stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-48490 (severity: HIGH, weakness: CWE-120)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-48491 (severity: MEDIUM, weakness: CWE-862)
Vulnerability of missing authentication on certain HUAWEI phones.Successful exploitation of this vulnerability can lead to ads and other windows to display at any time.
CVE-2022-48492 (severity: HIGH, weakness: CWE-1188)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-48493 (severity: HIGH, weakness: CWE-1188)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-48494 (severity: HIGH, weakness: CWE-287)
Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.
CVE-2022-48495 (severity: MEDIUM, weakness: CWE-863)
Vulnerability of unauthorized access to foreground app information.Successful exploitation of this vulnerability may cause foreground app information to be obtained.
CVE-2022-48496 (severity: HIGH, weakness: CWE-287)
Vulnerability of lax app identity verification in the pre-authorization function.Successful exploitation of this vulnerability will cause malicious apps to become pre-authorized.
CVE-2022-48497 (severity: HIGH, weakness: CWE-120)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-48498 (severity: HIGH, weakness: CWE-770)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-48499 (severity: HIGH, weakness: CWE-404)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-4850 (severity: MEDIUM, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-48500 (severity: HIGH, weakness: CWE-404)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-48501 (severity: HIGH, weakness: CWE-120)
Configuration defects in the secure OS module.Successful exploitation of this vulnerability will affect availability.
CVE-2022-48502 (severity: HIGH, weakness: CWE-125)
An issue was discovered in the Linux kernel before 6.2. The ntfs3 subsystem does not properly check for correctness during disk reads, leading to an out-of-bounds read in ntfs_set_ea in fs/ntfs3/xattr.c.
CVE-2022-48503 (severity: HIGH, weakness: NVD-CWE-Other)
The issue was addressed with improved bounds checks. This issue is fixed in tvOS 15.6, watchOS 8.7, iOS 15.6 and iPadOS 15.6, macOS Monterey 12.5, Safari 15.6. Processing web content may lead to arbitrary code execution.
CVE-2022-48504 (severity: MEDIUM, weakness: NVD-CWE-Other)
The issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.
CVE-2022-48505 (severity: MEDIUM, weakness: CWE-639)
This issue was addressed with improved data protection. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system
CVE-2022-48506 (severity: LOW, weakness: CWE-338)
A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios. This issue was observed for use of the following versions of Democracy Suite: 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15. NOTE: the Democracy Suite 5.17 EAC Certificate of Conformance mentions "Improved pseudo random number algorithm," which may be relevant.
CVE-2022-48507 (severity: HIGH, weakness: CWE-294)
Vulnerability of identity verification being bypassed in the storage module. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2022-48508 (severity: HIGH, weakness: CWE-264)
Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity.
CVE-2022-48509 (severity: MEDIUM, weakness: CWE-476)
Race condition vulnerability due to multi-thread access to mutually exclusive resources in Huawei Share. Successful exploitation of this vulnerability may cause the program to exit abnormally.
CVE-2022-4851 (severity: CRITICAL, weakness: CWE-229)
Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-48510 (severity: CRITICAL, weakness: CWE-200)
Input verification vulnerability in the AMS module. Successful exploitation of this vulnerability will cause unauthorized operations.
CVE-2022-48511 (severity: CRITICAL, weakness: CWE-843)
Use After Free (UAF) vulnerability in the audio PCM driver module under special conditions. Successful exploitation of this vulnerability may cause audio features to perform abnormally.
CVE-2022-48512 (severity: CRITICAL, weakness: CWE-122)
Use After Free (UAF) vulnerability in the Vdecoderservice service. Successful exploitation of this vulnerability may cause the image decoding feature to perform abnormally.
CVE-2022-48513 (severity: CRITICAL, weakness: CWE-290)
Vulnerability of identity verification being bypassed in the Gallery module. Successful exploitation of this vulnerability may cause out-of-bounds access.
CVE-2022-48514 (severity: HIGH, weakness: CWE-200)
The Sepolicy module has inappropriate permission control on the use of Netlink.Successful exploitation of this vulnerability may affect confidentiality.
CVE-2022-48515 (severity: HIGH, weakness: CWE-269)
Vulnerability of inappropriate permission control in Nearby. Successful exploitation of this vulnerability may affect service confidentiality.
CVE-2022-48516 (severity: HIGH, weakness: CWE-200)
Vulnerability that a unique value can be obtained by a third-party app in the DSoftBus module. Successful exploitation of this vulnerability will affect confidentiality.
CVE-2022-48517 (severity: HIGH, weakness: CWE-701)
Unauthorized service access vulnerability in the DSoftBus module. Successful exploitation of this vulnerability will affect availability.
CVE-2022-48518 (severity: MEDIUM, weakness: CWE-701)
Vulnerability of signature verification in the iaware system being initialized later than the time when the system broadcasts are sent. Successful exploitation of this vulnerability may cause malicious apps to start upon power-on by spoofing the package names of apps in the startup trustlist, which affects system performance.
CVE-2022-48519 (severity: HIGH, weakness: CWE-200)
Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.
CVE-2022-48520 (severity: HIGH, weakness: CWE-200)
Unauthorized access vulnerability in the SystemUI module. Successful exploitation of this vulnerability may affect confidentiality.
CVE-2022-48521 (severity: MEDIUM, weakness: NVD-CWE-Other)
An issue was discovered in OpenDKIM through 2.10.3, and 2.11.x through 2.11.0-Beta2. It fails to keep track of ordinal numbers when removing fake Authentication-Results header fields, which allows a remote attacker to craft an e-mail message with a fake sender address such that programs that rely on Authentication-Results from OpenDKIM will treat the message as having a valid DKIM signature when in fact it has none.
CVE-2022-48522 (severity: CRITICAL, weakness: CWE-787)
In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation.
CVE-2022-48538 (severity: MEDIUM, weakness: CWE-863)
In Cacti 1.2.19, there is an authentication bypass in the web login functionality because of improper validation in the PHP code: cacti_ldap_auth() allows a zero as the password.
CVE-2022-48541 (severity: HIGH, weakness: CWE-401)
A memory leak in ImageMagick 7.0.10-45 and 6.9.11-22 allows remote attackers to perform a denial of service via the "identify -help" command.
CVE-2022-48545 (severity: MEDIUM, weakness: CWE-674)
An infinite recursion in Catalog::findDestInTree can cause denial of service for xpdf 4.02.
CVE-2022-48547 (severity: MEDIUM, weakness: CWE-79)
A reflected cross-site scripting (XSS) vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at auth_changepassword.php.
CVE-2022-4855 (severity: CRITICAL, weakness: CWE-89)
A vulnerability, which was classified as critical, was found in SourceCodester Lead Management System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-217020.
CVE-2022-48554 (severity: MEDIUM, weakness: CWE-125)
File before 5.43 has an stack-based buffer over-read in file_copystr in funcs.c. NOTE: "File" is the name of an Open Source project.
CVE-2022-4856 (severity: HIGH, weakness: CWE-120)
A vulnerability has been found in Modbus Tools Modbus Slave up to 7.5.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file mbslave.exe of the component mbs File Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217021 was assigned to this vulnerability.
CVE-2022-48560 (severity: HIGH, weakness: CWE-416)
A use-after-free exists in Python through 3.9 via heappushpop in heapq.
CVE-2022-48564 (severity: MEDIUM, weakness: CWE-400)
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
CVE-2022-48565 (severity: CRITICAL, weakness: CWE-611)
An XML External Entity (XXE) issue was discovered in Python through 3.9.1. The plistlib module no longer accepts entity declarations in XML plist files to avoid XML vulnerabilities.
CVE-2022-48566 (severity: MEDIUM, weakness: CWE-362)
An issue was discovered in compare_digest in Lib/hmac.py in Python through 3.9.1. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest.
CVE-2022-4857 (severity: HIGH, weakness: CWE-120)
A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical. Affected by this issue is some unknown functionality of the file mbpoll.exe of the component mbp File Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-217022 is the identifier assigned to this vulnerability.
CVE-2022-48570 (severity: HIGH, weakness: CWE-787)
Crypto++ through 8.4 contains a timing side channel in ECDSA signature generation. Function FixedSizeAllocatorWithCleanup could write to memory outside of the allocation if the allocated memory was not 16-byte aligned. NOTE: this issue exists because the CVE-2019-14318 fix was intentionally removed for functionality reasons.
CVE-2022-48571 (severity: HIGH, weakness: CWE-400)
memcached 1.6.7 allows a Denial of Service via multi-packet uploads in UDP.
CVE-2022-48577 (severity: MEDIUM, weakness: NVD-CWE-Other)
An access issue was addressed with improved access restrictions. This issue is fixed in macOS Ventura 13. An app may be able to access user-sensitive data.
CVE-2022-48578 (severity: HIGH, weakness: CWE-125)
An out-of-bounds read was addressed with improved bounds checking. This issue is fixed in macOS Monterey 12.5. Processing an AppleScript may result in unexpected termination or disclosure of process memory.
CVE-2022-48579 (severity: HIGH, weakness: CWE-59)
UnRAR before 6.2.3 allows extraction of files outside of the destination folder via symlink chains.
CVE-2022-4858 (severity: HIGH, weakness: CWE-532)
Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set.
CVE-2022-48580 (severity: HIGH, weakness: CWE-78)
A command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
CVE-2022-48581 (severity: HIGH, weakness: CWE-78)
A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
CVE-2022-48582 (severity: HIGH, weakness: CWE-78)
A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
CVE-2022-48583 (severity: HIGH, weakness: CWE-78)
A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
CVE-2022-48584 (severity: HIGH, weakness: CWE-78)
A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system.
CVE-2022-48585 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “admin brand portal” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48586 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “json walker” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48587 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “schedule editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48588 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “schedule editor decoupled” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48589 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “reporting job editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-4859 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33. This issue affects the function submitForm of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java of the component User Profile Menu. The manipulation of the argument firstName/lastName leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.34 is able to address this issue. The patch is named 9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217055.
CVE-2022-48590 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48591 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the vendor_state parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48592 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the vendor_country parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48593 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “topology data service” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48594 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48595 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “ticket template watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48596 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “ticket queue watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48597 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “ticket event report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48598 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “reporter events type date” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48599 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-4860 (severity: CRITICAL, weakness: CWE-89)
A vulnerability was found in KBase Metrics. It has been classified as critical. This affects the function upload_user_data of the file source/daily_cron_jobs/methods_upload_user_stats.py. The manipulation leads to sql injection. The patch is named 959dfb6b05991e30b0fa972a1ecdcaae8e1dae6d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217059.
CVE-2022-48600 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48601 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “network print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48602 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48603 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48604 (severity: HIGH, weakness: CWE-78)
A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database.
CVE-2022-48605 (severity: CRITICAL, weakness: CWE-20)
Input verification vulnerability in the fingerprint module. Successful exploitation of this vulnerability will affect confidentiality, integrity, and availability.
CVE-2022-48606 (severity: HIGH, weakness: CWE-476)
Stability-related vulnerability in the binder background management and control module. Successful exploitation of this vulnerability may affect availability.
CVE-2022-4861 (severity: MEDIUM, weakness: CWE-303)
Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource.
CVE-2022-48610 (severity: MEDIUM, weakness: CWE-200)
This issue was addressed through improved state management. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2. An app may be able to access user-sensitive data.
CVE-2022-48611 (severity: HIGH, weakness: CWE-693)
A logic issue was addressed with improved checks. This issue is fixed in iTunes 12.12.4 for Windows. A local attacker may be able to elevate their privileges.
CVE-2022-48612 (severity: MEDIUM, weakness: CWE-79)
A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.7 allows remote attackers to inject JavaScript into any webpage, because a regular expression (validating whether a URL is controlled by ClassLink) is not present in all applicable places.
CVE-2022-48613 (severity: MEDIUM, weakness: CWE-362)
Race condition vulnerability in the kernel module. Successful exploitation of this vulnerability may cause variable values to be read with the condition evaluation bypassed.
CVE-2022-48614 (severity: MEDIUM, weakness: CWE-79)
Special:Ask in Semantic MediaWiki before 4.0.2 allows Reflected XSS.
CVE-2022-48615 (severity: HIGH, weakness: CWE-284)
An improper access control vulnerability exists in a Huawei datacom product. Attackers can exploit this vulnerability to obtain partial device information.
CVE-2022-48616 (severity: HIGH, weakness: CWE-78)
A Huawei data communication product has a command injection vulnerability. Successful exploitation of this vulnerability may allow attackers to gain higher privileges.
CVE-2022-48618 (severity: HIGH, weakness: CWE-367)
The issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.1, watchOS 9.2, iOS 16.2 and iPadOS 16.2, tvOS 16.2. An attacker with arbitrary read and write capability may be able to bypass Pointer Authentication. Apple is aware of a report that this issue may have been exploited against versions of iOS released before iOS 15.7.1.