stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-4746 (severity: HIGH, weakness: CWE-290)
The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.
CVE-2022-47460 (severity: MEDIUM, weakness: CWE-416)
In gpu device, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel.
CVE-2022-47461 (severity: MEDIUM, weakness: CWE-862)
In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
CVE-2022-47462 (severity: MEDIUM, weakness: CWE-862)
In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
CVE-2022-47463 (severity: MEDIUM, weakness: CWE-120)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVE-2022-47464 (severity: MEDIUM, weakness: CWE-120)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVE-2022-47465 (severity: MEDIUM, weakness: CWE-476)
In vdsp service, there is a missing permission check. This could lead to local denial of service in vdsp service.
CVE-2022-47466 (severity: MEDIUM, weakness: CWE-476)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVE-2022-47467 (severity: MEDIUM, weakness: CWE-476)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVE-2022-47468 (severity: MEDIUM, weakness: CWE-476)
In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
CVE-2022-47469 (severity: MEDIUM, weakness: CWE-787)
In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could local denial of service with System execution privileges needed.
CVE-2022-4747 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-47470 (severity: MEDIUM, weakness: CWE-787)
In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could local denial of service with System execution privileges needed.
CVE-2022-47471 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2022-47472 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2022-47473 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2022-47474 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2022-47475 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2022-47476 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2022-47477 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2022-47478 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2022-47479 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
CVE-2022-4748 (severity: CRITICAL, weakness: CWE-22)
A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The name of the patch is 5d5c7f6d8f072d14926fc2c3a97cdd763802f170. It is recommended to apply a patch to fix this issue. The identifier VDB-216861 was assigned to this vulnerability.
CVE-2022-47480 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
CVE-2022-47481 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
CVE-2022-47482 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
CVE-2022-47483 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
CVE-2022-47484 (severity: MEDIUM, weakness: CWE-862)
In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
CVE-2022-47485 (severity: MEDIUM, weakness: CWE-787)
In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-47486 (severity: MEDIUM, weakness: CWE-787)
In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-47487 (severity: MEDIUM, weakness: CWE-120)
In thermal service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service local denial of service with no additional execution privileges.
CVE-2022-47488 (severity: MEDIUM, weakness: CWE-119)
In spipe drive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-47489 (severity: MEDIUM, weakness: CWE-190)
In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-4749 (severity: MEDIUM, weakness: CWE-79)
The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-47490 (severity: MEDIUM, weakness: CWE-862)
In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-47491 (severity: MEDIUM, weakness: CWE-120)
In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-47492 (severity: MEDIUM, weakness: CWE-862)
In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-47493 (severity: MEDIUM, weakness: CWE-862)
In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
CVE-2022-47494 (severity: MEDIUM, weakness: CWE-120)
In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-47495 (severity: MEDIUM, weakness: CWE-120)
In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-47496 (severity: MEDIUM, weakness: CWE-120)
In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-47497 (severity: MEDIUM, weakness: CWE-120)
In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-47498 (severity: MEDIUM, weakness: CWE-120)
In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-47499 (severity: MEDIUM, weakness: CWE-120)
In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
CVE-2022-4750 (severity: MEDIUM, weakness: NVD-CWE-Other)
The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2022-47500 (severity: MEDIUM, weakness: CWE-601)
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4. Solution: removed the the forward component since it was improper designed for UI embedding. User please upgrade to 1.1.0 to fix this issue.
CVE-2022-47501 (severity: HIGH, weakness: CWE-22)
Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is a pre-authentication attack. This issue affects Apache OFBiz: before 18.12.07.
CVE-2022-47502 (severity: HIGH, weakness: CWE-20)
Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution.
CVE-2022-47503 (severity: HIGH, weakness: CWE-502)
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVE-2022-47504 (severity: HIGH, weakness: CWE-502)
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVE-2022-47505 (severity: HIGH, weakness: CWE-269)
The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges.
CVE-2022-47506 (severity: HIGH, weakness: CWE-22)
SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated account access to edit the default configuration, enabling the execution of arbitrary commands.
CVE-2022-47507 (severity: HIGH, weakness: CWE-502)
SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
CVE-2022-47508 (severity: HIGH, weakness: CWE-287)
Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP address this prevented us from utilizing Kerberos.
CVE-2022-47509 (severity: MEDIUM, weakness: CWE-79)
The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.
CVE-2022-4751 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-47512 (severity: MEDIUM, weakness: CWE-312)
Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Platform 2022.4. No other versions are affected
CVE-2022-47514 (severity: HIGH, weakness: CWE-611)
An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.
CVE-2022-47515 (severity: HIGH, weakness: CWE-170)
An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to std::length_error.
CVE-2022-47516 (severity: HIGH, weakness: CWE-617)
An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.
CVE-2022-47517 (severity: HIGH, weakness: CWE-193)
An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.
CVE-2022-47518 (severity: HIGH, weakness: CWE-787)
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.
CVE-2022-47519 (severity: HIGH, weakness: CWE-787)
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.
CVE-2022-4752 (severity: MEDIUM, weakness: CWE-79)
The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2022-47520 (severity: HIGH, weakness: CWE-125)
An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.
CVE-2022-47521 (severity: HIGH, weakness: CWE-787)
An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.
CVE-2022-47522 (severity: HIGH, weakness: CWE-290)
The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
CVE-2022-47523 (severity: CRITICAL, weakness: CWE-89)
Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.
CVE-2022-47524 (severity: MEDIUM, weakness: NVD-CWE-Other)
F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack.
CVE-2022-47525 (severity: HIGH, weakness: CWE-369)
Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leverage this vulnerability to cause a denial-of-service. Exploitation of this issue does not require user interaction.
CVE-2022-47526 (severity: CRITICAL, weakness: CWE-22)
Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the downstream node user. Exploitation of this issue does not require user interaction.
CVE-2022-47529 (severity: MEDIUM, weakness: NVD-CWE-Other)
Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.
CVE-2022-4753 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-47531 (severity: HIGH, weakness: NVD-CWE-Other)
An issue was discovered in Ericsson Evolved Packet Gateway (EPG) versions 3.x before 3.25 and 2.x before 2.16, allows authenticated users to bypass system CLI and execute commands they are authorized to execute directly in the UNIX shell.
CVE-2022-47532 (severity: CRITICAL, weakness: CWE-89)
FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request.
CVE-2022-4754 (severity: MEDIUM, weakness: CWE-79)
The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
CVE-2022-47542 (severity: HIGH, weakness: CWE-284)
Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privileges.
CVE-2022-47543 (severity: MEDIUM, weakness: CWE-284)
An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects.
CVE-2022-47544 (severity: CRITICAL, weakness: CWE-693)
An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed.
CVE-2022-47547 (severity: MEDIUM, weakness: CWE-281)
GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.
CVE-2022-47549 (severity: MEDIUM, weakness: CWE-347)
An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections.
CVE-2022-4755 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component Media Manager Plugin. The manipulation of the argument mm-newgallery-name leads to cross site scripting. The attack may be initiated remotely. The name of the patch is d3f329496536dc99f9707f2f295d571d65a496f5. It is recommended to apply a patch to fix this issue. The identifier VDB-216869 was assigned to this vulnerability.
CVE-2022-47551 (severity: MEDIUM, weakness: CWE-276)
Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.
CVE-2022-47553 (severity: HIGH, weakness: CWE-285)
Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server.
CVE-2022-47554 (severity: HIGH, weakness: CWE-200)
Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server.
CVE-2022-47555 (severity: HIGH, weakness: CWE-78)
Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.
CVE-2022-47556 (severity: MEDIUM, weakness: CWE-400)
Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service (DoS) on the device.
CVE-2022-47557 (severity: MEDIUM, weakness: CWE-916)
Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequently gain access to the system to perform malicious actions.
CVE-2022-47558 (severity: CRITICAL, weakness: CWE-284)
Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors.
CVE-2022-47559 (severity: HIGH, weakness: CWE-352)
Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity.