stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-47174 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions.
CVE-2022-47175 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions.
CVE-2022-47176 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0.
CVE-2022-47177 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions.
CVE-2022-47178 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in Simple Share Buttons Simple Share Buttons Adder plugin <= 8.4.7 versions.
CVE-2022-47179 (severity: MEDIUM, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <= 5.6.11 leads to post duplication as a draft.
CVE-2022-4718 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-47180 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in Kopa Theme Kopa Framework plugin <= 1.3.5 versions.
CVE-2022-47181 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2.
CVE-2022-47182 (severity: MEDIUM, weakness: CWE-862)
Missing Authorization vulnerability in Wpexpertsio APIExperts Square for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.4.1.
CVE-2022-47183 (severity: HIGH, weakness: CWE-352)
Cross-Site Request Forgery (CSRF) vulnerability in StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin <= 0.2.6 versions.
CVE-2022-47184 (severity: HIGH, weakness: CWE-200)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.
CVE-2022-47185 (severity: HIGH, weakness: CWE-20)
Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
CVE-2022-47186 (severity: CRITICAL, weakness: CWE-434)
There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory.
CVE-2022-47187 (severity: MEDIUM, weakness: CWE-79)
There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file.
CVE-2022-47188 (severity: HIGH, weakness: CWE-20)
There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path.
CVE-2022-47189 (severity: CRITICAL, weakness: CWE-20)
Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device.
CVE-2022-4719 (severity: MEDIUM, weakness: CWE-840)
Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVE-2022-47190 (severity: CRITICAL, weakness: CWE-20)
Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root.
CVE-2022-47191 (severity: HIGH, weakness: CWE-20)
Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges.
CVE-2022-47192 (severity: HIGH, weakness: CWE-20)
Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password.
CVE-2022-47194 (severity: CRITICAL, weakness: CWE-453)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `twitter` field for a user.
CVE-2022-47195 (severity: CRITICAL, weakness: CWE-453)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `facebook` field for a user.
CVE-2022-47196 (severity: CRITICAL, weakness: CWE-453)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_head` for a post.
CVE-2022-47197 (severity: CRITICAL, weakness: CWE-453)
An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_foot` for a post.
CVE-2022-4720 (severity: MEDIUM, weakness: CWE-601)
Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVE-2022-47208 (severity: HIGH, weakness: CWE-78)
The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication.
CVE-2022-47209 (severity: HIGH, weakness: CWE-287)
A support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for this account is “support” and cannot be changed by a user via any normally accessible means.
CVE-2022-4721 (severity: MEDIUM, weakness: CWE-75)
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVE-2022-47210 (severity: HIGH, weakness: CWE-78)
The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device.
CVE-2022-47211 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2022-47212 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2022-47213 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Graphics Remote Code Execution Vulnerability
CVE-2022-4722 (severity: HIGH, weakness: CWE-305)
Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVE-2022-4723 (severity: MEDIUM, weakness: CWE-770)
Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVE-2022-4724 (severity: HIGH, weakness: CWE-284)
Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.
CVE-2022-4725 (severity: CRITICAL, weakness: CWE-918)
A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.
CVE-2022-4726 (severity: CRITICAL, weakness: CWE-707)
A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-216739.
CVE-2022-4727 (severity: MEDIUM, weakness: CWE-707)
A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation of the argument notes leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.17.0 is able to address this issue. The name of the patch is 2ccbe39c020809765de41eeb8ee4c70b5ec49cc8. It is recommended to upgrade the affected component. The identifier VDB-216741 was assigned to this vulnerability.
CVE-2022-4728 (severity: MEDIUM, weakness: CWE-707)
A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. VDB-216742 is the identifier assigned to this vulnerability.
CVE-2022-4729 (severity: MEDIUM, weakness: CWE-707)
A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216743.
CVE-2022-4730 (severity: MEDIUM, weakness: CWE-707)
A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216744.
CVE-2022-4731 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x. Affected is an unknown function of the component Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 29.1.0 is able to address this issue. The name of the patch is 99934258530d761bd5d09809bfa6c14b598f8d18. It is recommended to upgrade the affected component. VDB-216750 is the identifier assigned to this vulnerability.
CVE-2022-47311 (severity: HIGH, weakness: NVD-CWE-Other)
A proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the username and password; it also contains the configuration data for the user specified. If the user does not exist, then it sends a value for username and password, which allows successful authentication for a connection.
CVE-2022-47317 (severity: HIGH, weakness: CWE-787)
Out-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.
CVE-2022-47318 (severity: HIGH, weakness: CWE-94)
ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.
CVE-2022-4732 (severity: MEDIUM, weakness: CWE-434)
Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
CVE-2022-47320 (severity: HIGH, weakness: NVD-CWE-Other)
The iBoot device’s basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.
CVE-2022-47322 (severity: MEDIUM, weakness: CWE-190)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
CVE-2022-47323 (severity: MEDIUM, weakness: CWE-125)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
CVE-2022-47324 (severity: MEDIUM, weakness: CWE-862)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
CVE-2022-47325 (severity: MEDIUM, weakness: CWE-862)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
CVE-2022-47326 (severity: MEDIUM, weakness: CWE-862)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
CVE-2022-47327 (severity: MEDIUM, weakness: CWE-862)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
CVE-2022-47328 (severity: MEDIUM, weakness: CWE-862)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
CVE-2022-47329 (severity: MEDIUM, weakness: CWE-862)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
CVE-2022-4733 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.
CVE-2022-47330 (severity: MEDIUM, weakness: CWE-862)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
CVE-2022-47331 (severity: MEDIUM, weakness: CWE-362)
In wlan driver, there is a race condition. This could lead to local denial of service in wlan services.
CVE-2022-47332 (severity: MEDIUM, weakness: CWE-862)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
CVE-2022-47333 (severity: MEDIUM, weakness: CWE-862)
In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
CVE-2022-47334 (severity: MEDIUM, weakness: CWE-125)
In phasecheck server, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-47335 (severity: MEDIUM, weakness: CWE-120)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVE-2022-47336 (severity: MEDIUM, weakness: CWE-120)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVE-2022-47337 (severity: MEDIUM, weakness: CWE-787)
In media service, there is a missing permission check. This could lead to local denial of service in media service.
CVE-2022-47338 (severity: HIGH, weakness: CWE-668)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVE-2022-47339 (severity: MEDIUM, weakness: CWE-862)
In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
CVE-2022-4734 (severity: MEDIUM, weakness: CWE-212)
Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.
CVE-2022-47340 (severity: MEDIUM, weakness: CWE-787)
In h265 codec firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-47341 (severity: MEDIUM, weakness: CWE-862)
In engineermode services, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
CVE-2022-47342 (severity: MEDIUM, weakness: CWE-129)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
CVE-2022-47343 (severity: MEDIUM, weakness: CWE-129)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
CVE-2022-47344 (severity: MEDIUM, weakness: CWE-129)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
CVE-2022-47345 (severity: MEDIUM, weakness: CWE-129)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
CVE-2022-47346 (severity: MEDIUM, weakness: CWE-129)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
CVE-2022-47347 (severity: MEDIUM, weakness: CWE-129)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
CVE-2022-47348 (severity: MEDIUM, weakness: CWE-129)
In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
CVE-2022-4735 (severity: MEDIUM, weakness: CWE-79)
A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 24d01757a5319cc14c4aa1d8b53d1ab24d48e451. It is recommended to apply a patch to fix this issue. VDB-216766 is the identifier assigned to this vulnerability.
CVE-2022-47350 (severity: MEDIUM, weakness: CWE-125)
In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVE-2022-47351 (severity: MEDIUM, weakness: CWE-125)
In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVE-2022-47352 (severity: MEDIUM, weakness: CWE-125)
In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
CVE-2022-47353 (severity: MEDIUM, weakness: CWE-20)
In vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of service with System execution privileges needed
CVE-2022-47354 (severity: MEDIUM, weakness: CWE-400)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
CVE-2022-47355 (severity: MEDIUM, weakness: CWE-400)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
CVE-2022-47356 (severity: MEDIUM, weakness: CWE-400)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
CVE-2022-47357 (severity: MEDIUM, weakness: CWE-862)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
CVE-2022-47358 (severity: MEDIUM, weakness: CWE-862)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
CVE-2022-47359 (severity: MEDIUM, weakness: CWE-476)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
CVE-2022-4736 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in Venganzas del Pasado and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument the_title leads to cross site scripting. The attack may be launched remotely. The name of the patch is 62339b2ec445692c710b804bdf07aef4bd247ff7. It is recommended to apply a patch to fix this issue. VDB-216770 is the identifier assigned to this vulnerability.
CVE-2022-47360 (severity: MEDIUM, weakness: CWE-476)
In log service, there is a missing permission check. This could lead to local denial of service in log service.
CVE-2022-47361 (severity: HIGH, weakness: CWE-862)
In firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
CVE-2022-47362 (severity: MEDIUM, weakness: CWE-120)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVE-2022-47363 (severity: MEDIUM, weakness: CWE-125)
In wlan driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service in wlan services.
CVE-2022-47364 (severity: MEDIUM, weakness: CWE-787)
In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
CVE-2022-47365 (severity: MEDIUM, weakness: CWE-787)
In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
CVE-2022-47366 (severity: MEDIUM, weakness: CWE-787)
In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
CVE-2022-47367 (severity: MEDIUM, weakness: CWE-862)
In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2022-47368 (severity: MEDIUM, weakness: CWE-787)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
CVE-2022-47369 (severity: MEDIUM, weakness: CWE-787)
In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.