stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-31510 (severity: CRITICAL, weakness: CWE-22)
The sergeKashkin/Simple-RAT repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31511 (severity: CRITICAL, weakness: CWE-22)
The AFDudley/equanimity repository through 2014-04-23 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31512 (severity: CRITICAL, weakness: CWE-22)
The Atom02/flask-mvc repository through 2020-09-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31513 (severity: CRITICAL, weakness: CWE-22)
The BolunHan/Krypton repository through 2021-06-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31514 (severity: CRITICAL, weakness: CWE-22)
The Caoyongqi912/Fan_Platform repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31515 (severity: CRITICAL, weakness: CWE-22)
The Delor4/CarceresBE repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31516 (severity: CRITICAL, weakness: CWE-22)
The Harveyzyh/Python repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31517 (severity: CRITICAL, weakness: CWE-22)
The HolgerGraef/MSM repository through 2021-04-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31518 (severity: CRITICAL, weakness: CWE-22)
The JustAnotherSoftwareDeveloper/Python-Recipe-Database repository through 2021-03-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31519 (severity: CRITICAL, weakness: CWE-22)
The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-3152 (severity: CRITICAL, weakness: CWE-620)
Unverified Password Change in GitHub repository phpfusion/phpfusion prior to 9.10.20.
CVE-2022-31520 (severity: CRITICAL, weakness: CWE-22)
The Luxas98/logstash-management-api repository through 2020-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31521 (severity: CRITICAL, weakness: CWE-22)
The Niyaz-Mohamed/mosaic repository through 1.0.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31522 (severity: CRITICAL, weakness: CWE-22)
The NotVinay/karaokey repository through 2019-12-11 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31523 (severity: CRITICAL, weakness: CWE-22)
The PaddlePaddle/Anakin repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31524 (severity: CRITICAL, weakness: CWE-22)
The PureStorage-OpenConnect/swagger repository through 1.1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31525 (severity: CRITICAL, weakness: CWE-22)
The SummaLabs/DLS repository through 0.1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31526 (severity: CRITICAL, weakness: CWE-22)
The ThundeRatz/ThunderDocs repository through 2020-05-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31527 (severity: CRITICAL, weakness: CWE-22)
The Wildog/flask-file-server repository through 2020-02-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31528 (severity: CRITICAL, weakness: CWE-22)
The bonn-activity-maps/bam_annotation_tool repository through 2021-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31529 (severity: CRITICAL, weakness: CWE-22)
The cinemaproject/monorepo repository through 2021-03-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-3153 (severity: MEDIUM, weakness: CWE-476)
NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
CVE-2022-31530 (severity: CRITICAL, weakness: CWE-22)
The csm-aut/csm repository through 3.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31531 (severity: CRITICAL, weakness: CWE-22)
The dainst/cilantro repository through 0.0.4 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31532 (severity: CRITICAL, weakness: CWE-22)
The dankolbman/travel_blahg repository through 2016-01-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31533 (severity: CRITICAL, weakness: CWE-22)
The decentraminds/umbral repository through 2020-01-15 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31534 (severity: CRITICAL, weakness: CWE-22)
The echoleegroup/PythonWeb repository through 2018-10-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31535 (severity: CRITICAL, weakness: CWE-22)
The freefood89/Fishtank repository through 2015-06-24 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31536 (severity: CRITICAL, weakness: CWE-22)
The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31537 (severity: CRITICAL, weakness: CWE-22)
The jmcginty15/Solar-system-simulator repository through 2021-07-26 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31538 (severity: CRITICAL, weakness: CWE-22)
The joaopedro-fg/mp-m08-interface repository through 2020-12-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31539 (severity: CRITICAL, weakness: CWE-22)
The kotekan/kotekan repository through 2021.11 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-3154 (severity: HIGH, weakness: CWE-352)
The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license
CVE-2022-31540 (severity: CRITICAL, weakness: CWE-22)
The kumardeepak/hin-eng-preprocessing repository through 2019-07-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31541 (severity: CRITICAL, weakness: CWE-22)
The lyubolp/Barry-Voice-Assistant repository through 2021-01-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31542 (severity: CRITICAL, weakness: CWE-22)
The mandoku/mdweb repository through 2015-05-07 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31543 (severity: CRITICAL, weakness: CWE-22)
The maxtortime/SetupBox repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31544 (severity: CRITICAL, weakness: CWE-22)
The meerstein/rbtm repository through 1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31545 (severity: CRITICAL, weakness: CWE-22)
The ml-inory/ModelConverter repository through 2021-04-26 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31546 (severity: CRITICAL, weakness: CWE-22)
The nlpweb/glance repository through 2014-06-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31547 (severity: CRITICAL, weakness: CWE-22)
The noamezekiel/sphere repository through 2020-05-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31548 (severity: CRITICAL, weakness: CWE-22)
The nrlakin/homepage repository through 2017-03-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31549 (severity: CRITICAL, weakness: CWE-22)
The olmax99/helm-flask-celery repository before 2022-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-3155 (severity: HIGH, weakness: CWE-276)
When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file. If the received file was an application and the user attempted to open it, then the application was started immediately without asking the user to confirm. This vulnerability affects Thunderbird < 102.3.
CVE-2022-31550 (severity: CRITICAL, weakness: CWE-22)
The olmax99/pyathenastack repository through 2019-11-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31551 (severity: CRITICAL, weakness: CWE-22)
The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31552 (severity: CRITICAL, weakness: CWE-22)
The project-anuvaad/anuvaad-corpus repository through 2020-11-23 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31553 (severity: CRITICAL, weakness: CWE-22)
The rainsoupah/sleep-learner repository through 2021-02-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31554 (severity: CRITICAL, weakness: CWE-22)
The rohitnayak/movie-review-sentiment-analysis repository through 2017-05-07 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31555 (severity: CRITICAL, weakness: CWE-22)
The romain20100/nursequest repository through 2018-02-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31556 (severity: CRITICAL, weakness: CWE-22)
The rusyasoft/TrainEnergyServer repository through 2017-08-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31557 (severity: CRITICAL, weakness: CWE-22)
The seveas/golem repository through 2016-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31558 (severity: CRITICAL, weakness: CWE-22)
The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31559 (severity: CRITICAL, weakness: CWE-22)
The tsileo/flask-yeoman repository through 2013-09-13 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-3156 (severity: HIGH, weakness: CWE-287)
A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software. Users are granted elevated permissions on certain product services when the software is installed. Due to this misconfiguration, a malicious user could potentially achieve remote code execution on the targeted software.
CVE-2022-31560 (severity: CRITICAL, weakness: CWE-22)
The uncleYiba/photo_tag repository through 2020-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31561 (severity: CRITICAL, weakness: CWE-22)
The varijkapil13/Sphere_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31562 (severity: CRITICAL, weakness: CWE-22)
The waveyan/internshipsystem repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31563 (severity: CRITICAL, weakness: CWE-22)
The whmacmac/vprj repository through 2022-04-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31564 (severity: CRITICAL, weakness: CWE-22)
The woduq1414/munhak-moa repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31565 (severity: CRITICAL, weakness: CWE-22)
The yogson/syrabond repository through 2020-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31566 (severity: HIGH, weakness: CWE-22)
The DSAB-local/DSAB repository through 2019-02-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31567 (severity: CRITICAL, weakness: CWE-22)
The DSABenchmark/DSAB repository through 2.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31568 (severity: CRITICAL, weakness: CWE-22)
The Rexians/rex-web repository through 2022-06-05 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-3157 (severity: HIGH, weakness: CWE-20)
A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-of-service condition (DOS).
CVE-2022-31570 (severity: CRITICAL, weakness: CWE-22)
The adriankoczuruek/ceneo-web-scrapper repository through 2021-03-15 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31571 (severity: CRITICAL, weakness: CWE-22)
The akashtalole/python-flask-restful-api repository through 2019-09-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31572 (severity: CRITICAL, weakness: CWE-22)
The ceee-vip/cockybook repository through 2015-04-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31573 (severity: CRITICAL, weakness: CWE-22)
The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31574 (severity: CRITICAL, weakness: CWE-22)
The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31575 (severity: CRITICAL, weakness: CWE-22)
The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31576 (severity: CRITICAL, weakness: CWE-22)
The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31577 (severity: CRITICAL, weakness: CWE-22)
The longmaoteamtf/audio_aligner_app repository through 2020-01-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31578 (severity: HIGH, weakness: CWE-22)
The piaoyunsoft/bt_lnmp repository through 2019-10-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31579 (severity: CRITICAL, weakness: CWE-22)
The ralphjzhang/iasset repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-3158 (severity: HIGH, weakness: CWE-89)
Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantagePoint SQL Server lacks input validation when users enter SQL statements to retrieve information from the back-end database. If successfully exploited, this could allow a user with basic user privileges to perform remote code execution on the server.
CVE-2022-31580 (severity: CRITICAL, weakness: CWE-22)
The sanojtharindu/caretakerr-api repository through 2021-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31581 (severity: CRITICAL, weakness: CWE-22)
The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31582 (severity: CRITICAL, weakness: CWE-22)
The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31583 (severity: CRITICAL, weakness: CWE-22)
The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31584 (severity: CRITICAL, weakness: CWE-22)
The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31585 (severity: CRITICAL, weakness: CWE-22)
The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31586 (severity: CRITICAL, weakness: CWE-22)
The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31587 (severity: CRITICAL, weakness: CWE-22)
The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31588 (severity: CRITICAL, weakness: CWE-22)
The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
CVE-2022-31589 (severity: MEDIUM, weakness: CWE-863)
Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.
CVE-2022-3159 (severity: HIGH, weakness: CWE-121)
The APDFL.dll contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
CVE-2022-31590 (severity: HIGH, weakness: CWE-428)
SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access restrictions to Write/Create a program file on system disk root path, which could then be executed with elevated privileges of the application during application start up or reboot, potentially compromising Confidentiality, Integrity and Availability of the system.
CVE-2022-31591 (severity: HIGH, weakness: CWE-428)
SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service
CVE-2022-31592 (severity: MEDIUM, weakness: CWE-862)
The application SAP Enterprise Extension Defense Forces & Public Security - versions 605, 606, 616,617,618, 802, 803, 804, 805, 806, does not perform necessary authorization checks for an authenticated user over the network, resulting in escalation of privileges leading to a limited impact on confidentiality.
CVE-2022-31593 (severity: HIGH, weakness: CWE-74)
SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
CVE-2022-31594 (severity: MEDIUM, weakness: CWE-269)
A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system.
CVE-2022-31595 (severity: HIGH, weakness: CWE-862)
SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
CVE-2022-31596 (severity: MEDIUM, weakness: CWE-668)
Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business Intelligence Platform (Monitoring DB) - version 430, can access BOE Monitoring database to retrieve and modify (non-personal) system data which would otherwise be restricted. Also, a potential attack could be used to leave the CMS's scope and impact the database. A successful attack could have a low impact on confidentiality, a high impact on integrity, and a low impact on availability.
CVE-2022-31597 (severity: MEDIUM, weakness: CWE-862)
Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to low impact on confidentiality and integrity of the data.
CVE-2022-31598 (severity: MEDIUM, weakness: CWE-345)
Due to insufficient input validation, SAP Business Objects - version 420, allows an authenticated attacker to submit a malicious request through an allowed operation. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
CVE-2022-31599 (severity: HIGH, weakness: CWE-824)
NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitialized pointer, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
CVE-2022-3160 (severity: HIGH, weakness: CWE-122)
The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
CVE-2022-31600 (severity: HIGH, weakness: CWE-190)
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causing an integer overflow, possibly leading to code execution, escalation of privileges, denial of service, compromised integrity, and information disclosure. The scope of impact can extend to other components.
CVE-2022-31601 (severity: MEDIUM, weakness: CWE-787)
NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmbiosPei, which may allow a highly privileged local attacker to cause an out-of-bounds write, which may lead to code execution, denial of service, compromised integrity, and information disclosure.
CVE-2022-31602 (severity: MEDIUM, weakness: CWE-787)
NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with elevated privileges and a preconditioned heap can exploit an out-of-bounds write vulnerability, which may lead to code execution, denial of service, data integrity impact, and information disclosure.
CVE-2022-31603 (severity: MEDIUM, weakness: CWE-129)
NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with high privileges and preconditioned IpSecDxe global data can exploit improper validation of an array index to cause code execution, which may lead to denial of service, data integrity impact, and information disclosure.
CVE-2022-31604 (severity: CRITICAL, weakness: CWE-502)
NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.