stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-24481 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2022-24482 (severity: HIGH, weakness: CWE-362)
Windows ALPC Elevation of Privilege Vulnerability
CVE-2022-24483 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Kernel Information Disclosure Vulnerability
CVE-2022-24484 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability
CVE-2022-24485 (severity: HIGH, weakness: NVD-CWE-Other)
Win32 File Enumeration Remote Code Execution Vulnerability
CVE-2022-24486 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-24487 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
CVE-2022-24488 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Desktop Bridge Elevation of Privilege Vulnerability
CVE-2022-24489 (severity: HIGH, weakness: NVD-CWE-Other)
Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
CVE-2022-2449 (severity: MEDIUM, weakness: CWE-352)
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.
CVE-2022-24490 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
CVE-2022-24491 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Network File System Remote Code Execution Vulnerability
CVE-2022-24492 (severity: HIGH, weakness: NVD-CWE-Other)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2022-24493 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
CVE-2022-24494 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2022-24495 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Direct Show Remote Code Execution Vulnerability
CVE-2022-24496 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
CVE-2022-24497 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Network File System Remote Code Execution Vulnerability
CVE-2022-24498 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows iSCSI Target Service Information Disclosure Vulnerability
CVE-2022-24499 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Installer Elevation of Privilege Vulnerability
CVE-2022-2450 (severity: MEDIUM, weakness: CWE-862)
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.
CVE-2022-24500 (severity: HIGH, weakness: NVD-CWE-Other)
Windows SMB Remote Code Execution Vulnerability
CVE-2022-24501 (severity: HIGH, weakness: NVD-CWE-Other)
VP9 Video Extensions Remote Code Execution Vulnerability
CVE-2022-24502 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows HTML Platforms Security Feature Bypass Vulnerability
CVE-2022-24503 (severity: MEDIUM, weakness: NVD-CWE-Other)
Remote Desktop Protocol Client Information Disclosure Vulnerability
CVE-2022-24504 (severity: HIGH, weakness: CWE-362)
Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
CVE-2022-24505 (severity: HIGH, weakness: CWE-362)
Windows ALPC Elevation of Privilege Vulnerability
CVE-2022-24506 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-24507 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2022-24508 (severity: HIGH, weakness: NVD-CWE-Other)
Win32 File Enumeration Remote Code Execution Vulnerability
CVE-2022-24509 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2022-24510 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Visio Remote Code Execution Vulnerability
CVE-2022-24511 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Office Word Tampering Vulnerability
CVE-2022-24512 (severity: MEDIUM, weakness: NVD-CWE-Other)
.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2022-24513 (severity: HIGH, weakness: NVD-CWE-Other)
Visual Studio Elevation of Privilege Vulnerability
CVE-2022-24515 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-24516 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2022-24517 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Site Recovery Remote Code Execution Vulnerability
CVE-2022-24518 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-24519 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Elevation of Privilege Vulnerability
CVE-2022-24520 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Site Recovery Remote Code Execution Vulnerability
CVE-2022-24521 (severity: HIGH, weakness: CWE-787)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2022-24522 (severity: MEDIUM, weakness: NVD-CWE-Other)
Skype Extension for Chrome Information Disclosure Vulnerability
CVE-2022-24523 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2022-24525 (severity: HIGH, weakness: CWE-362)
Windows Update Stack Elevation of Privilege Vulnerability
CVE-2022-24526 (severity: MEDIUM, weakness: NVD-CWE-Other)
Visual Studio Code Spoofing Vulnerability
CVE-2022-24527 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Endpoint Configuration Manager Elevation of Privilege Vulnerability
CVE-2022-24528 (severity: HIGH, weakness: NVD-CWE-Other)
Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2022-2453 (severity: HIGH, weakness: CWE-416)
Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV.
CVE-2022-24530 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Installer Elevation of Privilege Vulnerability
CVE-2022-24532 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2022-24533 (severity: HIGH, weakness: NVD-CWE-Other)
Remote Desktop Protocol Remote Code Execution Vulnerability
CVE-2022-24534 (severity: HIGH, weakness: NVD-CWE-Other)
Win32 Stream Enumeration Remote Code Execution Vulnerability
CVE-2022-24536 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DNS Server Remote Code Execution Vulnerability
CVE-2022-24537 (severity: HIGH, weakness: CWE-362)
Windows Hyper-V Remote Code Execution Vulnerability
CVE-2022-24538 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Cluster Shared Volume (CSV) Denial of Service Vulnerability
CVE-2022-24539 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Hyper-V Shared Virtual Hard Disks Information Disclosure Vulnerability
CVE-2022-2454 (severity: HIGH, weakness: CWE-190)
Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV.
CVE-2022-24540 (severity: HIGH, weakness: CWE-362)
Windows ALPC Elevation of Privilege Vulnerability
CVE-2022-24541 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Server Service Remote Code Execution Vulnerability
CVE-2022-24542 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Win32k Elevation of Privilege Vulnerability
CVE-2022-24543 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Upgrade Assistant Remote Code Execution Vulnerability
CVE-2022-24544 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-24545 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kerberos Remote Code Execution Vulnerability
CVE-2022-24546 (severity: HIGH, weakness: NVD-CWE-Other)
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2022-24547 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Digital Media Receiver Elevation of Privilege Vulnerability
CVE-2022-24548 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Defender Denial of Service Vulnerability
CVE-2022-24549 (severity: HIGH, weakness: NVD-CWE-Other)
Windows AppX Package Manager Elevation of Privilege Vulnerability
CVE-2022-2455 (severity: MEDIUM, weakness: CWE-400)
A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allowed an authenticated and authorized user to exhaust server resources by importing a malicious project.
CVE-2022-24550 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Telephony Server Elevation of Privilege Vulnerability
CVE-2022-24551 (severity: HIGH, weakness: CWE-287)
A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old password. An attacker could reset any local user password (including system/administrator user) using any available user This affects StarWind SAN and NAS v0.2 build 1633.
CVE-2022-24552 (severity: CRITICAL, weakness: CWE-78)
A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of them go directly to bash as part of a script. An attacker with non-root user access can inject arbitrary data into the command that will be executed with root privileges. This affects StarWind SAN and NAS v0.2 build 1633.
CVE-2022-24553 (severity: CRITICAL, weakness: CWE-434)
An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command execution.
CVE-2022-2456 (severity: LOW, weakness: NVD-CWE-Other)
An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request.
CVE-2022-24562 (severity: CRITICAL, weakness: CWE-306)
In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.
CVE-2022-24563 (severity: MEDIUM, weakness: CWE-79)
In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_title and intro_image parameters.
CVE-2022-24564 (severity: MEDIUM, weakness: CWE-79)
Checkmk <=2.0.0p19 contains a Cross Site Scripting (XSS) vulnerability. While creating or editing a user attribute, the Help Text is subject to HTML injection, which can be triggered for editing a user.
CVE-2022-24565 (severity: MEDIUM, weakness: CWE-79)
Checkmk <=2.0.0p19 Fixed in 2.0.0p20 and Checkmk <=1.6.0p27 Fixed in 1.6.0p28 are affected by a Cross Site Scripting (XSS) vulnerability. The Alias of a site was not properly escaped when shown as condition for notifications.
CVE-2022-24566 (severity: MEDIUM, weakness: CWE-79)
In Checkmk <=2.0.0p19 fixed in 2.0.0p20 and Checkmk <=1.6.0p27 fixed in 1.6.0p28, the title of a Predefined condition is not properly escaped when shown as condition, which can result in Cross Site Scripting (XSS).
CVE-2022-24568 (severity: CRITICAL, weakness: CWE-918)
Novel-plus v3.6.0 was discovered to be vulnerable to Server-Side Request Forgery (SSRF) via user-supplied crafted input.
CVE-2022-2457 (severity: CRITICAL, weakness: CWE-307)
A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts.
CVE-2022-24571 (severity: CRITICAL, weakness: CWE-89)
Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access.
CVE-2022-24572 (severity: MEDIUM, weakness: CWE-79)
Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit this Vulnerability, an admin views the registered user details.
CVE-2022-24573 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in the admin interface in Element-IT HTTP Commander 7.0.0 allows unauthenticated users to get admin access by injecting a malicious script in the User-Agent field.
CVE-2022-24574 (severity: MEDIUM, weakness: CWE-476)
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_dump_vrml_field.isra ().
CVE-2022-24575 (severity: HIGH, weakness: CWE-787)
GPAC 1.0.1 is affected by a stack-based buffer overflow through MP4Box.
CVE-2022-24576 (severity: MEDIUM, weakness: CWE-416)
GPAC 1.0.1 is affected by Use After Free through MP4Box.
CVE-2022-24577 (severity: HIGH, weakness: CWE-476)
GPAC 1.0.1 is affected by a NULL pointer dereference in gf_utf8_wcslen. (gf_utf8_wcslen is a renamed Unicode utf8_wcslen function.)
CVE-2022-24578 (severity: HIGH, weakness: CWE-787)
GPAC 1.0.1 is affected by a heap-based buffer overflow in SFS_AddString () at bifs/script_dec.c.
CVE-2022-2458 (severity: HIGH, weakness: CWE-91)
XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, XML external entity injection lead to External Service interaction & Internal file read in Business Central and also Kie-Server APIs.
CVE-2022-24581 (severity: HIGH, weakness: CWE-434)
ACEweb Online Portal 3.5.065 allows unauthenticated SMB hash capture via UNC. By specifying the UNC file path of an external SMB share when uploading a file, an attacker can induce the victim server to disclose the username and password hash of the user executing the ACEweb Online software.
CVE-2022-24582 (severity: MEDIUM, weakness: CWE-79)
Accounting Journal Management 1.0 is vulnerable to XSS-PHPSESSID-Hijacking. The parameter manage_user from User lists is vulnerable to XSS-Stored and PHPSESSID attacks. The malicious user can attack the system by using the already session which he has from inside and outside of the network.
CVE-2022-24584 (severity: MEDIUM, weakness: CWE-863)
Incorrect access control in Yubico OTP functionality of the YubiKey hardware tokens along with the Yubico OTP validation server. The Yubico OTP supposedly creates hardware bound second factor credentials. When a user reprograms the OTP functionality by "writing" it on a token using the Yubico Personalization Tool, they can then upload the new configuration to Yubicos OTP validation servers. NOTE: the vendor disputes this because there is no way for a YubiKey device to prevent a user from deciding that a secret value, which is imported into the device, should also be stored elsewhere
CVE-2022-24585 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/comment.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the author parameter.
CVE-2022-24586 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in the component /core/admin/categories.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the content and thumbnail parameters.
CVE-2022-24587 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in the component core/admin/medias.php of PluXml v5.8.7 allows attackers to execute arbitrary web scripts or HTML.
CVE-2022-24588 (severity: MEDIUM, weakness: CWE-79)
Flatpress v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability in the Upload SVG File function.
CVE-2022-24589 (severity: MEDIUM, weakness: CWE-79)
Burden v3.0 was discovered to contain a stored cross-site scripting (XSS) in the Add Category function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the task parameter.
CVE-2022-2459 (severity: LOW, weakness: CWE-862)
An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was enabled.
CVE-2022-24590 (severity: MEDIUM, weakness: CWE-79)
A stored cross-site scripting (XSS) vulnerability in the Add Link function of BackdropCMS v1.21.1 allows attackers to execute arbitrary web scripts or HTML.
CVE-2022-24594 (severity: MEDIUM, weakness: CWE-862)
In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address.
CVE-2022-24595 (severity: CRITICAL, weakness: NVD-CWE-Other)
Automotive Grade Linux Kooky Koi 11.0.0, 11.0.1, 11.0.2, 11.0.3, 11.0.4, and 11.0.5 is affected by Incorrect Access Control in usr/bin/afb-daemon. To exploit the vulnerability, an attacker should send a well-crafted HTTP (or WebSocket) request to the socket listened by the afb-daemon process. No credentials nor user interactions are required.
CVE-2022-24599 (severity: MEDIUM, weakness: CWE-401)
In autofile Audio File Library 0.3.6, there exists one memory leak vulnerability in printfileinfo, in printinfo.c, which allows an attacker to leak sensitive information via a crafted file. The printfileinfo function calls the copyrightstring function to get data, however, it dosn't use zero bytes to truncate the data.
CVE-2022-2460 (severity: CRITICAL, weakness: NVD-CWE-Other)
The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users
CVE-2022-24600 (severity: CRITICAL, weakness: CWE-89)
Luocms v2.0 is affected by SQL Injection through /admin/login.php. An attacker can log in to the background through SQL injection statements.
CVE-2022-24601 (severity: HIGH, weakness: CWE-89)
Luocms v2.0 is affected by SQL Injection in /admin/manager/admin_mod.php. An attacker can obtain sensitive information through SQL injection statements.
CVE-2022-24602 (severity: CRITICAL, weakness: CWE-89)
Luocms v2.0 is affected by SQL Injection in /admin/news/news_mod.php.
CVE-2022-24603 (severity: CRITICAL, weakness: CWE-89)
Luocms v2.0 is affected by SQL Injection in /admin/news/sort_mod.php.
CVE-2022-24604 (severity: CRITICAL, weakness: CWE-89)
Luocms v2.0 is affected by SQL Injection in /admin/link/link_mod.php.
CVE-2022-24605 (severity: CRITICAL, weakness: CWE-89)
Luocms v2.0 is affected by SQL Injection in /admin/link/link_ok.php.
CVE-2022-24606 (severity: CRITICAL, weakness: CWE-89)
Luocms v2.0 is affected by SQL Injection in /admin/news/sort_ok.php.
CVE-2022-24607 (severity: CRITICAL, weakness: CWE-89)
Luocms v2.0 is affected by SQL Injection in /admin/news/news_ok.php.
CVE-2022-24608 (severity: MEDIUM, weakness: CWE-79)
Luocms v2.0 is affected by Cross Site Scripting (XSS) in /admin/news/sort_add.php and /inc/function.php.
CVE-2022-24609 (severity: CRITICAL, weakness: CWE-863)
Luocms v2.0 is affected by an incorrect access control vulnerability. Through /admin/templates/template_manage.php, an attacker can write an arbitrary shell file.
CVE-2022-2461 (severity: MEDIUM, weakness: CWE-862)
The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site.
CVE-2022-24610 (severity: HIGH, weakness: CWE-522)
Settings/network settings/wireless settings on the Alecto DVC-215IP camera version 63.1.1.173 and below shows the Wi-Fi passphrase hidden, but by editing/removing the style of the password field the password becomes visible which grants access to an internal network connected to the camera.
CVE-2022-24611 (severity: MEDIUM, weakness: NVD-CWE-Other)
Denial of Service (DoS) in the Z-Wave S0 NonceGet protocol specification in Silicon Labs Z-Wave 500 series allows local attackers to block S0/S2 protected Z-Wave network via crafted S0 NonceGet Z-Wave packages, utilizing included but absent NodeIDs.
CVE-2022-24612 (severity: MEDIUM, weakness: CWE-79)
An authenticated user can upload an XML file containing an XSS via the ITSM module of EyesOfNetwork 5.3.11, resulting in a stored XSS.
CVE-2022-24613 (severity: MEDIUM, weakness: CWE-755)
metadata-extractor up to 2.16.0 can throw various uncaught exceptions while parsing a specially crafted JPEG file, which could result in an application crash. This could be used to mount a denial of service attack against services that use metadata-extractor library.
CVE-2022-24614 (severity: MEDIUM, weakness: CWE-770)
When reading a specially crafted JPEG file, metadata-extractor up to 2.16.0 can be made to allocate large amounts of memory that finally leads to an out-of-memory error even for very small inputs. This could be used to mount a denial of service attack against services that use metadata-extractor library.
CVE-2022-24615 (severity: MEDIUM, weakness: CWE-755)
zip4j up to v2.10.0 can throw various uncaught exceptions while parsing a specially crafted ZIP file, which could result in an application crash. This could be used to mount a denial of service attack against services that use zip4j library.
CVE-2022-24618 (severity: HIGH, weakness: CWE-281)
Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer.
CVE-2022-2462 (severity: MEDIUM, weakness: CWE-200)
The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text.
CVE-2022-24620 (severity: MEDIUM, weakness: CWE-79)
Piwigo version 12.2.0 is vulnerable to stored cross-site scripting (XSS), which can lead to privilege escalation. In this way, admin can steal webmaster's cookies to get the webmaster's access.
CVE-2022-24627 (severity: CRITICAL, weakness: CWE-89)
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is an unauthenticated SQL injection in the p parameter of the process_login.php login form.
CVE-2022-24628 (severity: HIGH, weakness: CWE-89)
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. It is authenticated SQL injection in the id parameter of IPPhoneFirmwareEdit.php.
CVE-2022-24629 (severity: CRITICAL, weakness: CWE-22)
An issue was discovered in AudioCodes Device Manager Express through 7.8.20002.47752. Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. An attacker can upload a .php file to WebAdmin/admin/AudioCodes_files/ajax/.