stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-46456 (severity: HIGH, weakness: CWE-120)
NASM v2.16 was discovered to contain a global buffer overflow in the component dbgdbg_typevalue at /output/outdbg.c.
CVE-2022-46457 (severity: MEDIUM, weakness: CWE-125)
NASM v2.16 was discovered to contain a segmentation violation in the component ieee_write_file at /output/outieee.c.
CVE-2022-4646 (severity: MEDIUM, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.5.4.
CVE-2022-46463 (severity: HIGH, weakness: CWE-306)
An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. NOTE: the vendor's position is that this "is clearly described in the documentation as a feature."
CVE-2022-4647 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.2.
CVE-2022-46471 (severity: CRITICAL, weakness: CWE-89)
Online Health Care System v1.0 was discovered to contain a SQL injection vulnerability via the consulting_id parameter at /healthcare/Admin/consulting_detail.php.
CVE-2022-46472 (severity: HIGH, weakness: CWE-89)
Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=delete.
CVE-2022-46475 (severity: CRITICAL, weakness: CWE-787)
D-Link DIR 645A1 1.06B01_Beta01 was discovered to contain a stack overflow via the service= variable in the genacgi_main function.
CVE-2022-46476 (severity: CRITICAL, weakness: CWE-78)
D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.
CVE-2022-46478 (severity: CRITICAL, weakness: CWE-502)
The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitrary commands via crafted Hessian serialized data.
CVE-2022-4648 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Real Testimonials WordPress plugin before 2.6.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-46480 (severity: HIGH, weakness: CWE-294)
Incorrect Session Management and Credential Re-use in the Bluetooth LE stack of the Ultraloq UL3 2nd Gen Smart Lock Firmware 02.27.0012 allows an attacker to sniff the unlock code and unlock the device whilst within Bluetooth range.
CVE-2022-46484 (severity: HIGH, weakness: CWE-922)
Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers to view the password to access and arbitrarily submit surveys.
CVE-2022-46485 (severity: HIGH, weakness: CWE-770)
Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Field", "Comment Field" or "Contact Details".
CVE-2022-46486 (severity: MEDIUM, weakness: CWE-763)
A lack of pointer-validation logic in the __scone_dispatch component of SCONE before v5.8.0 for Intel SGX allows attackers to access sensitive information.
CVE-2022-46487 (severity: HIGH, weakness: CWE-665)
Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for Intel SGX allows a local attacker to compromise the execution integrity of floating-point operations in an enclave or access sensitive information via side-channel analysis.
CVE-2022-46489 (severity: MEDIUM, weakness: CWE-401)
GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the gf_isom_box_parse_ex function at box_funcs.c.
CVE-2022-4649 (severity: MEDIUM, weakness: NVD-CWE-Other)
The WP Extended Search WordPress plugin before 2.1.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVE-2022-46490 (severity: MEDIUM, weakness: CWE-401)
GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the afrt_box_read function at box_code_adobe.c.
CVE-2022-46491 (severity: MEDIUM, weakness: CWE-352)
A Cross-Site Request Forgery (CSRF) vulnerability in the Add Administrator function of the default version of nbnbk allows attackers to arbitrarily add Administrator accounts.
CVE-2022-46492 (severity: MEDIUM, weakness: CWE-22)
nbnbk commit 879858451d53261d10f77d4709aee2d01c72c301 was discovered to contain an arbitrary file read vulnerability via the component /api/Index/getFileBinary.
CVE-2022-46493 (severity: CRITICAL, weakness: CWE-434)
Default version of nbnbk was discovered to contain an arbitrary file upload vulnerability via the component /api/User/download_img.
CVE-2022-46496 (severity: MEDIUM, weakness: CWE-295)
BTicino Door Entry HOMETOUCH for iOS 1.4.2 was discovered to be missing an SSL certificate.
CVE-2022-46497 (severity: HIGH, weakness: CWE-89)
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_doc_view_single_patien.php.
CVE-2022-46498 (severity: LOW, weakness: CWE-89)
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at his_admin_view_single_employee.php.
CVE-2022-46499 (severity: HIGH, weakness: CWE-89)
Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_admin_view_single_patient.php.
CVE-2022-4650 (severity: MEDIUM, weakness: CWE-79)
The HashBar WordPress plugin before 1.3.6 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVE-2022-46501 (severity: CRITICAL, weakness: CWE-89)
Accruent LLC Maintenance Connection 2021 (all) & 2022.2 was discovered to contain a SQL injection vulnerability via the E-Mail to Work Order function.
CVE-2022-46502 (severity: CRITICAL, weakness: CWE-89)
Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollment/admin/login.php.
CVE-2022-46503 (severity: MEDIUM, weakness: CWE-79)
A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to execute arbitrary web scripts via a crafted payload injected into the name parameter.
CVE-2022-46505 (severity: HIGH, weakness: CWE-665)
An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero MasterSecret that can decrypt secret data.
CVE-2022-4651 (severity: MEDIUM, weakness: CWE-79)
The Justified Gallery WordPress plugin before 1.7.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVE-2022-4652 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Video Background WordPress plugin before 2.7.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2022-46527 (severity: HIGH, weakness: CWE-120)
ELSYS ERS 1.5 Sound v2.3.8 was discovered to contain a buffer overflow via the NFC data parser.
CVE-2022-4653 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Greenshift WordPress plugin before 4.8.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVE-2022-46530 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mac parameter at /goform/GetParentControlInfo.
CVE-2022-46531 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/addWifiMacFilter.
CVE-2022-46532 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceMac parameter at /goform/addWifiMacFilter.
CVE-2022-46533 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeed parameter at /goform/SetClientState.
CVE-2022-46534 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the speed_dir parameter at /goform/SetSpeedWan.
CVE-2022-46535 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/SetClientState.
CVE-2022-46536 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the limitSpeedUp parameter at /goform/SetClientState.
CVE-2022-46537 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security parameter at /goform/WifiBasicSet.
CVE-2022-46538 (severity: CRITICAL, weakness: CWE-78)
Tenda F1203 V2.0.1.6 was discovered to contain a command injection vulnerability via the mac parameter at /goform/WriteFacMac.
CVE-2022-46539 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the security_5g parameter at /goform/WifiBasicSet.
CVE-2022-4654 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Pricing Tables WordPress Plugin WordPress plugin before 3.2.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVE-2022-46540 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/addressNat.
CVE-2022-46541 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the ssid parameter at /goform/fast_setting_wifi_set.
CVE-2022-46542 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/addressNat.
CVE-2022-46543 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the mitInterface parameter at /goform/addressNat.
CVE-2022-46544 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the cmdinput parameter at /goform/exeCommand.
CVE-2022-46545 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting.
CVE-2022-46546 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the entrys parameter at /goform/RouteStatic.
CVE-2022-46547 (severity: CRITICAL, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/VirtualSer.
CVE-2022-46548 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the page parameter at /goform/DhcpListClient.
CVE-2022-46549 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the deviceId parameter at /goform/saveParentControlInfo.
CVE-2022-4655 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Welcart e-Commerce WordPress plugin before 2.8.9 does not validate and escapes one of its shortcode attributes, which could allow users with a role as low as a contributor to perform a Stored Cross-Site Scripting attack.
CVE-2022-46550 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the urls parameter at /goform/saveParentControlInfo.
CVE-2022-46551 (severity: HIGH, weakness: CWE-120)
Tenda F1203 V2.0.1.6 was discovered to contain a buffer overflow via the time parameter at /goform/saveParentControlInfo.
CVE-2022-46552 (severity: HIGH, weakness: CWE-78)
D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. This vulnerability is exploited via a crafted POST request.
CVE-2022-4656 (severity: MEDIUM, weakness: CWE-79)
The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 6.5 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVE-2022-46560 (severity: HIGH, weakness: CWE-787)
D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetWan2Settings module.
CVE-2022-46561 (severity: HIGH, weakness: CWE-787)
D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetWanSettings module.
CVE-2022-46562 (severity: HIGH, weakness: CWE-787)
D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the PSK parameter in the SetQuickVPNSettings module.
CVE-2022-46563 (severity: HIGH, weakness: CWE-787)
D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetDynamicDNSSettings module.
CVE-2022-46566 (severity: HIGH, weakness: CWE-787)
D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetQuickVPNSettings module.
CVE-2022-46568 (severity: HIGH, weakness: CWE-787)
D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the AccountPassword parameter in the SetSysEmailSettings module.
CVE-2022-46569 (severity: HIGH, weakness: CWE-787)
D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Key parameter in the SetWLanRadioSecurity module.
CVE-2022-4657 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2022-46570 (severity: HIGH, weakness: CWE-787)
D-Link DIR-882 DIR882A1_FW130B06, DIR-878 DIR_878_FW1.30B08 was discovered to contain a stack overflow via the Password parameter in the SetWan3Settings module.
CVE-2022-4658 (severity: MEDIUM, weakness: NVD-CWE-Other)
The RSSImport WordPress plugin through 4.6.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
CVE-2022-46580 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the user_edit_page parameter in the wifi_captive_portal function.
CVE-2022-46581 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.nslookup_target parameter in the tools_nslookup function.
CVE-2022-46582 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the login_name parameter in the do_graph_auth (sub_4061E0) function.
CVE-2022-46583 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reboot_type parameter in the wizard_ipv6 (sub_41C380) function.
CVE-2022-46584 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the qcawifi.wifi%d_vap%d.maclist parameter in the kick_ban_wifi_mac_deny (sub_415D7C) function.
CVE-2022-46585 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the REMOTE_USER parameter in the get_access (sub_45AC2C) function.
CVE-2022-46586 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the qcawifi.wifi%d_vap%d.maclist parameter in the kick_ban_wifi_mac_allow (sub_415B00) function.
CVE-2022-46588 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) function.
CVE-2022-46589 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstat_option parameter in the tools_netstat (sub_41E730) function.
CVE-2022-46590 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the cameo.cameo.netstat_rsname parameter in the tools_netstat (sub_41E730) function.
CVE-2022-46591 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the reject_url parameter in the reject (sub_41BD60) function.
CVE-2022-46592 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the set_sta_enrollee_pin_5g function.
CVE-2022-46593 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the do_sta_enrollee_wifi function.
CVE-2022-46594 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the update_file_name parameter in the auto_up_fw (sub_420A04) function.
CVE-2022-46596 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the del_num parameter in the icp_delete_img (sub_41DEDC) function.
CVE-2022-46597 (severity: CRITICAL, weakness: CWE-78)
TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the sys_service parameter in the setup_wizard_mydlink (sub_4104B8) function.
CVE-2022-46598 (severity: CRITICAL, weakness: CWE-78)
TRENDnet TEW755AP 1.13B01 was discovered to contain a command injection vulnerability via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin_5g function.
CVE-2022-46599 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setlogo_num parameter in the icp_setlogo_img (sub_41DBF4) function.
CVE-2022-46600 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the wps_sta_enrollee_pin parameter in the action set_sta_enrollee_pin_24g function.
CVE-2022-46601 (severity: CRITICAL, weakness: CWE-787)
TRENDnet TEW755AP 1.13B01 was discovered to contain a stack overflow via the setbg_num parameter in the icp_setbg_img (sub_41DD68) function.
CVE-2022-46603 (severity: MEDIUM, weakness: CWE-79)
An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file.
CVE-2022-46604 (severity: HIGH, weakness: CWE-434)
An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.
CVE-2022-46609 (severity: CRITICAL, weakness: NVD-CWE-Other)
Python3-RESTfulAPI commit d9907f14e9e25dcdb54f5b22252b0e9452e3970e and e772e0beee284c50946e94c54a1d43071ca78b74 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
CVE-2022-4661 (severity: MEDIUM, weakness: CWE-79)
The Widgets for WooCommerce Products on Elementor WordPress plugin before 1.0.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2022-46610 (severity: HIGH, weakness: CWE-434)
72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
CVE-2022-4662 (severity: MEDIUM, weakness: CWE-455)
A flaw incorrect access control in the Linux kernel USB core subsystem was found in the way user attaches usb device. A local user could use this flaw to crash the system.
CVE-2022-46622 (severity: MEDIUM, weakness: CWE-79)
A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the firstname parameter.
CVE-2022-46623 (severity: HIGH, weakness: CWE-89)
Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.
CVE-2022-46624 (severity: MEDIUM, weakness: CWE-79)
A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
CVE-2022-4663 (severity: MEDIUM, weakness: CWE-79)
The Members Import plugin for WordPress is vulnerable to Self Cross-Site Scripting via the user_login parameter in an imported CSV file in versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a site's administrator into uploading a CSV file with the malicious payload.
CVE-2022-46631 (severity: CRITICAL, weakness: CWE-78)
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiSignalCfg function.
CVE-2022-46634 (severity: CRITICAL, weakness: CWE-78)
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiWpsCfg function.
CVE-2022-46637 (severity: CRITICAL, weakness: CWE-798)
Prolink router PRS1841 was discovered to contain hardcoded credentials for its Telnet and FTP services.
CVE-2022-46639 (severity: HIGH, weakness: CWE-22)
A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.
CVE-2022-4664 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Logo Slider WordPress plugin before 3.6.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2022-46640 (severity: CRITICAL, weakness: CWE-77)
Nanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP request.
CVE-2022-46641 (severity: CRITICAL, weakness: CWE-77)
D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the lan(0)_dhcps_staticlist parameter in the SetIpMacBindSettings function.
CVE-2022-46642 (severity: CRITICAL, weakness: CWE-77)
D-Link DIR-846 A1_FW100A43 was discovered to contain a command injection vulnerability via the auto_upgrade_hour parameter in the SetAutoUpgradeInfo function.
CVE-2022-46645 (severity: MEDIUM, weakness: CWE-400)
Uncontrolled resource consumption in the Intel(R) Smart Campus Android application before version 9.9 may allow an authenticated user to potentially enable denial of service via local access.
CVE-2022-46646 (severity: MEDIUM, weakness: CWE-200)
Exposure of sensitive information to an unauthorized actor for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local access.