stasvinokur/cve-and-cwe-dataset-1999-2025 huggingface dataset:
CVE-2022-26839 (severity: HIGH, weakness: CWE-276)
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) is vulnerable to an incorrect default permission in the DIAEnergie application, which may allow an attacker to plant new files (such as DLLs) or replace existing executable files.
CVE-2022-2684 (severity: MEDIUM, weakness: CWE-79)
A vulnerability has been found in SourceCodester Apartment Visitor Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /manage-apartment.php. The manipulation of the argument Apartment Number with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205672.
CVE-2022-26840 (severity: HIGH, weakness: NVD-CWE-Other)
Improper neutralization in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-26841 (severity: MEDIUM, weakness: NVD-CWE-Other)
Insufficient control flow management for the Intel(R) SGX SDK software for Linux before version 2.16.100.1 may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2022-26842 (severity: CRITICAL, weakness: CWE-79)
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.
CVE-2022-26843 (severity: CRITICAL, weakness: NVD-CWE-Other)
Insufficient visual distinction of homoglyphs presented to user in the Intel(R) oneAPI DPC++/C++ Compiler before version 2022.1 for Intel(R) oneAPI Toolkits before version 2022.2 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVE-2022-26844 (severity: HIGH, weakness: CWE-522)
Insufficiently protected credentials in the installation binaries for Intel(R) SEAPI in all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-26845 (severity: CRITICAL, weakness: CWE-287)
Improper authentication in firmware for Intel(R) AMT before versions 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticated user to potentially enable escalation of privilege via network access.
CVE-2022-26846 (severity: HIGH, weakness: NVD-CWE-Other)
SPIP before 3.2.14 and 4.x before 4.0.5 allows remote authenticated editors to execute arbitrary code.
CVE-2022-26847 (severity: MEDIUM, weakness: CWE-200)
SPIP before 3.2.14 and 4.x before 4.0.5 allows unauthenticated access to information about editorial objects.
CVE-2022-2685 (severity: MEDIUM, weakness: CWE-79)
A vulnerability was found in SourceCodester Interview Management System 1.0 and classified as problematic. This issue affects some unknown processing of the file /addQuestion.php. The manipulation of the argument question with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205673 was assigned to this vulnerability.
CVE-2022-26850 (severity: MEDIUM, weakness: CWE-668)
When creating or updating credentials for single-user access, Apache NiFi wrote a copy of the Login Identity Providers configuration to the operating system temporary directory. On most platforms, the operating system temporary directory has global read permissions. NiFi immediately moved the temporary file to the final configuration directory, which significantly limited the window of opportunity for access. NiFi 1.16.0 includes updates to replace the Login Identity Providers configuration without writing a file to the operating system temporary directory.
CVE-2022-26851 (severity: CRITICAL, weakness: CWE-330)
Dell PowerScale OneFS, 8.2.2-9.3.x, contains a predictable file name from observable state vulnerability. An unprivileged network attacker could potentially exploit this vulnerability, leading to data loss.
CVE-2022-26852 (severity: CRITICAL, weakness: CWE-337)
Dell PowerScale OneFS, versions 8.2.x-9.3.x, contain a predictable seed in pseudo-random number generator. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to an account compromise.
CVE-2022-26854 (severity: CRITICAL, weakness: CWE-327)
Dell PowerScale OneFS, versions 8.2.x-9.2.x, contain risky cryptographic algorithms. A remote unprivileged malicious attacker could potentially exploit this vulnerability, leading to full system access
CVE-2022-26855 (severity: MEDIUM, weakness: CWE-276)
Dell PowerScale OneFS, versions 8.2.x-9.3.0.x, contains an incorrect default permissions vulnerability. A local malicious user could potentially exploit this vulnerability, leading to a denial of service.
CVE-2022-26856 (severity: HIGH, weakness: CWE-522)
Dell EMC Repository Manager version 3.4.0 contains a plain-text password storage vulnerability. A local attacker could potentially exploit this vulnerability, leading to the disclosure of certain user credentials. The attacker may be able to use the exposed credentials to access the vulnerable application's database with privileges of the compromised account.
CVE-2022-26857 (severity: HIGH, weakness: CWE-285)
Dell OpenManage Enterprise Versions 3.8.3 and prior contain an improper authorization vulnerability. A remote authenticated malicious user with low privileges may potentially exploit this vulnerability to bypass blocked functionalities and perform unauthorized actions.
CVE-2022-26858 (severity: HIGH, weakness: CWE-287)
Dell BIOS versions contain an Improper Authentication vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls.
CVE-2022-26859 (severity: HIGH, weakness: CWE-367)
Dell BIOS contains a race condition vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI in order to bypass security checks during SMM.
CVE-2022-2686 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in oretnom23 Fast Food Ordering System. This affects an unknown part of the component Menu List Page. The manipulation of the argument Description leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205725 was assigned to this vulnerability.
CVE-2022-26860 (severity: HIGH, weakness: CWE-121)
Dell BIOS versions contain a stack-based buffer overflow vulnerability. A local attacker could exploit this vulnerability by sending malicious input via SMI to bypass security checks resulting in arbitrary code execution in SMM.
CVE-2022-26861 (severity: HIGH, weakness: CWE-1038)
Dell BIOS versions contain an Insecure Automated Optimization vulnerability. A local authenticated malicious user could exploit this vulnerability by sending malicious input via SMI to obtain arbitrary code execution during SMM.
CVE-2022-26862 (severity: HIGH, weakness: CWE-20)
Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.
CVE-2022-26863 (severity: HIGH, weakness: CWE-20)
Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.
CVE-2022-26864 (severity: HIGH, weakness: CWE-20)
Prior Dell BIOS versions contain an Input Validation vulnerability. A locally authenticated malicious user could potentially exploit this vulnerability by sending malicious input to an SMI in order to bypass security controls in SMM.
CVE-2022-26865 (severity: MEDIUM, weakness: CWE-288)
Dell Support Assist OS Recovery versions before 5.5.2 contain an Authentication Bypass vulnerability. An unauthenticated attacker with physical access to the system may exploit this vulnerability by bypassing OS Recovery authentication in order to run arbitrary code on the system as Administrator.
CVE-2022-26866 (severity: MEDIUM, weakness: CWE-79)
Dell PowerStore Versions before v2.1.1.0. contains a Stored Cross-Site Scripting vulnerability. A high privileged network attacker could potentially exploit this vulnerability, leading to the storage of malicious HTML or JavaScript codes in a trusted application data store. When a victim user accesses the data store through their browsers, the malicious code gets executed by the web browser in the context of the vulnerable web application. Exploitation may lead to information disclosure, session theft, or client-side request forgery.
CVE-2022-26867 (severity: HIGH, weakness: CWE-1236)
PowerStore SW v2.1.1.0 supports the option to export data to either a CSV or an XLSX file. The data is taken as is, without any validation or sanitization. It allows a malicious, authenticated user to inject payloads that might get interpreted as formulas by the corresponding spreadsheet application that is being used to open the CSV/XLSX file.
CVE-2022-26868 (severity: HIGH, weakness: CWE-78)
Dell EMC PowerStore versions 2.0.0.x, 2.0.1.x, and 2.1.0.x are vulnerable to a command injection flaw. An authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the application's underlying OS, with the privileges of the vulnerable application. Exploitation may lead to a system takeover by an attacker.
CVE-2022-26869 (severity: CRITICAL, weakness: CWE-200)
Dell PowerStore versions 2.0.0.x, 2.0.1.x and 2.1.0.x contains an open port vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability, leading to information disclosure and arbitrary code execution.
CVE-2022-2687 (severity: CRITICAL, weakness: CWE-89)
A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. Affected is an unknown function. The manipulation of the argument user_pass leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-205734 is the identifier assigned to this vulnerability.
CVE-2022-26870 (severity: CRITICAL, weakness: CWE-288)
Dell PowerStore versions 2.1.0.x contain an Authentication bypass vulnerability. A remote unauthenticated attacker could potentially exploit this vulnerability under specific configuration. An attacker would gain unauthorized access upon successful exploit.
CVE-2022-26871 (severity: CRITICAL, weakness: CWE-345)
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
CVE-2022-26872 (severity: HIGH, weakness: CWE-640)
AMI Megarac Password reset interception via API
CVE-2022-26873 (severity: HIGH, weakness: CWE-121)
A potential attacker can execute an arbitrary code at the time of the PEI phase and influence the subsequent boot stages. This can lead to the mitigations bypassing, physical memory contents disclosure, discovery of any secrets from any Virtual Machines (VMs) and bypassing memory isolation and confidential computing boundaries. Additionally, an attacker can build a payload which can be injected into the SMRAM memory. This issue affects: Module name: PlatformInitAdvancedPreMem SHA256: 644044fdb8daea30a7820e0f5f88dbf5cd460af72fbf70418e9d2e47efed8d9b Module GUID: EEEE611D-F78F-4FB9-B868-55907F169280 This issue affects: AMI Aptio 5.x.
CVE-2022-26874 (severity: MEDIUM, weakness: CWE-79)
lib/Horde/Mime/Viewer/Ooo.php in Horde Mime_Viewer before 2.2.4 allows XSS via an OpenOffice document, leading to account takeover in Horde Groupware Webmail Edition. This occurs after XSLT rendering.
CVE-2022-26877 (severity: MEDIUM, weakness: CWE-552)
Asana Desktop before 1.6.0 allows remote attackers to exfiltrate local files if they can trick the Asana desktop app into loading a malicious web page.
CVE-2022-26878 (severity: MEDIUM, weakness: CWE-401)
drivers/bluetooth/virtio_bt.c in the Linux kernel before 5.16.3 has a memory leak (socket buffers have memory allocated but not freed).
CVE-2022-2688 (severity: CRITICAL, weakness: CWE-89)
A vulnerability was found in SourceCodester Expense Management System. It has been rated as critical. This issue affects the function fetch_report_credit of the file report.php of the component POST Parameter Handler. The manipulation of the argument from/to leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-205811.
CVE-2022-26884 (severity: MEDIUM, weakness: CWE-22)
Users can read any files by log server, Apache DolphinScheduler users should upgrade to version 2.0.6 or higher.
CVE-2022-26885 (severity: HIGH, weakness: CWE-200)
When using tasks to read config files, there is a risk of database password disclosure. We recommend you upgrade to version 2.0.6 or higher.
CVE-2022-26887 (severity: CRITICAL, weakness: CWE-89)
Delta Electronics DIAEnergie (All versions prior to 1.8.02.004) has a blind SQL injection vulnerability exists in DIAE_loopmapHandler.ashx. This allows an attacker to inject arbitrary SQL queries, retrieve and modify database contents, and execute system commands.
CVE-2022-26888 (severity: MEDIUM, weakness: CWE-79)
Cross-site scripting in the Intel(R) Quartus Prime Pro and Standard edition software may allow an authenticated user to potentially enable information disclosure via local access.
CVE-2022-26889 (severity: HIGH, weakness: CWE-20)
In Splunk Enterprise versions before 8.1.2, the uri path to load a relative resource within a web page is vulnerable to path traversal. It allows an attacker to potentially inject arbitrary content into the web page (e.g., HTML Injection, XSS) or bypass SPL safeguards for risky commands. The attack is browser-based. An attacker cannot exploit the attack at will and requires the attacker to initiate a request within the victim's browser (e.g., phishing).
CVE-2022-2689 (severity: MEDIUM, weakness: CWE-79)
A vulnerability classified as problematic has been found in SourceCodester Wedding Hall Booking System. Affected is an unknown function of the file /whbs/?page=contact_us of the component Contact Page. The manipulation of the argument Message leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205812.
CVE-2022-26890 (severity: HIGH, weakness: CWE-670)
On F5 BIG-IP Advanced WAF, ASM, and APM 16.1.x versions prior to 16.1.2.1, 15.1.x versions prior to 15.1.5, 14.1.x versions prior to 14.1.4.6, and 13.1.x versions prior to 13.1.5, when ASM or Advanced WAF, as well as APM, are configured on a virtual server, the ASM policy is configured with Session Awareness, and the "Use APM Username and Session ID" option is enabled, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2022-26891 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-26894 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-26895 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-26896 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Information Disclosure Vulnerability
CVE-2022-26897 (severity: MEDIUM, weakness: NVD-CWE-Other)
Azure Site Recovery Information Disclosure Vulnerability
CVE-2022-26898 (severity: HIGH, weakness: NVD-CWE-Other)
Azure Site Recovery Remote Code Execution Vulnerability
CVE-2022-26899 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-2690 (severity: MEDIUM, weakness: CWE-79)
A vulnerability classified as problematic was found in SourceCodester Wedding Hall Booking System. Affected by this vulnerability is an unknown functionality of the file /whbs/?page=my_bookings of the component Booking Form. The manipulation of the argument Remarks leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205813 was assigned to this vulnerability.
CVE-2022-26900 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-26901 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Excel Remote Code Execution Vulnerability
CVE-2022-26903 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Graphics Component Remote Code Execution Vulnerability
CVE-2022-26904 (severity: HIGH, weakness: CWE-362)
Windows User Profile Service Elevation of Privilege Vulnerability
CVE-2022-26905 (severity: MEDIUM, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Spoofing Vulnerability
CVE-2022-26907 (severity: MEDIUM, weakness: CWE-532)
Azure SDK for .NET Information Disclosure Vulnerability
CVE-2022-26908 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-26909 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-2691 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, has been found in SourceCodester Wedding Hall Booking System. Affected by this issue is some unknown functionality of the file /whbs/?page=manage_account of the component Profile Page. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-205814 is the identifier assigned to this vulnerability.
CVE-2022-26910 (severity: MEDIUM, weakness: CWE-290)
Skype for Business and Lync Spoofing Vulnerability
CVE-2022-26911 (severity: MEDIUM, weakness: NVD-CWE-Other)
Skype for Business Information Disclosure Vulnerability
CVE-2022-26912 (severity: HIGH, weakness: NVD-CWE-Other)
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2022-26913 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Authentication Information Disclosure Vulnerability
CVE-2022-26914 (severity: HIGH, weakness: NVD-CWE-Other)
Win32k Elevation of Privilege Vulnerability
CVE-2022-26915 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Secure Channel Denial of Service Vulnerability
CVE-2022-26916 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Fax Compose Form Remote Code Execution Vulnerability
CVE-2022-26917 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Fax Compose Form Remote Code Execution Vulnerability
CVE-2022-26918 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Fax Compose Form Remote Code Execution Vulnerability
CVE-2022-26919 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
CVE-2022-2692 (severity: MEDIUM, weakness: CWE-79)
A vulnerability, which was classified as problematic, was found in SourceCodester Wedding Hall Booking System. This affects an unknown part of the file /whbs/admin/?page=user of the component Staff User Profile. The manipulation of the argument First Name/Last Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-205815.
CVE-2022-26920 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Graphics Component Information Disclosure Vulnerability
CVE-2022-26921 (severity: HIGH, weakness: NVD-CWE-Other)
Visual Studio Code Elevation of Privilege Vulnerability
CVE-2022-26923 (severity: HIGH, weakness: CWE-295)
Active Directory Domain Services Elevation of Privilege Vulnerability
CVE-2022-26924 (severity: HIGH, weakness: NVD-CWE-Other)
YARP Denial of Service Vulnerability
CVE-2022-26925 (severity: MEDIUM, weakness: CWE-306)
Windows LSA Spoofing Vulnerability
CVE-2022-26926 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Address Book Remote Code Execution Vulnerability
CVE-2022-26927 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Graphics Component Remote Code Execution Vulnerability
CVE-2022-26928 (severity: HIGH, weakness: CWE-362)
Windows Photo Import API Elevation of Privilege Vulnerability
CVE-2022-26929 (severity: HIGH, weakness: NVD-CWE-Other)
.NET Framework Remote Code Execution Vulnerability
CVE-2022-2693 (severity: HIGH, weakness: CWE-89)
A vulnerability has been found in SourceCodester Electronic Medical Records System and classified as critical. This vulnerability affects unknown code of the file register.php of the component UPDATE Statement Handler. The manipulation of the argument pconsultation leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-205816.
CVE-2022-26930 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2022-26931 (severity: HIGH, weakness: NVD-CWE-Other)
Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-26932 (severity: HIGH, weakness: NVD-CWE-Other)
Storage Spaces Direct Elevation of Privilege Vulnerability
CVE-2022-26933 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows NTFS Information Disclosure Vulnerability
CVE-2022-26934 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Graphics Component Information Disclosure Vulnerability
CVE-2022-26935 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows WLAN AutoConfig Service Information Disclosure Vulnerability
CVE-2022-26936 (severity: MEDIUM, weakness: NVD-CWE-Other)
Windows Server Service Information Disclosure Vulnerability
CVE-2022-26937 (severity: CRITICAL, weakness: NVD-CWE-Other)
Windows Network File System Remote Code Execution Vulnerability
CVE-2022-26938 (severity: HIGH, weakness: NVD-CWE-Other)
Storage Spaces Direct Elevation of Privilege Vulnerability
CVE-2022-26939 (severity: HIGH, weakness: NVD-CWE-Other)
Storage Spaces Direct Elevation of Privilege Vulnerability
CVE-2022-2694 (severity: HIGH, weakness: CWE-434)
A vulnerability was found in SourceCodester Company Website CMS and classified as critical. This issue affects some unknown processing. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205817 was assigned to this vulnerability.
CVE-2022-26940 (severity: MEDIUM, weakness: NVD-CWE-Other)
Remote Desktop Protocol Client Information Disclosure Vulnerability
CVE-2022-26941 (severity: HIGH, weakness: CWE-134)
A format string vulnerability exists in Motorola MTM5000 series firmware AT command handler for the AT+CTGL command. An attacker-controllable string is improperly handled, allowing for a write-anything-anywhere scenario. This can be leveraged to obtain arbitrary code execution inside the teds_app binary, which runs with root privileges.
CVE-2022-26942 (severity: HIGH, weakness: CWE-822)
The Motorola MTM5000 series firmwares lack pointer validation on arguments passed to trusted execution environment (TEE) modules. Two modules are used, one responsible for KVL key management and the other for TETRA cryptographic functionality. In both modules, an adversary with non-secure supervisor level code execution can exploit the issue in order to gain secure supervisor code execution within the TEE. This constitutes a full break of the TEE module, exposing the device key as well as any TETRA cryptographic keys and the confidential TETRA cryptographic primitives.