saikiranpennam/new_cves_pps huggingface dataset:
Explain the vulnerability: CVE-2022-47937
Description:** UNSUPPORTED WHEN ASSIGNED ** 





Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input.




NOTE: This vulnerability 
only affects products that are no longer supported by the maintainer




The org.apache.sling.commons.json bundle has been deprecated as of March
 2017 and should not be used anymore. Consumers are encouraged to 
consider the Apache Sling Commons Johnzon OSGi bundle provided by the 
Apache Sling project, but may of course use other JSON libraries.
Explain the vulnerability: CVE-2022-47872
Description:maccms10 2021.1000.2000 is vulnerable to Server-side request forgery (SSRF).
Explain the vulnerability: CVE-2022-47171
Description:Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul C. Schroeder IP Vault – WP Firewall plugin <= 1.1 versions.
Explain the vulnerability: CVE-2022-47521
Description:An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.
Explain the vulnerability: CVE-2022-47608
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions.
Explain the vulnerability: CVE-2022-47433
Description:Unauth. Reflected Cross-Site Scripting vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.
Explain the vulnerability: CVE-2022-47599
Description:Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.
Explain the vulnerability: CVE-2022-47126
Description:Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.
Explain the vulnerability: CVE-2022-47075
Description:An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.
Explain the vulnerability: CVE-2022-47976
Description:The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may disconnect normal service connections.
Explain the vulnerability: CVE-2022-47130
Description:A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privileges interacts on the CSRF page.
Explain the vulnerability: CVE-2022-47560
Description:The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged in.
Explain the vulnerability: CVE-2022-47188
Description:There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path.
Explain the vulnerability: CVE-2022-47472
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47409
Description:An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Attackers can unsubscribe everyone via a series of modified subscription UIDs in deleteAction operations.
Explain the vulnerability: CVE-2022-47370
Description:In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-47665
Description:Libde265 1.0.9 has a heap buffer overflow vulnerability in de265_image::set_SliceAddrRS(int, int, int)
Explain the vulnerability: CVE-2022-47327
Description:In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Explain the vulnerability: CVE-2022-47632
Description:Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if the malicious DLLs are unsigned, it suffices to use self-signed DLLs. The validity of the DLL signatures is not checked. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows.
Explain the vulnerability: CVE-2022-47448
Description:Cross-Site Request Forgery (CSRF) vulnerability in dev.Xiligroup.Com - MS plugin <= 1.12.03 versions.
Explain the vulnerability: CVE-2022-47331
Description:In wlan driver, there is a race condition. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-47366
Description:In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-47389
Description:An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Explain the vulnerability: CVE-2022-47673
Description:An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts.
Explain the vulnerability: CVE-2022-47551
Description:Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.
Explain the vulnerability: CVE-2022-47414
Description:
If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.
Explain the vulnerability: CVE-2022-47382
Description:An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Explain the vulnerability: CVE-2022-47443
Description:Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <= 5.0.5 versions.
Explain the vulnerability: CVE-2022-47140
Description:Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <= 4.0.1 versions.
Explain the vulnerability: CVE-2022-47455
Description:In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Explain the vulnerability: CVE-2022-47117
Description:Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security parameter at /goform/WifiBasicSet.
Explain the vulnerability: CVE-2022-47547
Description:GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.
Explain the vulnerability: CVE-2022-47951
Description:An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
Explain the vulnerability: CVE-2022-47052
Description:The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS and HTML Injection. A malicious unauthenticated attacker can exploit this vulnerability using a specially crafted URL. This affects firmware versions: V1.1.0.112_1.0.1, V1.1.0.114_1.0.1.
Explain the vulnerability: CVE-2022-47880
Description:An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleartext password via the 'test connection' function.
Explain the vulnerability: CVE-2022-47029
Description:An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update.
Explain the vulnerability: CVE-2022-47183
Description:Cross-Site Request Forgery (CSRF) vulnerability in StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin <= 0.2.6 versions.
Explain the vulnerability: CVE-2022-47479
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47615
Description:Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions.
Explain the vulnerability: CVE-2022-47091
Description:GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow in gf_text_process_sub function of filters/load_text.c
Explain the vulnerability: CVE-2022-47212
Description:Microsoft Office Graphics Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-47438
Description:Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <= 3.2.3 versions.
Explain the vulnerability: CVE-2022-47087
Description:GPAC MP4box 2.1-DEV-rev574-g9d5bb184b has a Buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c
Explain the vulnerability: CVE-2022-47984
Description:IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.  IBM X-Force ID:  243163.
Explain the vulnerability: CVE-2022-47654
Description:GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8261
Explain the vulnerability: CVE-2022-47341
Description:In engineermode services, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Explain the vulnerability: CVE-2022-47195
Description:An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `facebook` field for a user.
Explain the vulnerability: CVE-2022-47879
Description:A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods.
Explain the vulnerability: CVE-2022-47480
Description:In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47603
Description:Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.1 versions.
Explain the vulnerability: CVE-2022-47361
Description:In firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Explain the vulnerability: CVE-2022-47418
Description:LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document version comments.
Explain the vulnerability: CVE-2022-47336
Description:In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Explain the vulnerability: CVE-2022-47766
Description:PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.
Explain the vulnerability: CVE-2022-47859
Description:Lead Management System v1.0 is vulnerable to SQL Injection via the user_id parameter in changePassword.php.
Explain the vulnerability: CVE-2022-47770
Description:Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.
Explain the vulnerability: CVE-2022-47320
Description:The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.
Explain the vulnerability: CVE-2022-47635
Description:Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via ZohoClient.php.
Explain the vulnerability: CVE-2022-47377
Description:Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.13.4 as soon as possible (available in SICK Support Portal).
Explain the vulnerability: CVE-2022-47160
Description:Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wpmet Wp Social Login and Register Social Counter.This issue affects Wp Social Login and Register Social Counter: from n/a through 1.9.0.
Explain the vulnerability: CVE-2022-47588
Description:Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1.8.1.
Explain the vulnerability: CVE-2022-47422
Description:Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin Accept Stripe Donation – AidWP plugin <= 3.1.5 versions.
Explain the vulnerability: CVE-2022-47208
Description:The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication.
Explain the vulnerability: CVE-2022-47658
Description:GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function gf_hevc_read_vps_bs_internal of media_tools/av_parsers.c:8039
Explain the vulnerability: CVE-2022-47434
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PB SEO Friendly Images plugin <= 4.0.5 versions.
Explain the vulnerability: CVE-2022-47967
Description:A vulnerability has been identified in Solid Edge (All versions < V2023 MP1). The DOCMGMT.DLL contains a memory corruption vulnerability that could be triggered while parsing files in different file formats such as PAR, ASM, DFT. This could allow an attacker to execute code in the context of the current process.
Explain the vulnerability: CVE-2022-47930
Description:An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.
Explain the vulnerability: CVE-2022-47463
Description:In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Explain the vulnerability: CVE-2022-47526
Description:Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the downstream node user. Exploitation of this issue does not require user interaction.
Explain the vulnerability: CVE-2022-47875
Description:A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary code.
Explain the vulnerability: CVE-2022-47931
Description:IO FinNet tss-lib before 2.0.0 allows a collision of hash values.
Explain the vulnerability: CVE-2022-47462
Description:In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Explain the vulnerability: CVE-2022-47177
Description:Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions.
Explain the vulnerability: CVE-2022-47435
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Olive Design WP-OliveCart plugin <= 1.1.3 versions.
Explain the vulnerability: CVE-2022-47065
Description:TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Explain the vulnerability: CVE-2022-47966
Description:Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
Explain the vulnerability: CVE-2022-47120
Description:Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.
Explain the vulnerability: CVE-2022-47209
Description:A support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for this account is “support” and cannot be changed by a user via any normally accessible means.
Explain the vulnerability: CVE-2022-47659
Description:GPAC MP4box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to Buffer Overflow in gf_bs_read_data
Explain the vulnerability: CVE-2022-47589
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in this.Functional CTT Expresso para WooCommerce plugin <= 3.2.11 versions.
Explain the vulnerability: CVE-2022-47073
Description:A cross-site scripting (XSS) vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter.
Explain the vulnerability: CVE-2022-47423
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ulf Benjaminsson WP-dTree plugin <= 4.4.5 versions.
Explain the vulnerability: CVE-2022-47136
Description:Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions.
Explain the vulnerability: CVE-2022-47474
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47024
Description:A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts.
Explain the vulnerability: CVE-2022-47927
Description:An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data.
Explain the vulnerability: CVE-2022-47862
Description:Lead Management System v1.0 is vulnerable to SQL Injection via the customer_id parameter in ajax_represent.php.
Explain the vulnerability: CVE-2022-47531
Description:An issue was discovered in Ericsson Evolved Packet Gateway (EPG) versions 3.x before 3.25 and 2.x before 2.16, allows authenticated users to bypass system CLI and execute commands they are authorized to execute directly in the UNIX shell.
Explain the vulnerability: CVE-2022-47161
Description:Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions.
Explain the vulnerability: CVE-2022-47618
Description:Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials. An unauthenticated remote attacker can use these credentials to log in administrator page, to manipulate system or disrupt service.
Explain the vulnerability: CVE-2022-47376
Description:The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data.
Explain the vulnerability: CVE-2022-47634
Description:M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access and manipulate archive data via certain HTTP endpoints, aka LINK-2867.
Explain the vulnerability: CVE-2022-47767
Description:A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects all Solar-Log devices that use firmware version v4.2.7 up to v5.1.1 (included).
Explain the vulnerability: CVE-2022-47360
Description:In log service, there is a missing permission check. This could lead to local denial of service in log service.
Explain the vulnerability: CVE-2022-47602
Description:Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in JoomUnited WP Table Manager plugin <= 3.5.2 versions.
Explain the vulnerability: CVE-2022-47317
Description:Out-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.
Explain the vulnerability: CVE-2022-47747
Description:kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.
Explain the vulnerability: CVE-2022-47878
Description:Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify the location as Webroot directory. Consecutive file uploads can lead to the execution of arbitrary code.
Explain the vulnerability: CVE-2022-47655
Description:Libde265 1.0.9 is vulnerable to Buffer Overflow in function void put_qpel_fallback<unsigned short>
Explain the vulnerability: CVE-2022-47340
Description:In h265 codec firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges.
Explain the vulnerability: CVE-2022-47593
Description:Auth. (subscriber+) SQL Injection (SQLi) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize plugin <= 1.6.35 versions.
Explain the vulnerability: CVE-2022-47086
Description:GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentation violation via the function gf_sm_load_init_swf at scene_manager/swf_parse.c
Explain the vulnerability: CVE-2022-47213
Description:Microsoft Office Graphics Remote Code Execution Vulnerability
Explain the vulnerability: CVE-2022-47614
Description:Unauth. SQL Injection (SQLi) vulnerability in InspireUI MStore API plugin <= 3.9.7 versions.
Explain the vulnerability: CVE-2022-47881
Description:Foxit PDF Reader and PDF Editor 11.2.1.53537 and earlier has an Out-of-Bounds Read vulnerability.
Explain the vulnerability: CVE-2022-47478
Description:In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Explain the vulnerability: CVE-2022-47497
Description:In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-47395
Description:Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operations and cause a denial-of-service condition.
Explain the vulnerability: CVE-2022-47950
Description:An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).
Explain the vulnerability: CVE-2022-47053
Description:An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file.
Explain the vulnerability: CVE-2022-47141
Description:Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Dynamic Keywords Injector plugin <= 2.3.15 versions.
Explain the vulnerability: CVE-2022-47157
Description:Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Don Benjamin WP Custom Fields Search plugin <= 1.2.34 versions.
Explain the vulnerability: CVE-2022-47507
Description:SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
Explain the vulnerability: CVE-2022-47854
Description:i-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.
Explain the vulnerability: CVE-2022-47911
Description:Sewio’s Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.
Explain the vulnerability: CVE-2022-47442
Description:Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.
Explain the vulnerability: CVE-2022-47383
Description:An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can lead to a denial-of-service condition, memory overwriting, or remote code execution.
Explain the vulnerability: CVE-2022-47100
Description:A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802.15.4 frame.
Explain the vulnerability: CVE-2022-47415
Description:LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messaging system (both subject and message bodies).
Explain the vulnerability: CVE-2022-47946
Description:An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can occur in some situations by forking a process and then quickly terminating it. NOTE: later kernel versions, such as the 5.15 longterm series, substantially changed the implementation of io_sqpoll_wait_sq.
Explain the vulnerability: CVE-2022-48327
Description:Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) dataInicial, (2) dataFinal, (3) tipocliente, (4) format, (5) precoInicial, (6) precoFinal, (7) estoqueInicial, (8) estoqueFinal, (9) de_id, (10) ate_id, (11) clientes_id, (12) origem, (13) cliente, (14) responsavel, (15) status, (16) tipo, (17) situacao in file application/controllers/Relatorios.php; (18) preco, (19) nome, (20) descricao, (21) idServicos, (22) id in file application/controllers/Servicos.php; (23) senha, (24) permissoes_id, (25) idUsuarios, (26) situacao, (27) nome, (28) rg, (29) cpf, (30) cep, (31) rua, (32) numero, (33) bairro, (34) cidade, (35) estado, (36) email, (37) telefone, (38) celular in file application/controllers/Usuarios.php; (39) dataVenda, (40) observacoes, (41) observacoes_cliente, (42) clientes_id, (43) usuarios_id, (44) idVendas, (45) id, (46) idVendasProduto, (47) preco, (48) quantidade, (49) idProduto, (50) produto, (51) desconto, (52) tipoDesconto, (53) resultado, (54) vendas_id, (55) vencimento, (56) recebimento, (57) valor, (58) recebido, (59) formaPgto, (60) tipo in file application/controllers/Vendas.php; (61) situacao, (62) periodo, (63) vencimento_de, (64) vencimento_ate, (65) tipo, (66) status, (67) cliente in file application/views/financeiro/lancamentos.php; (68) year in file application/views/mapos/painel.php; (69) pesquisa in file application/views/os/os.php; (70) etiquetaCode in file application/views/relatorios/imprimir/imprimirEtiquetas.php.
Explain the vulnerability: CVE-2022-48370
Description:In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
Explain the vulnerability: CVE-2022-48235
Description:In MP3 encoder, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-48366
Description:An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
Explain the vulnerability: CVE-2022-48223
Description:An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK repair, certutil.exe is called by the Acuant installer to repair certificates. This call is vulnerable to DLL hijacking due to a race condition and insecure permissions on the executing directory.
Explain the vulnerability: CVE-2022-48448
Description:In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Explain the vulnerability: CVE-2022-48331
Description:Widevine Trusted Application (TA) 5.0.0 through 5.1.1 has a drm_save_keys feature_name_len integer overflow and resultant buffer overflow.
Explain the vulnerability: CVE-2022-48599
Description:A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
Explain the vulnerability: CVE-2022-48433
Description:In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.
Explain the vulnerability: CVE-2022-48126
Description:TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function.
Explain the vulnerability: CVE-2022-48464
Description:In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
Explain the vulnerability: CVE-2022-48521
Description:An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when in fact it has none.
Explain the vulnerability: CVE-2022-48188
Description:A buffer overflow vulnerability in the SecureBootDXE BIOS driver of some Lenovo Desktop and ThinkStation models could allow an attacker with local access to elevate their privileges to execute arbitrary code.
Explain the vulnerability: CVE-2022-48472
Description:A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution. Affected product versions include:BiSheng-WNM versions OTA-BiSheng-FW-2.0.0.211-beta,BiSheng-WNM FW 3.0.0.325,BiSheng-WNM FW 2.0.0.211.
Explain the vulnerability: CVE-2022-48425
Description:In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.
Explain the vulnerability: CVE-2022-48560
Description:A use-after-free exists in Python through 3.9 via heappushpop in heapq.
Explain the vulnerability: CVE-2022-48281
Description:processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a crafted TIFF image.
Explain the vulnerability: CVE-2022-48517
Description:Unauthorized service access vulnerability in the DSoftBus module. Successful exploitation of this vulnerability will affect availability.
Explain the vulnerability: CVE-2022-48452
Description:In Ifaa service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
Explain the vulnerability: CVE-2022-48110
Description:CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).
Explain the vulnerability: CVE-2022-48385
Description:In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-48444
Description:In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Explain the vulnerability: CVE-2022-48346
Description:The HwContacts module has a logic bypass vulnerability. Successful exploitation of this vulnerability may affect confidentiality.
Explain the vulnerability: CVE-2022-48595
Description:A SQL injection vulnerability exists in the “ticket template watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
Explain the vulnerability: CVE-2022-48604
Description:A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
Explain the vulnerability: CVE-2022-48254
Description:There is a data processing error vulnerability in Leia-B29 2.0.0.49(M03). Successful exploitation could bypass lock screen authentication.
Explain the vulnerability: CVE-2022-48192
Description:Cross-site Scripting vulnerability in Softing smartLink SW-HT before 1.30, which allows an attacker to execute a dynamic script (JavaScript, VBScript) in the context of the application.
Explain the vulnerability: CVE-2022-48468
Description:protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
Explain the vulnerability: CVE-2022-48487
Description:Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
Explain the vulnerability: CVE-2022-48242
Description:In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
Explain the vulnerability: CVE-2022-48612
Description:A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.7 allows remote attackers to inject JavaScript into any webpage, because a regular expression (validating whether a URL is controlled by ClassLink) is not present in all applicable places.
Explain the vulnerability: CVE-2022-48307
Description:It was discovered that the Magritte-ftp was not verifying hostnames in TLS certificates due to a misuse of the javax.net.ssl.SSLSocketFactory API. A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. In the case of a successful man in the middle attack on magritte-ftp, an attacker would be able to read and modify network traffic such as authentication tokens or raw data entering a Palantir Foundry stack.
Explain the vulnerability: CVE-2022-48491
Description:Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead to ads and other windows to display at any time.
Explain the vulnerability: CVE-2022-48350
Description:The HUAWEI Messaging app has a vulnerability of unauthorized file access. Successful exploitation of this vulnerability may affect confidentiality.
Explain the vulnerability: CVE-2022-48583
Description:A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
Explain the vulnerability: CVE-2022-48079
Description:Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system.
Explain the vulnerability: CVE-2022-48429
Description:In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
Explain the vulnerability: CVE-2022-48582
Description:A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
Explain the vulnerability: CVE-2022-48078
Description:pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.
Explain the vulnerability: CVE-2022-48428
Description:In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible
Explain the vulnerability: CVE-2022-48351
Description:The secure OS module has configuration defects. Successful exploitation of this vulnerability may affect availability.
Explain the vulnerability: CVE-2022-48490
Description:Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
Explain the vulnerability: CVE-2022-48243
Description:In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Explain the vulnerability: CVE-2022-48306
Description:Improper Validation of Certificate with Host Mismatch vulnerability in Gotham Chat IRC helper of Palantir Gotham allows A malicious attacker in a privileged network position could abuse this to perform a man-in-the-middle attack. A successful man-in-the-middle attack would allow them to intercept, read, or modify network communications to and from the affected service. This issue affects: Palantir Palantir Gotham Chat IRC helper versions prior to 30221005.210011.9242.
Explain the vulnerability: CVE-2022-48469
Description:There is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers.
Explain the vulnerability: CVE-2022-48486
Description:Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
Explain the vulnerability: CVE-2022-48605
Description:Input verification vulnerability in the fingerprint module. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availability.
Explain the vulnerability: CVE-2022-48310
Description:An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versions older than 2.2.90.
Explain the vulnerability: CVE-2022-48594
Description:A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
Explain the vulnerability: CVE-2022-48347
Description:The MediaProvider module has a vulnerability in permission verification. Successful exploitation of this vulnerability may affect confidentiality.
Explain the vulnerability: CVE-2022-48500
Description:Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
Explain the vulnerability: CVE-2022-48150
Description:Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.
Explain the vulnerability: CVE-2022-48279
Description:In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firewall. NOTE: this is related to CVE-2022-39956 but can be considered independent changes to the ModSecurity (C language) codebase.
Explain the vulnerability: CVE-2022-48384
Description:In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Explain the vulnerability: CVE-2022-48541
Description:A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command.
Explain the vulnerability: CVE-2022-48111
Description:A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter.
Explain the vulnerability: CVE-2022-48238
Description:In Image filter, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Explain the vulnerability: CVE-2022-48392
Description:In dialer service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Explain the vulnerability: CVE-2022-48516
Description:Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerability will affect confidentiality.
Explain the vulnerability: CVE-2022-48453
Description:In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Explain the vulnerability: CVE-2022-48424
Description:In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur.
Explain the vulnerability: CVE-2022-48074
Description:An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file.
Explain the vulnerability: CVE-2022-48023
Description:Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. This is now corrected in v5.3.1 so that only agents with write permissions may change ticket tags.
Explain the vulnerability: CVE-2022-48189
Description:An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privileges to execute arbitrary code.
Explain the vulnerability: CVE-2022-48473
Description:There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
Explain the vulnerability: CVE-2022-48166
Description:An access control issue in Wavlink WL-WN530HG4 M30HG4.V5030.201217 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
Explain the vulnerability: CVE-2022-48259
Description:There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could allow attackers to gain higher privileges.
Explain the vulnerability: CVE-2022-48520
Description:Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.