stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-44089 (severity: CRITICAL, weakness: CWE-94)
ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component IS_GETCACHE.
CVE-2022-4409 (severity: MEDIUM, weakness: CWE-614)
Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9.
CVE-2022-44096 (severity: CRITICAL, weakness: CWE-798)
Sanitization Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
CVE-2022-44097 (severity: CRITICAL, weakness: CWE-798)
Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel.
CVE-2022-4410 (severity: MEDIUM, weakness: CWE-79)
The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output escaping on post/page/media titles. This makes it possible for attackers to inject arbitrary web scripts on the permalink-manager page if another plugin or theme is installed on the site that allows lower privileged users with unfiltered_html the ability to modify post/page titles with malicious web scripts.
CVE-2022-44108 (severity: CRITICAL, weakness: CWE-787)
pdftojson commit 94204bb was discovered to contain a stack overflow via the component Object::copy(Object*):Object.cc.
CVE-2022-44109 (severity: CRITICAL, weakness: CWE-787)
pdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream::makeFilter(char*, Stream*, Object*, int).
CVE-2022-44117 (severity: CRITICAL, weakness: CWE-89)
Boa 0.94.14rc21 is vulnerable to SQL Injection via username. NOTE: the is disputed by multiple third parties because Boa does not ship with any support for SQL.
CVE-2022-44118 (severity: CRITICAL, weakness: NVD-CWE-Other)
dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.
CVE-2022-44120 (severity: CRITICAL, weakness: CWE-89)
dedecmdv6 6.1.9 is vulnerable to SQL Injection. via sys_sql_query.php.
CVE-2022-4413 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13.
CVE-2022-44136 (severity: CRITICAL, weakness: NVD-CWE-Other)
Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE).
CVE-2022-44137 (severity: HIGH, weakness: CWE-89)
SourceCodester Sanitization Management System 1.0 is vulnerable to SQL Injection.
CVE-2022-44139 (severity: CRITICAL, weakness: CWE-89)
Apartment Visitor Management System v1.0 is vulnerable to SQL Injection via /avms/index.php.
CVE-2022-4414 (severity: MEDIUM, weakness: CWE-79)
Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13.
CVE-2022-44140 (severity: HIGH, weakness: CWE-89)
Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.
CVE-2022-44149 (severity: HIGH, weakness: CWE-78)
The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required
CVE-2022-4415 (severity: MEDIUM, weakness: CWE-200)
A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.
CVE-2022-44151 (severity: CRITICAL, weakness: CWE-89)
Simple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php.
CVE-2022-44153 (severity: MEDIUM, weakness: CWE-79)
Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).
CVE-2022-44156 (severity: HIGH, weakness: CWE-787)
Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind.
CVE-2022-44158 (severity: HIGH, weakness: CWE-787)
Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.
CVE-2022-4416 (severity: HIGH, weakness: CWE-707)
A vulnerability was found in RainyGao DocSys. It has been declared as critical. This vulnerability affects the function getReposAllUsers of the file /DocSystem/Repos/getReposAllUsers.do. The manipulation of the argument searchWord/reposId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-215278 is the identifier assigned to this vulnerability.
CVE-2022-44163 (severity: HIGH, weakness: CWE-787)
Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
CVE-2022-44167 (severity: HIGH, weakness: CWE-787)
Tenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer.
CVE-2022-44168 (severity: HIGH, weakness: CWE-787)
Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic..
CVE-2022-44169 (severity: HIGH, weakness: CWE-787)
Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer.
CVE-2022-4417 (severity: MEDIUM, weakness: NVD-CWE-Other)
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
CVE-2022-44171 (severity: CRITICAL, weakness: CWE-120)
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set.
CVE-2022-44172 (severity: CRITICAL, weakness: CWE-120)
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler.
CVE-2022-44174 (severity: CRITICAL, weakness: CWE-120)
Tenda AC18 V15.03.05.05 is vulnerable to Buffer Overflow via function formSetDeviceName.
CVE-2022-44175 (severity: CRITICAL, weakness: CWE-120)
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
CVE-2022-44176 (severity: CRITICAL, weakness: CWE-120)
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function fromSetRouteStatic.
CVE-2022-44177 (severity: CRITICAL, weakness: CWE-120)
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart.
CVE-2022-44178 (severity: CRITICAL, weakness: CWE-120)
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow. via function formWifiWpsOOB.
CVE-2022-4418 (severity: HIGH, weakness: CWE-347)
Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40208.
CVE-2022-44180 (severity: CRITICAL, weakness: CWE-120)
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.
CVE-2022-44183 (severity: CRITICAL, weakness: CWE-120)
Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic.
CVE-2022-44184 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_sec.
CVE-2022-44186 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_pri.
CVE-2022-44187 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via wan_dns1_pri.
CVE-2022-44188 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter enable_band_steering.
CVE-2022-44190 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable_band_steering.
CVE-2022-44191 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameters KEY1 and KEY2.
CVE-2022-44193 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameters: starthour, startminute , endhour, and endminute.
CVE-2022-44194 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode_dns1_pri and apmode_dns1_sec.
CVE-2022-44196 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_push1.
CVE-2022-44197 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_server_ip.
CVE-2022-44198 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_push1.
CVE-2022-44199 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_server_ip.
CVE-2022-44200 (severity: CRITICAL, weakness: CWE-787)
Netgear R7000P V1.3.0.8, V1.3.1.64 is vulnerable to Buffer Overflow via parameters: stamode_dns1_pri and stamode_dns1_sec.
CVE-2022-44201 (severity: CRITICAL, weakness: CWE-78)
D-Link DIR823G 1.02B05 is vulnerable to Commad Injection.
CVE-2022-44202 (severity: CRITICAL, weakness: CWE-787)
D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow.
CVE-2022-44204 (severity: CRITICAL, weakness: CWE-120)
D-Link DIR3060 DIR3060A1_FW111B04.bin is vulnerable to Buffer Overflow.
CVE-2022-4421 (severity: MEDIUM, weakness: CWE-707)
A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view.php of the component Service Desk Image URL Handler. The manipulation of the argument sslink leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 8a39b2b2bf28353b3503ff1421862393db15aa7e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215304.
CVE-2022-44211 (severity: HIGH, weakness: CWE-284)
In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings.
CVE-2022-44212 (severity: MEDIUM, weakness: CWE-284)
In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.
CVE-2022-44213 (severity: MEDIUM, weakness: CWE-79)
ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).
CVE-2022-44215 (severity: MEDIUM, weakness: CWE-601)
There is an open redirect vulnerability in Titan FTP server 19.0 and below. Users are redirected to any target URL.
CVE-2022-44216 (severity: HIGH, weakness: CWE-306)
Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password.
CVE-2022-4422 (severity: CRITICAL, weakness: CWE-89)
Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in the version 3.0
CVE-2022-44232 (severity: HIGH, weakness: CWE-120)
libming 0.4.8 0.4.8 is vulnerable to Buffer Overflow. In getInt() in decompile.c unknown type may lead to denial of service. This is a different vulnerability than CVE-2018-9132 and CVE-2018-20427.
CVE-2022-44235 (severity: MEDIUM, weakness: CWE-79)
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) is vulnerable to Cross Site Scripting (XSS).
CVE-2022-44236 (severity: CRITICAL, weakness: CWE-521)
Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability.
CVE-2022-44244 (severity: MEDIUM, weakness: CWE-287)
An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.
CVE-2022-44249 (severity: CRITICAL, weakness: CWE-78)
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function.
CVE-2022-44250 (severity: CRITICAL, weakness: CWE-78)
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function.
CVE-2022-44251 (severity: CRITICAL, weakness: CWE-78)
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function.
CVE-2022-44252 (severity: CRITICAL, weakness: CWE-78)
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function.
CVE-2022-44253 (severity: HIGH, weakness: CWE-787)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function.
CVE-2022-44254 (severity: HIGH, weakness: CWE-787)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter text in the setSmsCfg function.
CVE-2022-44255 (severity: CRITICAL, weakness: CWE-787)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.
CVE-2022-44256 (severity: HIGH, weakness: CWE-787)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function.
CVE-2022-44257 (severity: HIGH, weakness: CWE-787)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function.
CVE-2022-44258 (severity: HIGH, weakness: CWE-787)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter command in the setTracerouteCfg function.
CVE-2022-44259 (severity: HIGH, weakness: CWE-787)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function.
CVE-2022-4426 (severity: MEDIUM, weakness: NVD-CWE-Other)
The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.
CVE-2022-44260 (severity: HIGH, weakness: CWE-787)
TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function.
CVE-2022-44261 (severity: MEDIUM, weakness: CWE-79)
Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).
CVE-2022-44262 (severity: CRITICAL, weakness: CWE-94)
ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).
CVE-2022-44263 (severity: HIGH, weakness: CWE-732)
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.
CVE-2022-44264 (severity: HIGH, weakness: CWE-428)
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path.
CVE-2022-44267 (severity: MEDIUM, weakness: CWE-404)
ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.
CVE-2022-44268 (severity: MEDIUM, weakness: CWE-200)
ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).
CVE-2022-4427 (severity: CRITICAL, weakness: CWE-20)
Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
CVE-2022-44276 (severity: CRITICAL, weakness: CWE-434)
In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.
CVE-2022-44277 (severity: HIGH, weakness: CWE-89)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product.
CVE-2022-44278 (severity: HIGH, weakness: CWE-89)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=user/manage_user&id=.
CVE-2022-44279 (severity: MEDIUM, weakness: CWE-79)
Garage Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /garage/php_action/createBrand.php.
CVE-2022-4428 (severity: HIGH, weakness: CWE-20)
support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients).
CVE-2022-44280 (severity: MEDIUM, weakness: CWE-22)
Automotive Shop Management System v1.0 is vulnerable to Delete any file via /asms/classes/Master.php?f=delete_img.
CVE-2022-44283 (severity: CRITICAL, weakness: CWE-120)
AVS Audio Converter 10.3 is vulnerable to Buffer Overflow.
CVE-2022-44284 (severity: MEDIUM, weakness: CWE-79)
Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).
CVE-2022-44289 (severity: HIGH, weakness: CWE-434)
Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
CVE-2022-4429 (severity: MEDIUM, weakness: CWE-428)
Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issue was fixed with Avira Security version 1.1.78
CVE-2022-44290 (severity: CRITICAL, weakness: CWE-89)
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
CVE-2022-44291 (severity: CRITICAL, weakness: CWE-89)
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
CVE-2022-44294 (severity: HIGH, weakness: CWE-89)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manage_service&id=.
CVE-2022-44295 (severity: HIGH, weakness: CWE-89)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=.
CVE-2022-44296 (severity: HIGH, weakness: CWE-89)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manage_remark.php?id=.
CVE-2022-44297 (severity: CRITICAL, weakness: CWE-89)
SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.
CVE-2022-44298 (severity: CRITICAL, weakness: CWE-89)
SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
CVE-2022-44299 (severity: MEDIUM, weakness: CWE-22)
SiteServerCMS 7.1.3 sscms has a file read vulnerability.
CVE-2022-44303 (severity: MEDIUM, weakness: CWE-79)
Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the "{schedule_job}" or "args" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.
CVE-2022-4431 (severity: MEDIUM, weakness: NVD-CWE-Other)
The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
CVE-2022-44310 (severity: HIGH, weakness: CWE-668)
In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.
CVE-2022-44311 (severity: HIGH, weakness: CWE-125)
html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elm_close(tree_node_t *nodo) at procesador.c. This vulnerability allows attackers to access sensitive files or cause a Denial of Service (DoS) via a crafted html file.
CVE-2022-44312 (severity: MEDIUM, weakness: CWE-787)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in expression.c when called from ExpressionInfixOperator.
CVE-2022-44313 (severity: MEDIUM, weakness: CWE-787)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when called from ExpressionParseFunctionCall.
CVE-2022-44314 (severity: MEDIUM, weakness: CWE-787)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunctionCall.
CVE-2022-44315 (severity: MEDIUM, weakness: CWE-787)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCall.
CVE-2022-44316 (severity: MEDIUM, weakness: CWE-787)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanGetToken.
CVE-2022-44317 (severity: MEDIUM, weakness: CWE-787)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioOutPutc function in cstdlib/stdio.c when called from ExpressionParseFunctionCall.
CVE-2022-44318 (severity: MEDIUM, weakness: CWE-787)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionCall.
CVE-2022-44319 (severity: MEDIUM, weakness: CWE-787)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from ExpressionParseFunctionCall.
CVE-2022-4432 (severity: MEDIUM, weakness: CWE-126)
A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
CVE-2022-44320 (severity: MEDIUM, weakness: CWE-787)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from ExpressionParseFunctionCall.
CVE-2022-44321 (severity: MEDIUM, weakness: CWE-787)
PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexSkipComment function in lex.c when called from LexScanGetToken.
CVE-2022-4433 (severity: MEDIUM, weakness: CWE-126)
A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
CVE-2022-4434 (severity: MEDIUM, weakness: CWE-126)
A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS driver that could allow a local attacker with elevated privileges to cause information disclosure.
CVE-2022-44343 (severity: HIGH, weakness: CWE-552)
CRMEB 4.4.4 is vulnerable to Any File download.
CVE-2022-44345 (severity: HIGH, weakness: CWE-89)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=quotes/view_quote&id=.
CVE-2022-44347 (severity: HIGH, weakness: CWE-89)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=inquiries/view_inquiry&id=.
CVE-2022-44348 (severity: HIGH, weakness: CWE-89)
Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.
CVE-2022-44349 (severity: MEDIUM, weakness: CWE-79)
NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50 is vulnerable to Cross Site Scripting (XSS).
CVE-2022-4435 (severity: MEDIUM, weakness: CWE-126)
A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoRemoteConfigUpdateDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
CVE-2022-44351 (severity: CRITICAL, weakness: CWE-502)
Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.
CVE-2022-44354 (severity: CRITICAL, weakness: CWE-434)
SolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file.
CVE-2022-44355 (severity: MEDIUM, weakness: CWE-79)
SolarView Compact 7.0 is vulnerable to Cross-site Scripting (XSS) via /network_test.php.