yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-31683: Concourse (7.x.y prior to 7.8.3 and 6.x.y prior to 6.7.9) contains an authorization bypass issue. A Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team.
Key phrases: bypass issue, bypass team scope check, authorization bypass, gain access, authorization bypass issue
CVE-2022-31684: Reactor Netty HTTP Server, in versions 1.0.11 - 1.0.23, may log request headers in some cases of invalid HTTP requests. The logged headers may reveal valid access tokens to those with access to server logs. This may affect only invalid HTTP requests where logging at WARN level is enabled.
Key phrases: valid access tokens
CVE-2022-31685: VMware Workspace ONE Assist prior to 22.10 contains an Authentication Bypass vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
Key phrases: Authentication Bypass, obtain administrative access, authentication bypass
CVE-2022-31686: VMware Workspace ONE Assist prior to 22.10 contains a Broken Authentication Method vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
Key phrases: obtain administrative access, broken authentication method
CVE-2022-31687: VMware Workspace ONE Assist prior to 22.10 contains a Broken Access Control vulnerability. A malicious actor with network access to Workspace ONE Assist may be able to obtain administrative access without the need to authenticate to the application.
Key phrases: obtain administrative access, broken access control
CVE-2022-31688: VMware Workspace ONE Assist prior to 22.10 contains a Reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-31689: VMware Workspace ONE Assist prior to 22.10 contains a Session fixation vulnerability. A malicious actor who obtains a valid session token may be able to authenticate to the application using that token.
Key phrases: session fixation
CVE-2022-3169: A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect.
Key phrases: denial of service flaw, pcie link disconnect
CVE-2022-31690: Spring Security, versions 5.7 prior to 5.7.5, and 5.6 prior to 5.6.9, and older unsupported versions could be susceptible to a privilege escalation under certain conditions. A malicious user or attacker can modify a request initiated by the Client (via the browser) to the Authorization Server which can lead to a privilege escalation on the subsequent approval. This scenario can happen if the Authorization Server responds with an OAuth2 Access Token Response containing an empty scope list (per RFC 6749, Section 5.1) on the subsequent request to the token endpoint to obtain the access token.
Key phrases: obtain the access, privilege escalation
CVE-2022-31691: Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML that under certain circumstances allows for potentially harmful remote code execution by the attacker.
Key phrases: for some special syntax in the YAML that, for potentially harmful remote code execution by the
CVE-2022-31692: Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass via forward or include dispatcher types. Specifically, an application is vulnerable when all of the following are true: The application expects that Spring Security applies security to forward and include dispatcher types. The application uses the AuthorizationFilter either manually or via the authorizeHttpRequests() method. The application configures the FilterChainProxy to apply to forward and/or include requests (e.g. spring.security.filter.dispatcher-types = request, error, async, forward, include). The application may forward or include the request to a higher privilege-secured endpoint.The application configures Spring Security to apply to every dispatcher type via authorizeHttpRequests().shouldFilterAllDispatcherTypes(true)
Key phrases: bypass via forward or include dispatcher types. Specifically, authorization rules bypass
CVE-2022-31693: VMware Tools for Windows (12.x.y prior to 12.1.5, 11.x.y and 10.x.y) contains a denial-of-service vulnerability in the VM3DMP driver. A malicious actor with local user privileges in the Windows guest OS, where VMware Tools is installed, can trigger a PANIC in the VM3DMP driver leading to a denial-of-service condition in the Windows guest OS.
Key phrases: denial-of-service, denial of service
CVE-2022-31694: InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may allow an attacker to plant a malicious DLL in the installer parent directory to allow executing code with the privileges of the installer (when the popup triggers the loading of the library). Exploiting these type of vulnerabilities generally require that an attacker has access to a vulnerable machine to plant the malicious DLL.
Key phrases: plant a malicious DLL in the installer parent, a vulnerable machine to plant the malicious DLL, execute code
CVE-2022-31696: VMware ESXi contains a memory corruption vulnerability that exists in the way it handles a network socket. A malicious actor with local access to ESXi may exploit this issue to corrupt memory leading to an escape of the ESXi sandbox.
Key phrases: memory corruption, escape, corrupt memory
CVE-2022-31697: The vCenter Server contains an information disclosure vulnerability due to the logging of credentials in plaintext. A malicious actor with access to a workstation that invoked a vCenter Server Appliance ISO operation (Install/Upgrade/Migrate/Restore) can access plaintext passwords used during that operation.
Key phrases: information disclosure
CVE-2022-31698: The vCenter Server contains a denial-of-service vulnerability in the content library service. A malicious actor with network access to port 443 on vCenter Server may exploit this issue to trigger a denial-of-service condition by sending a specially crafted header.
Key phrases: denial-of-service, denial of service
CVE-2022-31699: VMware ESXi contains a heap-overflow vulnerability. A malicious local actor with restricted privileges within a sandbox process may exploit this issue to achieve a partial information disclosure.
Key phrases: heap-overflow, partial information disclosure, heap overflow
CVE-2022-3170: An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\\\\0'. A privileged local user could pass a specially crafted name through ioctl() interface and crash the system or potentially escalate their privileges on the system.
Key phrases: out-of-bounds access issue, crash the system, out of bounds access, crash system, escalate privilege
CVE-2022-31700: VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
Key phrases: remote code execution
CVE-2022-31701: VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 5.3.
Key phrases: authentication
CVE-2022-31702: vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network access to the vRNI REST API can execute commands without authentication.
Key phrases: command injection, execute commands
CVE-2022-31703: The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
Key phrases: directory traversal, impacted appliance, remote code execution
CVE-2022-31704: The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into sensitive files of an impacted appliance which can result in remote code execution.
Key phrases: broken access control, impacted appliance, remote code execution
CVE-2022-31705: VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor with local administrative privileges on a virtual machine may exploit this issue to execute code as the virtual machine's VMX process running on the host. On ESXi, the exploitation is contained within the VMX sandbox whereas, on Workstation and Fusion, this may lead to code execution on the machine where Workstation or Fusion is installed.
Key phrases: heap out-of-bounds write, code execution, out of bounds write, execute code
CVE-2022-31706: The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operating system of an impacted appliance which can result in remote code execution.
Key phrases: directory traversal, impacted appliance, remote code execution
CVE-2022-31707: vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.
Key phrases: privilege escalation
CVE-2022-31708: vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Moderate severity range with a maximum CVSSv3 base score of 4.4.
Key phrases: broken access control
CVE-2022-3171: A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Key phrases: garbage collection pauses, denial of service
CVE-2022-31710: vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization of untrusted data which could result in a denial of service.
Key phrases: deserialization, denial of service, deserialization of untrusted data
CVE-2022-31711: VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and application information without authentication.
Key phrases: information disclosure
CVE-2022-3172: A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL.  This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties.
Key phrases: redirect client traffic to any URL, security issue, unexpected actions
CVE-2022-3173: Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10.
Key phrases: improper authentication
CVE-2022-31733: Starting with diego-release 2.55.0 and up to 2.69.0, and starting with CF Deployment 17.1 and up to 23.2.0, apps are accessible via another port on diego cells, allowing application ingress without a client certificate. If mTLS route integrity is enabled AND unproxied ports are turned off, then an attacker could connect to an application that should be only reachable via mTLS, without presenting a client certificate.
Key phrases: an application that should be only reachable via, unproxied ports, integrity
CVE-2022-31734: Cisco Catalyst 2940 Series Switches provided by Cisco Systems, Inc. contain a reflected cross-site scripting vulnerability regarding error page generation. An arbitrary script may be executed on the web browser of the user who is using the product. The affected firmware is prior to 12.2(50)SY released in 2011, and Cisco Catalyst 2940 Series Switches have been retired since January 2015
Key phrases: cross-site scripting, arbitrary script
CVE-2022-31735: OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability (CWE-601). When accessing an affected server through some specially crafted URL, the user may be redirected to an arbitrary website.
Key phrases: open redirect
CVE-2022-31736: A malicious website could have learned the size of a cross-origin resource that supported Range requests. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Key phrases: cross-origin resource, range requests
CVE-2022-31737: A malicious webpage could have caused an out-of-bounds write in WebGL, leading to memory corruption and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Key phrases: out-of-bounds write, memory corruption, exploitable crash, out of bounds write
CVE-2022-31738: When exiting fullscreen mode, an iframe could have confused the browser about the current state of fullscreen, resulting in potential user confusion or spoofing attacks. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Key phrases: iframe, user confusion, spoofing
CVE-2022-31739: When downloading files on Windows, the % character was not escaped, which could have lead to a download incorrectly being saved to attacker-influenced paths that used variables such as %HOMEPATH% or %APPDATA%.<br>*This bug only affects Firefox for Windows. Other operating systems are unaffected.*. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
CVE-2022-3174: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2.
Key phrases: sensitive cookie
CVE-2022-31740: On arm64, WASM code could have resulted in incorrect assembly generation leading to a register allocation problem, and a potentially exploitable crash. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Key phrases: register allocation problem, exploitable crash
CVE-2022-31741: A crafted CMS message could have been processed incorrectly, leading to an invalid memory read, and potentially further memory corruption. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Key phrases: invalid memory read, memory corruption
CVE-2022-31742: An attacker could have exploited a timing attack by sending a large number of allowCredential entries and detecting the difference between invalid key handles and cross-origin key handles. This could have led to cross-origin account linking in violation of WebAuthn goals. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Key phrases: timing attack, invalid key handles, cross-origin key handles, cross-origin account linking
CVE-2022-31743: Firefox's HTML parser did not correctly interpret HTML comment tags, resulting in an incongruity with other browsers. This could have been used to escape HTML comments on pages that put user-controlled data in them. This vulnerability affects Firefox < 101.
CVE-2022-31744: An attacker could have injected CSS into stylesheets accessible via internal URIs, such as resource:, and in doing so bypass a page's Content Security Policy. This vulnerability affects Firefox ESR < 91.11, Thunderbird < 102, Thunderbird < 91.11, and Firefox < 101.
Key phrases: bypass a page
CVE-2022-31745: If array shift operations are not used, the Garbage Collector may have become confused about valid objects. This vulnerability affects Firefox < 101.
CVE-2022-31746: Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header. This vulnerability affects Firefox for iOS < 102.
Key phrases: internal urls
CVE-2022-31747: Mozilla developers Andrew McCreight, Nicolas B. Pierron, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100 and Firefox ESR 91.9. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Thunderbird < 91.10, Firefox < 101, and Firefox ESR < 91.10.
Key phrases: run arbitrary code, memory safety bugs, memory corruption
CVE-2022-31748: Mozilla developers Gabriele Svelto, Timothy Nikkel, Randell Jesup, Jon Coppeard, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 100. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 101.
Key phrases: run arbitrary code, memory safety bugs, memory corruption
CVE-2022-3175: Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2.
Key phrases: missing custom error page
CVE-2022-31751: The kernel emcom module has multi-thread contention. Successful exploitation of this vulnerability may affect system availability.
Key phrases: multi-thread contention, system availability
CVE-2022-31752: Missing authorization vulnerability in the system components. Successful exploitation of this vulnerability will affect confidentiality.
Key phrases: authorization, affect confidentiality, missing authorization
CVE-2022-31753: The voice wakeup module has a vulnerability of using externally-controlled format strings. Successful exploitation of this vulnerability may affect system availability.
Key phrases: voice wakeup module, externally-controlled format strings, system availability
CVE-2022-31754: Logical defects in code implementation in some products. Successful exploitation of this vulnerability may affect the availability of some features.
Key phrases: logical defects, availability of some features
CVE-2022-31755: The communication module has a vulnerability of improper permission preservation. Successful exploitation of this vulnerability may affect system availability.
Key phrases: improper permission preservation, system availability, improper permissions
CVE-2022-31756: The fingerprint sensor module has design defects. Successful exploitation of this vulnerability may affect data confidentiality.
Key phrases: design defects, data confidentiality
CVE-2022-31757: The setting module has a vulnerability of improper use of APIs. Successful exploitation of this vulnerability may affect data confidentiality.
Key phrases: setting module, improper use of apis, data confidentiality
CVE-2022-31758: The kernel module has the race condition vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
Key phrases: race condition, data confidentiality
CVE-2022-31759: AppLink has a vulnerability of accessing uninitialized pointers. Successful exploitation of this vulnerability may affect system availability.
Key phrases: applink, uninitialized pointers, system availability
CVE-2022-3176: There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659
Key phrases: occur if a signalfd or binder fd is, use-after-free, use after free
CVE-2022-31760: Dialog boxes can still be displayed even if the screen is locked in carrier-customized USSD services. Successful exploitation of this vulnerability may affect data integrity and confidentiality.
Key phrases: dialog boxes, data integrity, confidentiality
CVE-2022-31761: Configuration defects in the secure OS module. Successful exploitation of this vulnerability will affect confidentiality.
Key phrases: configuration defects, affect confidentiality
CVE-2022-31762: The AMS module has a vulnerability in input validation. Successful exploitation of this vulnerability may cause privilege escalation.
Key phrases: ams module, input validation, privilege escalation
CVE-2022-31763: The kernel module has the null pointer and out-of-bounds array vulnerabilities. Successful exploitation of this vulnerability may affect system availability.
Key phrases: null pointer, out-of-bounds array, system availability
CVE-2022-31765: Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges.
Key phrases: escalate their privileges, escalate privilege
CVE-2022-31766: A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (All versions < V7.1.2), RUGGEDCOM RM1224 LTE(4G) NAM (All versions < V7.1.2), SCALANCE M804PB (All versions < V7.1.2), SCALANCE M812-1 ADSL-Router (Annex A) (All versions < V7.1.2), SCALANCE M812-1 ADSL-Router (Annex B) (All versions < V7.1.2), SCALANCE M816-1 ADSL-Router (Annex A) (All versions < V7.1.2), SCALANCE M816-1 ADSL-Router (Annex B) (All versions < V7.1.2), SCALANCE M826-2 SHDSL-Router (All versions < V7.1.2), SCALANCE M874-2 (All versions < V7.1.2), SCALANCE M874-3 (All versions < V7.1.2), SCALANCE M876-3 (EVDO) (All versions < V7.1.2), SCALANCE M876-3 (ROK) (All versions < V7.1.2), SCALANCE M876-4 (All versions < V7.1.2), SCALANCE M876-4 (EU) (All versions < V7.1.2), SCALANCE M876-4 (NAM) (All versions < V7.1.2), SCALANCE MUM853-1 (EU) (All versions < V7.1.2), SCALANCE MUM856-1 (EU) (All versions < V7.1.2), SCALANCE MUM856-1 (RoW) (All versions < V7.1.2), SCALANCE S615 (All versions < V7.1.2), SCALANCE S615 EEC (All versions < V7.1.2), SCALANCE WAM763-1 (All versions >= V1.1.0 < V2.0), SCALANCE WAM766-1 (EU) (All versions >= V1.1.0 < V2.0), SCALANCE WAM766-1 (US) (All versions >= V1.1.0 < V2.0), SCALANCE WAM766-1 EEC (EU) (All versions >= V1.1.0 < V2.0), SCALANCE WAM766-1 EEC (US) (All versions >= V1.1.0 < V2.0), SCALANCE WUM763-1 (All versions >= V1.1.0 < V2.0), SCALANCE WUM763-1 (All versions >= V1.1.0 < V2.0), SCALANCE WUM766-1 (EU) (All versions >= V1.1.0 < V2.0), SCALANCE WUM766-1 (US) (All versions >= V1.1.0 < V2.0). Affected devices with TCP Event service enabled do not properly handle malformed packets.This could allow an unauthenticated remote attacker to cause a denial of service condition and reboot the device thus possibly affecting other network resources.
Key phrases: cause a denial of service condition and reboot
CVE-2022-31767: IBM CICS TX Standard and Advanced 11.1 could allow a remote attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-Force ID: 227980.
Key phrases: execute arbitrary commands, execute arbitrary commands on the system by sending
CVE-2022-31768: IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.
Key phrases: view, sql injection
CVE-2022-31769: IBM Spectrum Copy Data Management 2.2.0.0 through 2.2.15.0 could allow a remote attacker to view product configuration information stored in PostgreSQL, which could be used in further attacks against the system. IBM X-Force ID: 228219.
Key phrases: view product configuration information stored in PostgreSQL
CVE-2022-31770: IBM App Connect Enterprise Certified Container 4.2 could allow a user from the administration console to cause a denial of service by creating a specially crafted request. IBM X-Force ID: 228221.
Key phrases: cause a denial of service by creating a
CVE-2022-31772: IBM MQ 8.0, 9.0 LTS, 9.1 CD, 9.1 LTS, 9.2 CD, and 9.2 LTS could allow an authenticated and authorized user to cause a denial of service to the MQTT channels. IBM X-Force ID: 228335.
Key phrases: cause a denial of service to the MQTT
CVE-2022-31773: IBM DataPower Gateway V10CD, 10.0.1, and 2018.4.1 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 228357.
Key phrases: execute malicious and unauthorized actions transmitted from a, cross-site request forgery, cross site request forgery
CVE-2022-31774: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 228358.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2022-31775: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources. IBM X-Force ID: 228359.
Key phrases: xml external entity injection (xxe), consume memory resources, sensitive information
CVE-2022-31776: IBM DataPower Gateway 10.0.2.0 through 10.0.4.0, 10.0.1.0 through 10.0.1.8, 10.5.0.0, and 2018.4.1.0 through 2018.4.1.21 is vulnerable to server-side request forgery (SSRF). This may allow an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. IBM X-Force ID: 228433.
Key phrases: send unauthorized requests from the system, server-side request forgery (ssrf), network enumeration, server side request forgery
CVE-2022-31777: A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a malicious payload into the logs which would be returned in logs rendered in the UI.
Key phrases: execute arbitrary JavaScript, execute arbitrary JavaScript in the web browser of, stored cross-site scripting (xss), malicious payload
CVE-2022-31778: Improper Input Validation vulnerability in handling the Transfer-Encoding header of Apache Traffic Server allows an attacker to poison the cache. This issue affects Apache Traffic Server 8.0.0 to 9.0.2.
Key phrases: poison the cache, improper input validation
CVE-2022-31779: Improper Input Validation vulnerability in HTTP/2 header parsing of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Key phrases: smuggle requests, improper input validation
CVE-2022-3178: Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV.
Key phrases: buffer over-read
CVE-2022-31780: Improper Input Validation vulnerability in HTTP/2 frame handling of Apache Traffic Server allows an attacker to smuggle requests. This issue affects Apache Traffic Server 8.0.0 to 9.1.2.
Key phrases: smuggle requests, improper input validation
CVE-2022-31781: Apache Tapestry up to version 5.8.1 is vulnerable to Regular Expression Denial of Service (ReDoS) in the way it handles Content Types. Specially crafted Content Types may cause catastrophic backtracking, taking exponential time to complete. Specifically, this is about the regular expression used on the parameter of the org.apache.tapestry5.http.ContentType class. Apache Tapestry 5.8.2 has a fix for this vulnerability. Notice the vulnerability cannot be triggered by web requests in Tapestry code alone. It would only happen if there's some non-Tapestry codepath passing some outside input to the ContentType class constructor.
Key phrases: Denial of Service (ReDoS), regular expression denial of service (redos)
CVE-2022-31782: ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2022-31783: Liblouis 3.21.0 has an out-of-bounds write in compileRule in compileTranslationTable.c, as demonstrated by lou_trace.
Key phrases: out-of-bounds write, out of bounds write
CVE-2022-31784: A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker (that has network access to the management interface) to conduct a buffer overflow attack due to insufficient validation of URL parameters. A successful exploit could allow arbitrary code execution.
Key phrases: allow arbitrary code execution, the management interface) to conduct a buffer, buffer overflow
CVE-2022-31786: IdeaLMS 2022 allows reflected Cross Site Scripting (XSS) via the IdeaLMS/Class/Assessment/ PATH_INFO.
Key phrases: reflected Cross Site Scripting (XSS) via, cross site scripting (xss)
CVE-2022-31787: IdeaTMS 2022 is vulnerable to SQL Injection via the PATH_INFO
Key phrases: sql injection
CVE-2022-31788: IdeaLMS 2022 allows SQL injection via the IdeaLMS/ChatRoom/ClassAccessControl/6?isBigBlueButton=0&ClassID= pathname.
Key phrases: SQL injection via the IdeaLMS/ChatRoom/, sql injection
CVE-2022-31789: An integer overflow in WatchGuard Firebox and XTM appliances allows an unauthenticated remote attacker to trigger a buffer overflow and potentially execute arbitrary code by sending a malicious request to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
Key phrases: execute arbitrary code, trigger a buffer overflow and potentially execute arbitrary, integer overflow, malicious request
CVE-2022-3179: Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2.
Key phrases: weak password requirements
CVE-2022-31790: WatchGuard Firebox and XTM appliances allow an unauthenticated remote attacker to retrieve sensitive authentication server settings by sending a malicious request to exposed authentication endpoints. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
Key phrases: retrieve sensitive authentication server settings by sending a, exposed authentication endpoints
CVE-2022-31791: WatchGuard Firebox and XTM appliances allow a local attacker (that has already obtained shell access) to elevate their privileges and execute code with root permissions. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
Key phrases: elevate their privileges and execute code with root, shell access, elevate privileges
CVE-2022-31792: A stored cross-site scripting (XSS) vulnerability exists in the management web interface of WatchGuard Firebox and XTM appliances. A remote attacker can potentially execute arbitrary JavaScript code in the management web interface by sending crafted requests to exposed management ports. This is fixed in Fireware OS 12.8.1, 12.5.10, and 12.1.4.
Key phrases: execute arbitrary JavaScript code, stored cross-site scripting (xss)
CVE-2022-31793: do_request in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and NVG510 devices and Arris-derived BGW210 and BGW320 devices are affected.
Key phrases: read arbitrary files, read arbitrary files by constructing a URL with
CVE-2022-31794: An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the requestTempFile function in hw_view.php. An attacker is able to influence the unitName POST parameter and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.
Key phrases: execute arbitrary commands, command-substitution sequences
CVE-2022-31795: An issue was discovered on Fujitsu ETERNUS CentricStor CS8000 (Control Center) devices before 8.1A SP02 P04. The vulnerability resides in the grel_finfo function in grel.php. An attacker is able to influence the username (user), password (pw), and file-name (file) parameters and inject special characters such as semicolons, backticks, or command-substitution sequences in order to force the application to execute arbitrary commands.
Key phrases: execute arbitrary commands, command-substitution sequences
CVE-2022-31796: libjpeg 1.63 has a heap-based buffer over-read in HierarchicalBitmapRequester::FetchRegion in hierarchicalbitmaprequester.cpp because the MCU size can be different between allocation and use.
Key phrases: heap-based buffer over-read, buffer over read
CVE-2022-31798: Nortek Linear eMerge E3-Series 0.32-07p devices are vulnerable to /card_scan.php?CardFormatNo= XSS with session fixation (via PHPSESSID) when they are chained together. This would allow an attacker to take over an admin account or a user account.
Key phrases: take over an admin account or a user, xss, session fixation
CVE-2022-31799: Bottle before 0.12.20 mishandles errors during early request binding.
CVE-2022-31800: An unauthenticated, remote attacker could upload malicious logic to devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
Key phrases: gain full control, malicious logic
CVE-2022-31801: An unauthenticated, remote attacker could upload malicious logic to the devices based on ProConOS/ProConOS eCLR in order to gain full control over the device.
Key phrases: gain full control, malicious logic
CVE-2022-31802: In CODESYS Gateway Server V2 for versions prior to V2.3.9.38 only a part of the the specified password is been compared to the real CODESYS Gateway password. An attacker may perform authentication by specifying a small password that matches the corresponding part of the longer real CODESYS Gateway password.
CVE-2022-31803: In CODESYS Gateway Server V2 an insufficient check for the activity of TCP client connections allows an unauthenticated attacker to consume all available TCP connections and prevent legitimate users or clients from establishing a new connection to the CODESYS Gateway Server V2. Existing connections are not affected and therefore remain intact.
Key phrases: consume all available TCP connections and prevent legitimate, insufficient check
CVE-2022-31804: The CODESYS Gateway Server V2 does not verifiy that the size of a request is within expected limits. An unauthenticated attacker may allocate an arbitrary amount of memory, which may lead to a crash of the Gateway due to an out-of-memory condition.
Key phrases: arbitrary amount of memory, crash, out-of-memory condition
CVE-2022-31805: In the CODESYS Development System multiple components in multiple versions transmit the passwords for the communication between clients and servers unprotected.
Key phrases: unprotected
CVE-2022-31806: In CODESYS V2 PLCWinNT and Runtime Toolkit 32 in versions prior to V2.4.7.57 password protection is not enabled by default and there is no information or prompt to enable password protection at login in case no password is set at the controller.
CVE-2022-31808: A vulnerability has been identified in SiPass integrated AC5102 (ACC-G2) (All versions < V2.85.44), SiPass integrated ACC-AP (All versions < V2.85.43). Affected devices improperly sanitize user input on the telnet command line interface.This could allow an authenticated user to escalate privileges by injecting arbitrary commands that are executed with root privileges.
Key phrases: injecting arbitrary commands, escalate privileges by injecting arbitrary commands that are, root privilege
CVE-2022-3181: An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior.A specifically malformed HTTP request could cause the affected VTScada to crash. Both local area network (LAN)-only and internet facing systems are affected. 
Key phrases: improper input validation, crash
CVE-2022-31810: A vulnerability has been identified in SiPass integrated (All versions < V2.90.3.8). Affected server applications improperly check the size of data packets received for the configuration client login, causing a stack-based buffer overflow.This could allow an unauthenticated remote attacker to crash the server application, creating a denial of service condition.
Key phrases: crash the server application, stack-based buffer overflow, denial of service condition
CVE-2022-31813: Apache HTTP Server 2.4.53 and earlier may not send the X-Forwarded-* headers to the origin server based on client side Connection header hop-by-hop mechanism. This may be used to bypass IP based authentication on the origin server/application.
Key phrases: bypass IP based authentication
CVE-2022-31814: pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. NOTE: 3.x is unaffected.
Key phrases: execute arbitrary OS commands, execute arbitrary OS commands as root via shell, shell metacharacters, arbitrary os command
CVE-2022-3182: Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the application lock. This issue affects: Devolutions Remote Desktop Manager version 2022.2.14 and prior versions.
Key phrases: bypass the application lock, improper access control
CVE-2022-31827: MonstaFTP v2.10.3 was discovered to contain a Server-Side Request Forgery (SSRF) via the function performFetchRequest at HTTPFetcher.php.
Key phrases: server-side request forgery (ssrf)
CVE-2022-3183: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerabilitywhere a specificfunction does not sanitize the input provided by the user, which may expose the affected to an OS command injection vulnerability. 
Key phrases: os command injection
CVE-2022-31830: Kity Minder v1.3.5 was discovered to contain a Server-Side Request Forgery (SSRF) via the init function at ImageCapture.class.php.
Key phrases: server-side request forgery (ssrf)
CVE-2022-31836: The leafInfo.match() function in Beego v2.0.3 and below uses path.join() to deal with wildcardvalues which can lead to cross directory risk.
Key phrases: cross directory risk
CVE-2022-3184: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerabilitywhere the devices existing firmware allows unauthenticated users to access an old PHP page vulnerable to directory traversal, which may allow a user to write a file to the webroot directory. 
Key phrases: access an old PHP page vulnerable to directory, write a file to the webroot directory, directory traversal, to write files
CVE-2022-31845: A vulnerability in live_check.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.
Key phrases: obtain sensitive router information, obtain sensitive router information via execution of the
CVE-2022-31846: A vulnerability in live_mfg.shtml of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to obtain sensitive router information via execution of the exec cmd function.
Key phrases: obtain sensitive router information, obtain sensitive router information via execution of the, live_mfg.shtml
CVE-2022-31847: A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN579 X3 M79X3.V5030.180719 allows attackers to obtain sensitive router information via a crafted POST request.
Key phrases: obtain sensitive router information, obtain sensitive router information via a crafted POST, cgi-bin exportallsettings.sh
CVE-2022-31849: MERCURY MIPC451-4 1.0.22 Build 220105 Rel.55642n was discovered to contain a remote code execution (RCE) vulnerability which is exploitable via a crafted POST request.
Key phrases: remote code execution (rce)
CVE-2022-3185: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerabilitywhere theaffected product exposes sensitive data concerning the device.
CVE-2022-31854: Codoforum v5.1 was discovered to contain an arbitrary file upload vulnerability via the logo change option in the admin panel.
Key phrases: arbitrary file upload
CVE-2022-31856: Newsletter Module v3.x was discovered to contain a SQL injection vulnerability via the zemez_newsletter_email parameter at /index.php.
Key phrases: sql injection
CVE-2022-3186: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerabilitywhere theaffected product allows an attacker to access the devices main management page from the cloud. This feature enables users to remotely connect devices, however, the current implementation permits users to access other device's information.
Key phrases: access the devices main management page from the
CVE-2022-31860: An issue was discovered in OpenRemote through 1.0.4 allows attackers to execute arbitrary code via a crafted Groovy rule.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted Groovy rule
CVE-2022-31861: Cross site Scripting (XSS) in ThingsBoard IoT Platform through 3.3.4.1 via a crafted value being sent to the audit logs.
Key phrases: cross site scripting (xss)
CVE-2022-3187: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerabilitywhere certain PHP pages only validate when a valid connection is established with the database. However, these PHP pages do not verify the validity of a user. Attackers could leverage this lack of verification to read the state of outlets. 
Key phrases: state of outlets
CVE-2022-31873: Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an XSS vulnerability via the prefix parameter in /admin/general.cgi.
Key phrases: xss
CVE-2022-31874: ASUS RT-N53 3.0.0.4.376.3754 has a command injection vulnerability in the SystemCmd parameter of the apply.cgi interface.
Key phrases: command injection
CVE-2022-31875: Trendnet IP-110wn camera fw_tv-ip110wn_v2(1.2.2.68) has an xss vulnerability via the proname parameter in /admin/scheprofile.cgi
Key phrases: xss
CVE-2022-31876: netgear wnap320 router WNAP320_V2.0.3_firmware is vulnerable to Incorrect Access Control via /recreate.php, which can leak all users cookies.
Key phrases: incorrect access control, leak all users cookies
CVE-2022-31877: An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate privileges via a crafted TCP packet.
Key phrases: escalate privileges via a crafted TCP packet
CVE-2022-31879: Online Fire Reporting System 1.0 is vulnerable to SQL Injection via the date parameter.
Key phrases: sql injection
CVE-2022-3188: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerabilitywhere unauthenticated users could open PHP index pages without authentication and download the history file from the device; the history file includes the latest actions completed by specific users.
CVE-2022-31883: Marval MSM v14.19.0.12476 is has an Insecure Direct Object Reference (IDOR) vulnerability. A low privilege user is able to see other users API Keys including the Admins API Keys.
Key phrases: insecure direct object reference (idor)
CVE-2022-31884: Marval MSM v14.19.0.12476 has an Improper Access Control vulnerability which allows a low privilege user to delete other users API Keys including high privilege and the Administrator users API Keys.
Key phrases: delete other users API Keys including high privilege, improper access control
CVE-2022-31885: Marval MSM v14.19.0.12476 is vulnerable to OS Command Injection due to the insecure handling of VBScripts.
Key phrases: os command injection
CVE-2022-31886: Marval MSM v14.19.0.12476 is vulnerable to Cross Site Request Forgery (CSRF). An attacker can disable the 2FA by sending the user a malicious form.
Key phrases: cross site request forgery (csrf)
CVE-2022-31887: Marval MSM v14.19.0.12476 has a 0-Click Account Takeover vulnerability which allows an attacker to change any user's password in the organization, this means that the user can also escalate achieve Privilege Escalation by changing the administrator password.
Key phrases: change any user's password in the organization, account takeover, privilege escalation
CVE-2022-31888: Session Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.
Key phrases: session fixation
CVE-2022-31889: Cross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae.
Key phrases: cross site scripting (xss)
CVE-2022-3189: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerabilitywhere aspecially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a request to the host or IP specified in the changed host parameter. 
Key phrases: php script
CVE-2022-31890: SQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit a7842d494889fd5533d13deb3c6a7789768795ae via the order parameter to the getOrder function.
Key phrases: sql injection
CVE-2022-31897: SourceCodester Zoo Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via public_html/register_visitor?msg=.
Key phrases: cross site scripting (xss)
CVE-2022-31898: gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the ping_addr and trace_addr function parameters.
Key phrases: command injection
CVE-2022-3190: Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via packet injection or crafted capture file
Key phrases: denial of service via packet injection or crafted, infinite loop
CVE-2022-31901: Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two crafted files.
Key phrases: crash the application via two crafted files, buffer overflow
CVE-2022-31902: Notepad++ v8.4.1 was discovered to contain a stack overflow via the component Finder::add().
Key phrases: stack overflow
CVE-2022-31904: EGT-Kommunikationstechnik UG Mediacenter before v2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Online_Update.php.
Key phrases: cross-site scripting (xss)
CVE-2022-31906: Online Fire Reporting System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ofrs/classes/Master.php.
Key phrases: cross site scripting (xss)
CVE-2022-31908: Student Registration and Fee Payment System v1.0 is vulnerable to SQL Injection via /scms/student.php.
Key phrases: sql injection
CVE-2022-3191: Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Analyzer on Linux (Virtual Strage Software Agent component) allows local users to gain sensitive information.This issue affects Hitachi Ops Center Analyzer: from 10.8.1-00 before 10.9.0-00
Key phrases: gain sensitive information
CVE-2022-31910: Online Tutor Portal Site v1.0 is vulnerable to Cross Site Scripting (XSS). via /otps/classes/Master.php.
Key phrases: cross site scripting (xss)
CVE-2022-31911: Online Discussion Forum Site v1.0 is vulnerable to SQL Injection via /odfs/classes/Master.php?f=delete_team.
Key phrases: sql injection
CVE-2022-31912: Online Tutor Portal Site v1.0 is vulnerable to SQL Injection via /otps/classes/Master.php?f=delete_team.
Key phrases: sql injection
CVE-2022-31913: Online Discussion Forum Site v1.0 is vulnerable to Cross Site Scripting (XSS) via /odfs/classes/Master.php?f=save_category, name.
Key phrases: cross site scripting (xss)
CVE-2022-31914: Zoo Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via zms/admin/public_html/save_animal?an_id=24.
Key phrases: cross site scripting (xss)