stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-48355 (severity: MEDIUM, weakness: CWE-787)
The Bluetooth module has a heap out-of-bounds read vulnerability. Successful exploitation of this vulnerability can cause the Bluetooth process to crash.
CVE-2022-48356 (severity: HIGH, weakness: CWE-20)
The facial recognition module has a vulnerability in input parameter verification. Successful exploitation of this vulnerability may cause failed facial recognition.
CVE-2022-48357 (severity: HIGH, weakness: CWE-770)
Some products have the double fetch vulnerability. Successful exploitation of this vulnerability may cause denial of service (DoS) attacks to the kernel.
CVE-2022-48358 (severity: HIGH, weakness: CWE-601)
The BatteryHealthActivity has a redirection vulnerability. Successful exploitation of this vulnerability by a malicious app can cause service exceptions.
CVE-2022-48359 (severity: HIGH, weakness: CWE-915)
The recovery mode for updates has a vulnerability that causes arbitrary disk modification. Successful exploitation of this vulnerability may affect confidentiality.
CVE-2022-4836 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Breadcrumb WordPress plugin before 1.5.33 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-48360 (severity: HIGH, weakness: CWE-276)
The facial recognition module has a vulnerability in file permission control. Successful exploitation of this vulnerability may affect confidentiality.
CVE-2022-48361 (severity: MEDIUM, weakness: CWE-22)
The Always On Display (AOD) has a path traversal vulnerability in theme files. Successful exploitation of this vulnerability may cause a failure in reading AOD theme resources.
CVE-2022-48362 (severity: HIGH, weakness: CWE-22)
Zoho ManageEngine Desktop Central and Desktop Central MSP before 10.1.2137.2 allow directory traversal via computerName to AgentLogUploadServlet. A remote, authenticated attacker could upload arbitrary code that would be executed when Desktop Central is restarted. (The attacker could authenticate by exploiting CVE-2021-44515.)
CVE-2022-48363 (severity: HIGH, weakness: CWE-617)
In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain situations involving truncated files. Eventually there is an assertion failure in libmpdclient because libqtappfw passes in a NULL pointer.
CVE-2022-48364 (severity: MEDIUM, weakness: CWE-287)
The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive.
CVE-2022-48365 (severity: HIGH, weakness: CWE-269)
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.26. The Company admin role gives excessive privileges.
CVE-2022-48366 (severity: LOW, weakness: CWE-362)
An issue was discovered in eZ Platform Ibexa Kernel before 1.3.19. It allows determining account existence via a timing attack.
CVE-2022-48367 (severity: CRITICAL, weakness: CWE-862)
An issue was discovered in eZ Publish Ibexa Kernel before 7.5.28. Access control based on object state is mishandled.
CVE-2022-48368 (severity: HIGH, weakness: CWE-862)
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVE-2022-48369 (severity: HIGH, weakness: CWE-862)
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVE-2022-4837 (severity: MEDIUM, weakness: CWE-79)
The CPO Companion WordPress plugin before 1.1.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-48370 (severity: MEDIUM, weakness: CWE-862)
In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
CVE-2022-48371 (severity: MEDIUM, weakness: CWE-862)
In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
CVE-2022-48372 (severity: MEDIUM, weakness: CWE-787)
In bootcp service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48373 (severity: MEDIUM, weakness: CWE-787)
In tee service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48374 (severity: MEDIUM, weakness: CWE-787)
In tee service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48375 (severity: MEDIUM, weakness: CWE-862)
In contacts service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48376 (severity: MEDIUM, weakness: CWE-862)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48377 (severity: MEDIUM, weakness: CWE-862)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48378 (severity: MEDIUM, weakness: CWE-862)
In engineermode service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48379 (severity: MEDIUM, weakness: CWE-862)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-4838 (severity: MEDIUM, weakness: CWE-79)
The Clean Login WordPress plugin before 1.13.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-48380 (severity: MEDIUM, weakness: CWE-787)
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48381 (severity: MEDIUM, weakness: CWE-787)
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48382 (severity: MEDIUM, weakness: CWE-787)
In log service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48383 (severity: HIGH, weakness: CWE-862)
.In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVE-2022-48384 (severity: HIGH, weakness: CWE-862)
In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVE-2022-48385 (severity: MEDIUM, weakness: CWE-787)
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48386 (severity: MEDIUM, weakness: CWE-416)
the apipe driver, there is a possible use after free due to a logic error. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48387 (severity: MEDIUM, weakness: CWE-787)
the apipe driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48388 (severity: HIGH, weakness: CWE-862)
In powerEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVE-2022-48389 (severity: MEDIUM, weakness: CWE-787)
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-4839 (severity: HIGH, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-48390 (severity: HIGH, weakness: CWE-862)
In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVE-2022-48391 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48392 (severity: HIGH, weakness: CWE-862)
In dialer service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
CVE-2022-4840 (severity: HIGH, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-4841 (severity: HIGH, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-4842 (severity: MEDIUM, weakness: CWE-476)
A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found. A local user could use this flaw to crash the system.
CVE-2022-48422 (severity: HIGH, weakness: CWE-427)
ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located.
CVE-2022-48423 (severity: HIGH, weakness: CWE-787)
In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. An out-of-bounds write may occur.
CVE-2022-48424 (severity: HIGH, weakness: NVD-CWE-Other)
In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. An unhandled page fault may occur.
CVE-2022-48425 (severity: HIGH, weakness: CWE-763)
In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs.
CVE-2022-48426 (severity: MEDIUM, weakness: CWE-79)
In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible
CVE-2022-48427 (severity: MEDIUM, weakness: CWE-79)
In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible
CVE-2022-48428 (severity: MEDIUM, weakness: CWE-79)
In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible
CVE-2022-48429 (severity: MEDIUM, weakness: CWE-79)
In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible
CVE-2022-4843 (severity: MEDIUM, weakness: CWE-476)
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.8.2.
CVE-2022-48430 (severity: HIGH, weakness: CWE-200)
In JetBrains IntelliJ IDEA before 2023.1 file content could be disclosed via an external stylesheet path in Markdown preview.
CVE-2022-48431 (severity: HIGH, weakness: CWE-345)
In JetBrains IntelliJ IDEA before 2023.1 in some cases, Gradle and Maven projects could be imported without the “Trust Project” confirmation.
CVE-2022-48432 (severity: HIGH, weakness: CWE-1188)
In JetBrains IntelliJ IDEA before 2023.1 the bundled version of Chromium wasn't sandboxed.
CVE-2022-48433 (severity: HIGH, weakness: CWE-522)
In JetBrains IntelliJ IDEA before 2023.1 the NTLM hash could leak through an API method used in the IntelliJ IDEA built-in web server.
CVE-2022-48434 (severity: HIGH, weakness: CWE-416)
libavcodec/pthread_frame.c in FFmpeg before 5.1.2, as used in VLC and other products, leaves stale hwaccel state in worker threads, which allows attackers to trigger a use-after-free and execute arbitrary code in some circumstances (e.g., hardware re-initialization upon a mid-video SPS change when Direct3D11 is used).
CVE-2022-48435 (severity: LOW, weakness: CWE-532)
In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file
CVE-2022-48437 (severity: MEDIUM, weakness: CWE-295)
An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors that occur during leaf certificate verification, and therefore an incorrect error is returned. This behavior occurs when there is an installed verification callback that instructs the verifier to continue upon detecting an invalid certificate.
CVE-2022-48438 (severity: HIGH, weakness: CWE-787)
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48439 (severity: MEDIUM, weakness: CWE-787)
In cp_dump driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-4844 (severity: MEDIUM, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-48440 (severity: MEDIUM, weakness: CWE-862)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48441 (severity: MEDIUM, weakness: CWE-862)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48442 (severity: MEDIUM, weakness: CWE-862)
In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48443 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48444 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48445 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48446 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48447 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-48448 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-4845 (severity: MEDIUM, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-48450 (severity: MEDIUM, weakness: NVD-CWE-Other)
In bluetooth service, there is a possible missing params check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48451 (severity: MEDIUM, weakness: CWE-362)
In bluetooth service, there is a possible out of bounds write due to race condition. This could lead to local denial of service with System execution privileges needed.
CVE-2022-48452 (severity: MEDIUM, weakness: CWE-862)
In Ifaa service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
CVE-2022-48453 (severity: MEDIUM, weakness: CWE-787)
In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVE-2022-48454 (severity: MEDIUM, weakness: CWE-787)
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVE-2022-48455 (severity: MEDIUM, weakness: CWE-787)
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVE-2022-48456 (severity: MEDIUM, weakness: CWE-787)
In camera driver, there is a possible out of bounds write due to a incorrect bounds check. This could lead to local denial of service with System execution privileges needed
CVE-2022-48457 (severity: MEDIUM, weakness: CWE-20)
In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
CVE-2022-48458 (severity: MEDIUM, weakness: CWE-20)
In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
CVE-2022-48459 (severity: MEDIUM, weakness: CWE-20)
In TeleService, there is a possible system crash due to improper input validation. This could lead to local denial of service with no additional execution privileges needed
CVE-2022-4846 (severity: MEDIUM, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-48460 (severity: MEDIUM, weakness: NVD-CWE-Other)
In setting service, there is a possible undefined behavior due to incorrect error handling. This could lead to local denial of service with no additional execution privileges needed
CVE-2022-48461 (severity: MEDIUM, weakness: CWE-787)
In sensor driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVE-2022-48462 (severity: MEDIUM, weakness: CWE-787)
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVE-2022-48463 (severity: MEDIUM, weakness: CWE-787)
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVE-2022-48464 (severity: MEDIUM, weakness: CWE-787)
In wifi service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges needed
CVE-2022-48468 (severity: MEDIUM, weakness: CWE-190)
protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
CVE-2022-48469 (severity: MEDIUM, weakness: CWE-290)
There is a traffic hijacking vulnerability in Huawei routers. Successful exploitation of this vulnerability can cause packets to be hijacked by attackers.
CVE-2022-4847 (severity: HIGH, weakness: CWE-941)
Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-48470 (severity: MEDIUM, weakness: CWE-305)
Huawei HiLink AI Life product has an identity authentication bypass vulnerability. Successful exploitation of this vulnerability may allow attackers to access restricted functions.(Vulnerability ID:HWPSIRT-2022-42291) This vulnerability has been assigned a (CVE)ID:CVE-2022-48470
CVE-2022-48471 (severity: HIGH, weakness: CWE-436)
There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
CVE-2022-48472 (severity: CRITICAL, weakness: CWE-78)
A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution. Affected product versions include:BiSheng-WNM versions OTA-BiSheng-FW-2.0.0.211-beta,BiSheng-WNM FW 3.0.0.325,BiSheng-WNM FW 2.0.0.211.
CVE-2022-48473 (severity: HIGH, weakness: CWE-436)
There is a misinterpretation of input vulnerability in Huawei Printer. Successful exploitation of this vulnerability may cause the printer service to be abnormal.
CVE-2022-48474 (severity: HIGH, weakness: CWE-400)
Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. Sending a malicious request could cause the server to check if an unrecognized component is up to date, causing a memory failure error that shuts down the process.
CVE-2022-48475 (severity: HIGH, weakness: CWE-400)
Buffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function. Sending a modified request by the attacker could cause a Buffer Overflow when the adminitrator tries to accept or delete the print query created by the request.
CVE-2022-48476 (severity: HIGH, weakness: CWE-35)
In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible
CVE-2022-48477 (severity: CRITICAL, weakness: CWE-918)
In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing
CVE-2022-48478 (severity: CRITICAL, weakness: NVD-CWE-Other)
The facial recognition TA of some products lacks memory length verification. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.
CVE-2022-48479 (severity: CRITICAL, weakness: CWE-125)
The facial recognition TA of some products has the out-of-bounds memory read vulnerability. Successful exploitation of this vulnerability may cause exceptions of the facial recognition service.
CVE-2022-4848 (severity: HIGH, weakness: CWE-940)
Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-48480 (severity: HIGH, weakness: CWE-190)
Integer overflow vulnerability in some phones. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2022-48481 (severity: HIGH, weakness: CWE-691)
In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possible
CVE-2022-48482 (severity: HIGH, weakness: CWE-22)
3CX before 18 Update 2 Security Hotfix build 18.0.2.315 on Windows allows unauthenticated remote attackers to read certain files via /Electron/download directory traversal. Files may have credentials, full backups, call recordings, and chat logs.
CVE-2022-48483 (severity: HIGH, weakness: CWE-22)
3CX before 18 Hotfix 1 build 18.0.3.461 on Windows allows unauthenticated remote attackers to read %WINDIR%\system32 files via /Electron/download directory traversal in conjunction with a path component that has a drive letter and uses backslash characters. NOTE: this issue exists because of an incomplete fix for CVE-2022-28005.
CVE-2022-48486 (severity: HIGH, weakness: CWE-787)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-48487 (severity: HIGH, weakness: NVD-CWE-Other)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-48488 (severity: MEDIUM, weakness: CWE-863)
Vulnerability of bypassing the default desktop security controls.Successful exploitation of this vulnerability may cause unauthorized modifications to the desktop.
CVE-2022-48489 (severity: HIGH, weakness: CWE-404)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-4849 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.