulnerability: CVE-2022-47653
Description:GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in eac3_update_channels function of media_tools/av_parsers.c:9113
Explain the vulnerability: CVE-2022-47346
Description:In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Explain the vulnerability: CVE-2022-47983
Description:IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  243161.
Explain the vulnerability: CVE-2022-47350
Description:In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Explain the vulnerability: CVE-2022-47583
Description:Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.
Explain the vulnerability: CVE-2022-47612
Description:Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update.
Explain the vulnerability: CVE-2022-47757
Description:In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's data directory. This may allow an attacker to save a shared library under a special directory which the app uses to dynamically load modules. Loading the library can lead to arbitrary code execution.
Explain the vulnerability: CVE-2022-47184
Description:Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.
Explain the vulnerability: CVE-2022-47491
Description:In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-47393
Description:An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.
Explain the vulnerability: CVE-2022-47517
Description:An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.
Explain the vulnerability: CVE-2022-47147
Description:Cross-Site Request Forgery (CSRF) vulnerability in Kesz1 Technologies ipBlockList plugin <= 1.0 versions.
Explain the vulnerability: CVE-2022-47452
Description:In gnss driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-47002
Description:A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.
Explain the vulnerability: CVE-2022-47501
Description:Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a 
pre-authentication attack.
This issue affects Apache OFBiz: before 18.12.07.
Explain the vulnerability: CVE-2022-47444
Description:Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin <= 4.5.3 versions.
Explain the vulnerability: CVE-2022-47385
Description:An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Explain the vulnerability: CVE-2022-47556
Description:Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service (DoS) on the device.
Explain the vulnerability: CVE-2022-47940
Description:An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write.
Explain the vulnerability: CVE-2022-47034
Description:A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.
Explain the vulnerability: CVE-2022-47464
Description:In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.