stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-21789 (severity: MEDIUM, weakness: CWE-362)
In audio ipi, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478101; Issue ID: ALPS06478101.
CVE-2022-2179 (severity: MEDIUM, weakness: CWE-1021)
The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.
CVE-2022-21790 (severity: MEDIUM, weakness: CWE-125)
In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479306; Issue ID: ALPS06479306.
CVE-2022-21791 (severity: MEDIUM, weakness: CWE-125)
In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478059; Issue ID: ALPS06478059.
CVE-2022-21792 (severity: MEDIUM, weakness: CWE-787)
In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07085410; Issue ID: ALPS07085410.
CVE-2022-21793 (severity: MEDIUM, weakness: NVD-CWE-Other)
Insufficient control flow management in the Intel(R) Ethernet 500 Series Controller drivers for VMWare before version 1.11.4.0 and in the Intel(R) Ethernet 700 Series Controller drivers for VMWare before version 2.1.5.0 may allow an authenticated user to potentially enable a denial of service via local access.
CVE-2022-21794 (severity: MEDIUM, weakness: CWE-287)
Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067 may allow a privileged user to potentially enable escalation of privilege via local access.
CVE-2022-21796 (severity: CRITICAL, weakness: CWE-20)
A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability.
CVE-2022-21797 (severity: CRITICAL, weakness: CWE-94)
The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
CVE-2022-21798 (severity: CRITICAL, weakness: CWE-319)
The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in to make operational changes to the system.
CVE-2022-21799 (severity: MEDIUM, weakness: CWE-79)
Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on the adjacent network to inject an arbitrary script via unspecified vectors.
CVE-2022-2180 (severity: CRITICAL, weakness: CWE-434)
The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE).
CVE-2022-21800 (severity: MEDIUM, weakness: CWE-327)
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed passwords.
CVE-2022-21801 (severity: HIGH, weakness: CWE-190)
A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to a reboot. An attacker can send a malicious packet to trigger this vulnerability.
CVE-2022-21802 (severity: MEDIUM, weakness: CWE-79)
The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.
CVE-2022-21803 (severity: HIGH, weakness: CWE-1321)
This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
CVE-2022-21804 (severity: HIGH, weakness: CWE-787)
Out-of-bounds write in software for the Intel QAT Driver for Windows before version 1.9.0-0008 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-21805 (severity: MEDIUM, weakness: CWE-79)
Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
CVE-2022-21806 (severity: CRITICAL, weakness: CWE-368)
A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to remote code execution. The device is exposed to attacks from the network.
CVE-2022-21807 (severity: HIGH, weakness: CWE-427)
Uncontrolled search path elements in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-21808 (severity: HIGH, weakness: CWE-23)
Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
CVE-2022-21809 (severity: CRITICAL, weakness: CWE-377)
A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file to trigger this vulnerability.
CVE-2022-2181 (severity: MEDIUM, weakness: CWE-79)
The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
CVE-2022-21810 (severity: HIGH, weakness: CWE-78)
All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.
CVE-2022-21812 (severity: HIGH, weakness: NVD-CWE-Other)
Improper access control in the Intel(R) HAXM software before version 7.7.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-21813 (severity: MEDIUM, weakness: CWE-284)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.
CVE-2022-21814 (severity: MEDIUM, weakness: CWE-280)
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.
CVE-2022-21815 (severity: MEDIUM, weakness: CWE-476)
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs where a NULL pointer dereference in the kernel, created within user mode code, may lead to a denial of service in the form of a system crash.
CVE-2022-21816 (severity: MEDIUM, weakness: CWE-284)
NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hypervisor host, leading to a denial of service.
CVE-2022-21817 (severity: CRITICAL, weakness: NVD-CWE-Other)
NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can get user to browse malicious site, to acquire access tokens allowing them to access resources in other security domains, which may lead to code execution, escalation of privileges, and impact to confidentiality and integrity.
CVE-2022-21818 (severity: MEDIUM, weakness: CWE-312)
NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after signing in to the portal can access other users’ credentials, allowing them to gain escalated privileges, resulting in limited impact to both confidentiality and integrity.
CVE-2022-21819 (severity: HIGH, weakness: CWE-732)
NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access to the board direct read/write access to the entire system address space through the PCI bus. Such an attack could result in denial of service, code execution, escalation of privileges, and impact to data integrity and confidentiality. The scope impact may extend to other components.
CVE-2022-2182 (severity: HIGH, weakness: CWE-122)
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
CVE-2022-21820 (severity: MEDIUM, weakness: CWE-20)
NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may lead to limited code execution, some denial of service, escalation of privileges, and limited impacts to both data confidentiality and integrity.
CVE-2022-21821 (severity: HIGH, weakness: CWE-1285)
NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.
CVE-2022-21822 (severity: HIGH, weakness: CWE-770)
NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.
CVE-2022-21823 (severity: MEDIUM, weakness: CWE-922)
A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack vector.
CVE-2022-21824 (severity: HIGH, weakness: CWE-471)
Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
CVE-2022-21825 (severity: HIGH, weakness: CWE-284)
An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow an attacker to perform local privilege escalation.
CVE-2022-21826 (severity: MEDIUM, weakness: CWE-444)
Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.
CVE-2022-21827 (severity: HIGH, weakness: CWE-269)
An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 what could allow an attacker who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM.
CVE-2022-21828 (severity: HIGH, weakness: CWE-502)
A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3.
CVE-2022-21829 (severity: CRITICAL, weakness: CWE-319)
Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.
CVE-2022-2183 (severity: HIGH, weakness: CWE-125)
Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
CVE-2022-21830 (severity: MEDIUM, weakness: CWE-79)
A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.
CVE-2022-21831 (severity: CRITICAL, weakness: CWE-94)
A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.
CVE-2022-21833 (severity: HIGH, weakness: NVD-CWE-Other)
Virtual Machine IDE Drive Elevation of Privilege Vulnerability
CVE-2022-21834 (severity: HIGH, weakness: NVD-CWE-Other)
Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability
CVE-2022-21835 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Cryptographic Services Elevation of Privilege Vulnerability
CVE-2022-21836 (severity: HIGH, weakness: CWE-295)
Windows Certificate Spoofing Vulnerability
CVE-2022-21837 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2022-21838 (severity: HIGH, weakness: CWE-59)
Windows Cleanup Manager Elevation of Privilege Vulnerability
CVE-2022-21839 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability
CVE-2022-2184 (severity: HIGH, weakness: CWE-22)
The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.
CVE-2022-21840 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Office Remote Code Execution Vulnerability
CVE-2022-21841 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2022-21842 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Word Remote Code Execution Vulnerability
CVE-2022-21843 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
CVE-2022-21844 (severity: HIGH, weakness: NVD-CWE-Other)
HEVC Video Extensions Remote Code Execution Vulnerability
CVE-2022-21845 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Kernel Information Disclosure Vulnerability
CVE-2022-21846 (severity: CRITICAL, weakness: NVD-CWE-Other)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2022-21847 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Hyper-V Denial of Service Vulnerability
CVE-2022-21848 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
CVE-2022-21849 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
CVE-2022-2185 (severity: HIGH, weakness: CWE-78)
A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.
CVE-2022-21850 (severity: HIGH, weakness: NVD-CWE-Other)
Remote Desktop Client Remote Code Execution Vulnerability
CVE-2022-21851 (severity: HIGH, weakness: NVD-CWE-Other)
Remote Desktop Client Remote Code Execution Vulnerability
CVE-2022-21852 (severity: HIGH, weakness: CWE-119)
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2022-21855 (severity: CRITICAL, weakness: NVD-CWE-Other)
Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2022-21857 (severity: HIGH, weakness: NVD-CWE-Other)
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2022-21858 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Bind Filter Driver Elevation of Privilege Vulnerability
CVE-2022-21859 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Accounts Control Elevation of Privilege Vulnerability
CVE-2022-2186 (severity: MEDIUM, weakness: CWE-79)
The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
CVE-2022-21860 (severity: HIGH, weakness: NVD-CWE-Other)
Windows AppContracts API Server Elevation of Privilege Vulnerability
CVE-2022-21861 (severity: HIGH, weakness: NVD-CWE-Other)
Task Flow Data Engine Elevation of Privilege Vulnerability
CVE-2022-21862 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Application Model Core API Elevation of Privilege Vulnerability
CVE-2022-21863 (severity: HIGH, weakness: NVD-CWE-Other)
Windows StateRepository API Server file Elevation of Privilege Vulnerability
CVE-2022-21864 (severity: HIGH, weakness: NVD-CWE-Other)
Windows UI Immersive Server API Elevation of Privilege Vulnerability
CVE-2022-21865 (severity: HIGH, weakness: NVD-CWE-Other)
Connected Devices Platform Service Elevation of Privilege Vulnerability
CVE-2022-21866 (severity: HIGH, weakness: NVD-CWE-Other)
Windows System Launcher Elevation of Privilege Vulnerability
CVE-2022-21867 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Push Notifications Apps Elevation of Privilege Vulnerability
CVE-2022-21868 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Devices Human Interface Elevation of Privilege Vulnerability
CVE-2022-21869 (severity: HIGH, weakness: NVD-CWE-Other)
Clipboard User Service Elevation of Privilege Vulnerability
CVE-2022-2187 (severity: MEDIUM, weakness: CWE-79)
The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVE-2022-21870 (severity: HIGH, weakness: NVD-CWE-Other)
Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
CVE-2022-21871 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
CVE-2022-21872 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Event Tracing Elevation of Privilege Vulnerability
CVE-2022-21873 (severity: HIGH, weakness: NVD-CWE-Other)
Tile Data Repository Elevation of Privilege Vulnerability
CVE-2022-21874 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Security Center API Remote Code Execution Vulnerability
CVE-2022-21875 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Storage Elevation of Privilege Vulnerability
CVE-2022-21876 (severity: MEDIUM, weakness: CWE-125)
Win32k Information Disclosure Vulnerability
CVE-2022-21877 (severity: MEDIUM, weakness: CWE-125)
Storage Spaces Controller Information Disclosure Vulnerability
CVE-2022-21878 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Geolocation Service Remote Code Execution Vulnerability
CVE-2022-21879 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2022-2188 (severity: MEDIUM, weakness: CWE-732)
Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory controls in the logs directory. This can lead to a denial-of-service attack on the DXL Broker.
CVE-2022-21880 (severity: HIGH, weakness: NVD-CWE-Other)
Windows GDI+ Information Disclosure Vulnerability
CVE-2022-21881 (severity: HIGH, weakness: CWE-362)
Windows Kernel Elevation of Privilege Vulnerability
CVE-2022-21882 (severity: HIGH, weakness: CWE-787)
Win32k Elevation of Privilege Vulnerability
CVE-2022-21883 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
CVE-2022-21884 (severity: HIGH, weakness: NVD-CWE-Other)
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
CVE-2022-21885 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2022-21887 (severity: HIGH, weakness: NVD-CWE-Other)
Win32k Elevation of Privilege Vulnerability
CVE-2022-21888 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Modern Execution Server Remote Code Execution Vulnerability
CVE-2022-21889 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
CVE-2022-2189 (severity: MEDIUM, weakness: CWE-79)
The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVE-2022-21890 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
CVE-2022-21891 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability
CVE-2022-21892 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
CVE-2022-21893 (severity: HIGH, weakness: NVD-CWE-Other)
Remote Desktop Protocol Remote Code Execution Vulnerability
CVE-2022-21894 (severity: MEDIUM, weakness: CWE-863)
Secure Boot Security Feature Bypass Vulnerability
CVE-2022-21895 (severity: HIGH, weakness: CWE-59)
Windows User Profile Service Elevation of Privilege Vulnerability
CVE-2022-21896 (severity: HIGH, weakness: CWE-362)
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2022-21897 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2022-21898 (severity: CRITICAL, weakness: NVD-CWE-Other)
DirectX Graphics Kernel Remote Code Execution Vulnerability
CVE-2022-21899 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Extensible Firmware Interface Security Feature Bypass Vulnerability
CVE-2022-2190 (severity: MEDIUM, weakness: CWE-79)
The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
CVE-2022-21900 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Hyper-V Security Feature Bypass Vulnerability
CVE-2022-21901 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2022-21902 (severity: HIGH, weakness: CWE-269)
Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2022-21903 (severity: HIGH, weakness: NVD-CWE-Other)
Windows GDI Elevation of Privilege Vulnerability