yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-33180: A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5 could allow a local authenticated attacker to export out sensitive files with seccryptocfg, configupload.
Key phrases: export out sensitive files with seccryptocfg
CVE-2022-33181: An information disclosure vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a local authenticated attacker to read sensitive files using switch commands configshow and supportlink.
Key phrases: read sensitive files using switch commands configshow and, information disclosure
CVE-2022-33182: A privilege escalation vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, could allow a local authenticated user to escalate its privilege to root using switch commands supportlink, firmwaredownload, portcfgupload, license, and fosexec.
Key phrases: escalate its privilege to root using switch commands, privilege escalation, escalate privilege
CVE-2022-33183: A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, 8.2.0cbn5, 7.4.2.j could allow a remote authenticated attacker to perform stack buffer overflow using in firmwaredownload and diagshow commands.
Key phrases: perform stack buffer overflow using in firmwaredownload and
CVE-2022-33184: A vulnerability in fab_seg.c.h libraries of all Brocade Fabric OS versions before Brocade Fabric OS v9.1.1, v9.0.1e, v8.2.3c, v8.2.0_cbn5, 7.4.2j could allow local authenticated attackers to exploit stack-based buffer overflows and execute arbitrary code as the root user account.
Key phrases: execute arbitrary code, exploit stack-based buffer overflows and execute, stack based buffer overflow
CVE-2022-33185: Several commands in Brocade Fabric OS before Brocade Fabric OS v.9.0.1e, and v9.1.0 use unsafe string functions to process user input. Authenticated local attackers could abuse these vulnerabilities to exploit stack-based buffer overflows, allowing arbitrary code execution as the root user account.
Key phrases: allowing arbitrary code execution, arbitrary code execution as the root user account, stack-based buffer overflows, stack based buffer overflow
CVE-2022-33186: A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling the switch, disabling ports, and modifying the switch IP address.
Key phrases: execute on a Brocade Fabric OS switch commands
CVE-2022-33187: Brocade SANnav before v2.2.1 logs usernames and encoded passwords in debug-enabled logs. The vulnerability could allow an attacker with admin privilege to read sensitive information.
Key phrases: read sensitive information
CVE-2022-33189: An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-crafted XCMD can lead to arbitrary command execution. An attacker can send a malicious XML payload to trigger this vulnerability.
Key phrases: os command injection, malicious xml payload, arbitrary commands, arbitrary command execution
CVE-2022-33190: Improper input validation in the Intel(R) SUR software before version 2.4.8902 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2022-33191: Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Chinmoy Paul's Testimonials plugin <= 3.0.1 at WordPress.
Key phrases: stored cross-site scripting (xss)
CVE-2022-33192: Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability specifically focuses on the unsafe use of the `WL_SSID` and `WL_SSID_HEX` configuration values in the function at offset `0x1c7d28` of firmware 6.9Z.
Key phrases: os command injection, malicious commands, arbitrary commands, arbitrary command execution
CVE-2022-33193: Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability specifically focuses on the unsafe use of the `WL_WPAPSK` configuration value in the function located at offset `0x1c7d28` of firmware 6.9Z.
Key phrases: os command injection, malicious commands, arbitrary commands, arbitrary command execution
CVE-2022-33194: Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `WL_Key` and `WL_DefaultKeyID` configuration values in the function located at offset `0x1c7d28` of firmware 6.9Z , and even more specifically on the command execution occuring at offset `0x1c7f6c`.
Key phrases: os command injection, malicious commands, arbitrary commands, arbitrary command execution
CVE-2022-33195: Four OS command injection vulnerabilities exist in the XCMD testWifiAP functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A XCMD can lead to arbitrary command execution. An attacker can send a sequence of malicious commands to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `WL_DefaultKeyID` in the function located at offset `0x1c7d28` of firmware 6.9Z, and even more specifically on the command execution occuring at offset `0x1c7fac`.
Key phrases: os command injection, malicious commands, arbitrary commands, arbitrary command execution
CVE-2022-33196: Incorrect default permissions in some memory controller configurations for some Intel(R) Xeon(R) Processors when using Intel(R) Software Guard Extensions which may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, incorrect default permissions, escalation privilege
CVE-2022-33198: Unauthenticated WordPress Options Change vulnerability in Biplob Adhikari's Accordions plugin <= 2.0.2 at WordPress.
Key phrases: unauthenticated wordpress options change
CVE-2022-3320: It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restrictions on a Zero Trust enrolled endpoint. 
Key phrases: bypass policies, unreachable endpoint, disconnect
CVE-2022-33201: Cross-Site Request Forgery (CSRF) vulnerability in MailerLite  Signup forms (official) plugin <= 1.5.7 at WordPress allows an attacker to change the API key.
Key phrases: change the API key, cross-site request forgery (csrf)
CVE-2022-33202: Authentication bypass vulnerability in the setup screen of L2Blocker(on-premise) Ver4.8.5 and earlier and L2Blocker(Cloud) Ver4.8.5 and earlier allows an adjacent attacker to perform an unauthorized login and obtain the stored information or cause a malfunction of the device by using alternative paths or channels for Sensor.
Key phrases: Authentication bypass, obtain the stored information, perform an unauthorized login and obtain the stored, authentication bypass, malfunction
CVE-2022-33203: In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when a BIG-IP APM access policy with Service Connect agent is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: undisclosed requests, increase in memory resource utilization
CVE-2022-33204: Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `ssid_hex` HTTP parameter to construct an OS Command at offset `0x19afc0` of the `/root/hpgw` binary included in firmware 6.9Z.
Key phrases: os command injection, http request, arbitrary command execution, arbitrary commands
CVE-2022-33205: Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `wpapsk_hex` HTTP parameter to construct an OS Command at offset `0x19b0ac` of the `/root/hpgw` binary included in firmware 6.9Z.
Key phrases: os command injection, http request, arbitrary command execution, arbitrary commands
CVE-2022-33206: Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on the unsafe use of the `key` and `default_key_id` HTTP parameters to construct an OS Command crafted at offset `0x19b1f4` of the `/root/hpgw` binary included in firmware 6.9Z.
Key phrases: os command injection, http request, arbitrary command execution, arbitrary commands
CVE-2022-33207: Four OS command injection vulnerabilities exists in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger these vulnerabilities.This vulnerability focuses on a second unsafe use of the `default_key_id` HTTP parameter to construct an OS Command at offset `0x19B234` of the `/root/hpgw` binary included in firmware 6.9Z.
Key phrases: os command injection, http request, arbitrary command execution, arbitrary commands
CVE-2022-33208: Authentication bypass by capture-replay vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who can analyze the communication between the affected controller and automation software 'Sysmac Studio' and/or a Programmable Terminal (PT) to access the controller.
Key phrases: bypass by capture-replay vulnerability exists in Machine automation controller NJ series, Authentication bypass, access the controller, authentication bypass
CVE-2022-33209: Improper input validation in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2022-3321: It was possible to bypass  Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for Wi-Fi networks" switches at once in the application settings. Such configuration caused the WARP client to disconnect and allowed the user to bypass restrictions and policies enforced by the Zero Trust platform.
Key phrases: bypass  Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on, bypass restrictions
CVE-2022-33210: Memory corruption in automotive multimedia due to use of out-of-range pointer offset while parsing command request packet with a very large type value. in Snapdragon Auto
Key phrases: memory corruption, out-of-range pointer offset
CVE-2022-33211: memory corruption in modem due to improper check while calculating size of serialized CoAP message
Key phrases: memory corruption
CVE-2022-33213: Memory corruption in modem due to buffer overflow while processing a PPP packet
Key phrases: memory corruption, buffer overflow
CVE-2022-33214: Memory corruption in display due to time-of-check time-of-use of metadata reserved size in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Key phrases: memory corruption
CVE-2022-33216: Transient Denial-of-service in Automotive due to improper input validation while parsing ELF file.
Key phrases: transient denial-of-service, improper input validation
CVE-2022-33217: Memory corruption in Qualcomm IPC due to buffer copy without checking the size of input while starting communication with a compromised kernel. in Snapdragon Mobile
Key phrases: memory corruption
CVE-2022-33218: Memory corruption in Automotive due to improper input validation.
Key phrases: memory corruption, improper input validation
CVE-2022-33219: Memory corruption in Automotive due to integer overflow to buffer overflow while registering a new listener with shared buffer.
Key phrases: memory corruption, integer overflow, buffer overflow
CVE-2022-3322: Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quick action.
Key phrases: insufficient policy verification, feature bypass,
CVE-2022-33220: Information disclosure in Automotive multimedia due to buffer over-read.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33221: Information disclosure in Trusted Execution Environment due to buffer over-read while processing metadata verification requests.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33222: Information disclosure due to buffer over-read while parsing DNS response packets in Modem.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33223: Transient DOS in Modem due to null pointer dereference while processing the incoming packet with http chunked encoding.
Key phrases: transient dos, null pointer dereference
CVE-2022-33224: Memory corruption in core due to buffer copy without check9ing the size of input while processing ioctl queries.
Key phrases: memory corruption
CVE-2022-33225: Memory corruption due to use after free in trusted application environment.
Key phrases: memory corruption, use after free
CVE-2022-33226: Memory corruption due to buffer copy without checking the size of input in Core while processing ioctl commands from diag client applications.
Key phrases: memory corruption
CVE-2022-33227: Memory corruption in Linux android due to double free while calling unregister provider after register call.
Key phrases: memory corruption, double free
CVE-2022-33228: Information disclosure sue to buffer over-read in modem while processing ipv6 packet with hop-by-hop or destination option in header.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33229: Information disclosure due to buffer over-read in Modem while using static array to process IPv4 packets.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-3323: An SQL injection vulnerability in Advantech iView 5.7.04.6469. The specific flaw exists within the ConfigurationServlet endpoint, which listens on TCP port 8080 by default. An unauthenticated remote attacker can craft a special column_value parameter in the setConfiguration action to bypass checks in com.imc.iview.utils.CUtils.checkSQLInjection() to perform SQL injection. For example, the attacker can exploit the vulnerability to retrieve the iView admin password.
Key phrases: bypass checks, sql injection
CVE-2022-33230: Memory corruption in FM Host due to buffer copy without checking the size of input in FM Host
Key phrases: memory corruption, buffer copy
CVE-2022-33231: Memory corruption due to double free in core while initializing the encryption key.
Key phrases: memory corruption, double free
CVE-2022-33232: Memory corruption due to buffer copy without checking size of input while running memory sharing tests with large scattered memory.
Key phrases: memory corruption
CVE-2022-33233: Memory corruption due to configuration weakness in modem wile sending command to write protected files.
Key phrases: configuration weakness, memory corruption
CVE-2022-33234: Memory corruption in video due to configuration weakness. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Key phrases: configuration weakness, memory corruption
CVE-2022-33235: Information disclosure due to buffer over-read in WLAN firmware while parsing security context info attributes. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33236: Transient DOS due to buffer over-read in WLAN firmware while parsing cipher suite info attributes. in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wired Infrastructure and Networking
Key phrases: transient dos, buffer over-read, buffer over read
CVE-2022-33237: Transient DOS due to buffer over-read in WLAN firmware while processing PPE threshold. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Key phrases: transient dos, buffer over-read, buffer over read
CVE-2022-33238: Transient DOS due to loop with unreachable exit condition in WLAN while processing an incoming FTM frames. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Key phrases: transient dos, loop with unreachable exit condition
CVE-2022-33239: Transient DOS due to loop with unreachable exit condition in WLAN firmware while parsing IPV6 extension header. in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Key phrases: transient dos, loop with unreachable exit condition
CVE-2022-3324: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0598.
Key phrases: stack-based buffer overflow
CVE-2022-33240: Memory corruption in Audio due to incorrect type cast during audio use-cases.
Key phrases: memory corruption
CVE-2022-33242: Memory corruption due to improper authentication in Qualcomm IPC while loading unsigned lib in audio PD.
Key phrases: memory corruption, improper authentication
CVE-2022-33243: Memory corruption due to improper access control in Qualcomm IPC.
Key phrases: memory corruption, improper access control
CVE-2022-33244: Transient DOS due to reachable assertion in modem during MIB reception and SIB timeout
Key phrases: transient dos, reachable assertion
CVE-2022-33245: Memory corruption in WLAN due to use after free
Key phrases: memory corruption, use after free
CVE-2022-33246: Memory corruption in Audio due to use of out-of-range pointer offset while Initiating a voice call session from user space with invalid session id.
Key phrases: memory corruption, out-of-range pointer offset
CVE-2022-33248: Memory corruption in User Identity Module due to integer overflow to buffer overflow when a segement is received via qmi http.
Key phrases: memory corruption, integer overflow, buffer overflow
CVE-2022-3325: Improper access control in the GitLab CE/EE API affecting all versions starting from 12.8 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. Allowed for editing the approval rules via the API by an unauthorised user.
Key phrases: improper access control
CVE-2022-33250: Transient DOS due to reachable assertion in modem when network repeatedly sent invalid message container for NR to LTE handover.
Key phrases: transient dos, reachable assertion
CVE-2022-33251: Transient DOS due to reachable assertion in Modem because of invalid network configuration.
Key phrases: transient dos, reachable assertion, invalid network configuration
CVE-2022-33252: Information disclosure due to buffer over-read in WLAN while handling IBSS beacons frame.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33253: Transient DOS due to buffer over-read in WLAN while parsing corrupted NAN frames.
Key phrases: transient dos, buffer over-read, buffer over read
CVE-2022-33254: Transient DOS due to reachable assertion in Modem while processing SIB1 Message.
Key phrases: transient dos, reachable assertion
CVE-2022-33255: Information disclosure due to buffer over-read in Bluetooth HOST while processing GetFolderItems and GetItemAttribute Cmds from peer device.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33256: Memory corruption due to improper validation of array index in Multi-mode call processor.
Key phrases: memory corruption
CVE-2022-33257: Memory corruption in Core due to time-of-check time-of-use race condition during dump collection in trust zone.
Key phrases: memory corruption, time-of-check time-of-use race condition
CVE-2022-33258: Information disclosure due to buffer over-read in modem while reading configuration parameters.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33259: Memory corruption due to buffer copy without checking the size of input in modem while decoding raw SMS received.
Key phrases: memory corruption, buffer copy
CVE-2022-3326: Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.9.
Key phrases: weak password requirements
CVE-2022-33260: Memory corruption due to stack based buffer overflow in core while sending command from USB of large size.
Key phrases: memory corruption, stack based buffer overflow
CVE-2022-33263: Memory corruption due to use after free in Core when multiple DCI clients register and deregister.
Key phrases: memory corruption, use after free
CVE-2022-33264: Memory corruption in modem due to stack based buffer overflow while parsing OTASP Key Generation Request Message.
Key phrases: memory corruption, stack based buffer overflow
CVE-2022-33265: Memory corruption due to information exposure in Powerline Communication Firmware while sending different MMEs from a single, unassociated device.
Key phrases: memory corruption, information exposure
CVE-2022-33266: Memory corruption in Audio due to integer overflow to buffer overflow while music playback of clips like amr,evrc,qcelp with modified content.
Key phrases: memory corruption, integer overflow, buffer overflow
CVE-2022-33267: Memory corruption in Linux while sending DRM request.
Key phrases: memory corruption
CVE-2022-33268: Information disclosure due to buffer over-read in Bluetooth HOST while pairing and connecting A2DP. in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33269: Memory corruption due to integer overflow or wraparound in Core while DDR memory assignment.
Key phrases: memory corruption, integer overflow, wraparound
CVE-2022-3327: Missing Authentication for Critical Function in GitHub repository ikus060/rdiffweb prior to 2.5.0a6.
Key phrases: missing authentication
CVE-2022-33270: Transient DOS due to time-of-check time-of-use race condition in Modem while processing RRC Reconfiguration message.
Key phrases: transient dos, time-of-check time-of-use race condition
CVE-2022-33271: Information disclosure due to buffer over-read in WLAN while parsing NMF frame.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33272: Transient DOS in modem due to reachable assertion.
Key phrases: reachable assertion
CVE-2022-33273: Information disclosure due to buffer over-read in Trusted Execution Environment while QRKS report generation.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33274: Memory corruption in android core due to improper validation of array index while returning feature ids after license authentication.
Key phrases: memory corruption
CVE-2022-33275: Memory corruption due to improper validation of array index in WLAN HAL when received lm_itemNum is out of range.
Key phrases: memory corruption
CVE-2022-33276: Memory corruption due to buffer copy without checking size of input in modem while receiving WMI_REQUEST_STATS_CMDID command.
Key phrases: memory corruption
CVE-2022-33277: Memory corruption in modem due to buffer copy without checking size of input while receiving WMI command.
Key phrases: memory corruption, buffer copy
CVE-2022-33278: Memory corruption due to buffer copy without checking the size of input in HLOS when input message size is larger than the buffer capacity.
Key phrases: memory corruption
CVE-2022-33279: Memory corruption due to stack based buffer overflow in WLAN having invalid WNM frame length.
Key phrases: memory corruption, stack based buffer overflow, invalid wnm frame length
CVE-2022-3328: Race condition in snap-confine's must_mkdir_and_open_with_perms()
Key phrases: race condition
CVE-2022-33280: Memory corruption due to access of uninitialized pointer in Bluetooth HOST while processing the AVRCP packet.
Key phrases: memory corruption, uninitialized pointer
CVE-2022-33281: Memory corruption due to improper validation of array index in computer vision while testing EVA kernel without sending any frames.
Key phrases: memory corruption
CVE-2022-33282: Memory corruption in Automotive Multimedia due to integer overflow to buffer overflow during IOCTL calls in video playback.
Key phrases: memory corruption, integer overflow, buffer overflow
CVE-2022-33283: Information disclosure due to buffer over-read in WLAN while WLAN frame parsing due to missing frame length check.
Key phrases: information disclosure, buffer over-read, missing frame length check, buffer over read
CVE-2022-33284: Information disclosure due to buffer over-read in WLAN while parsing BTM action frame.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33285: Transient DOS due to buffer over-read in WLAN while parsing WLAN CSA action frames.
Key phrases: transient dos, buffer over-read, buffer over read
CVE-2022-33286: Transient DOS due to buffer over-read in WLAN while processing 802.11 management frames.
Key phrases: transient dos, buffer over-read, buffer over read
CVE-2022-33287: Information disclosure in Modem due to buffer over-read while getting length of Unfragmented headers in an IPv6 packet.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33288: Memory corruption due to buffer copy without checking the size of input in Core while sending SCM command to get write protection information.
Key phrases: memory corruption
CVE-2022-33289: Memory corruption occurs in Modem due to improper validation of array index when malformed APDU is sent from card.
Key phrases: memory corruption
CVE-2022-33290: Transient DOS in Bluetooth HOST due to null pointer dereference when a mismatched argument is passed.
Key phrases: null pointer dereference, mismatched argument
CVE-2022-33291: Information disclosure in Modem due to buffer over-read while receiving a IP header with malformed length.
Key phrases: information disclosure, buffer over-read, malformed length, buffer over read
CVE-2022-33292: Memory corruption in Qualcomm IPC due to use after free while receiving the incoming packet and reposting it.
Key phrases: memory corruption, use after free
CVE-2022-33294: Transient DOS in Modem due to NULL pointer dereference while receiving response of lwm2m registration/update/bootstrap request message.
Key phrases: transient dos, null pointer dereference
CVE-2022-33295: Information disclosure in Modem due to buffer over-read while parsing the wms message received given the buffer and its length.
Key phrases: information disclosure, buffer over-read, buffer over read
CVE-2022-33296: Memory corruption due to integer overflow to buffer overflow in Modem while parsing Traffic Channel Neighbor List Update message.
Key phrases: memory corruption, integer overflow, buffer overflow
CVE-2022-33297: Information disclosure due to buffer overread in Linux sensors
Key phrases: information disclosure, buffer overread
CVE-2022-33298: Memory corruption due to use after free in Modem while modem initialization.
Key phrases: memory corruption, use after free
CVE-2022-33299: Transient DOS due to null pointer dereference in Bluetooth HOST while receiving an attribute protocol PDU with zero length data.
Key phrases: transient dos, null pointer dereference
CVE-2022-3330: It was possible for a guest user to read a todo targeting an inaccessible note in Gitlab CE/EE affecting all versions from 15.0 prior to 15.2.5, 15.3 prior to 15.3.4, and 15.4 prior to 15.4.1.
Key phrases: inaccessible note
CVE-2022-33300: Memory corruption in Automotive Android OS due to improper input validation.
Key phrases: memory corruption, improper input validation
CVE-2022-33301: Memory corruption due to incorrect type conversion or cast in audio while using audio playback/capture when crafted address is sent from AGM IPC to AGM.
Key phrases: memory corruption
CVE-2022-33302: Memory corruption due to improper validation of array index in User Identity Module when APN TLV length is greater than command length.
Key phrases: memory corruption
CVE-2022-33303: Transient DOS due to uncontrolled resource consumption in Linux kernel when malformed messages are sent from the Gunyah Resource Manager message queue.
Key phrases: transient dos, uncontrolled resource consumption, malformed messages
CVE-2022-33304: Transient DOS due to NULL pointer dereference in Modem while performing pullup for received TCP/UDP packet.
Key phrases: transient dos, null pointer dereference
CVE-2022-33305: Transient DOS due to NULL pointer dereference in Modem while sending invalid messages in DCCH.
Key phrases: transient dos, null pointer dereference
CVE-2022-33306: Transient DOS due to buffer over-read in WLAN while processing an incoming management frame with incorrectly filled IEs.
Key phrases: transient dos, buffer over-read, incorrectly filled ies, buffer over read
CVE-2022-33307: Memory Corruption due to double free in automotive when a bad HLOS address for one of the lists to be mapped is passed.
Key phrases: memory corruption, double free
CVE-2022-33309: Transient DOS due to buffer over-read in WLAN Firmware while parsing secure FTMR frame with size lesser than 39 Bytes.
Key phrases: transient dos, buffer over-read, buffer over read
CVE-2022-3331: An issue has been discovered in GitLab EE affecting all versions starting from 14.5 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab's Zentao integration has an insecure direct object reference vulnerability that may be exploited by an attacker to leak Zentao project issues.
Key phrases: direct object reference, insecure direct object reference
CVE-2022-33311: Browse restriction bypass vulnerability in Address Book of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Address Book via unspecified vectors.
Key phrases: Browse restriction bypass, obtain the data, obtain the data of Address Book via unspecified, unspecified vectors
CVE-2022-33312: Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/action/import_cert_file/` API is affected by command injection vulnerability.
Key phrases: command injection, arbitrary commands, arbitrary command execution
CVE-2022-33313: Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/action/import_https_cert_file/` API is affected by command injection vulnerability.
Key phrases: command injection, arbitrary commands, arbitrary command execution
CVE-2022-33314: Multiple command injection vulnerabilities exist in the web_server action endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/action/import_sdk_file/` API is affected by command injection vulnerability.
Key phrases: command injection, arbitrary commands, arbitrary command execution
CVE-2022-33315: Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.
Key phrases: execute an arbitrary malicious code by leading a, deserialization of untrusted data, execute arbitrary
CVE-2022-33316: Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious XAML codes.
Key phrases: execute an arbitrary malicious code by leading a, deserialization of untrusted data, execute arbitrary
CVE-2022-33317: Inclusion of Functionality from Untrusted Control Sphere vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a monitoring screen file including malicious script codes.
Key phrases: execute an arbitrary malicious code by leading a, untrusted control sphere, execute arbitrary
CVE-2022-33318: Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows a remote unauthenticated attacker to execute an arbitrary malicious code by sending specially crafted packets to the GENESIS64 server.
Key phrases: execute an arbitrary malicious code by sending specially, deserialization of untrusted data, execute arbitrary
CVE-2022-33319: Out-of-bounds Read vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows a remote unauthenticated attacker to disclose information on memory or cause a Denial of Service (DoS) condition by sending specially crafted packets to the GENESIS64 server.
Key phrases: Denial of Service (DoS), disclose information on memory or cause a Denial, out-of-bounds read, denial of service (dos) condition
CVE-2022-3332: A vulnerability classified as critical has been found in SourceCodester Food Ordering Management System. This affects an unknown part of the file router.php of the component POST Parameter Handler. The manipulation of the argument username leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-209583.
Key phrases: sql injection
CVE-2022-33320: Deserialization of Untrusted Data vulnerability in ICONICS GENESIS64 versions 10.97.1 and prior and Mitsubishi Electric MC Works64 versions 4.04E (10.95.210.01) and prior allows an unauthenticated attacker to execute an arbitrary malicious code by leading a user to load a project configuration file including malicious XML codes.
Key phrases: execute an arbitrary malicious code by leading a, deserialization of untrusted data, execute arbitrary
CVE-2022-33321: Cleartext Transmission of Sensitive Information vulnerability due to the use of Basic Authentication for HTTP connections in Mitsubishi Electric consumer electronics products (PHOTOVOLTAIC COLOR MONITOR ECO-GUIDE, HEMS adapter, Wi-Fi Interface, Air Conditioning, Induction hob, Mitsubishi Electric HEMS Energy Measurement Unit, Refrigerator, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch, Ventilating Fan, Range hood fan, Energy Measurement Unit and Air Purifier) allows a remote unauthenticated attacker to disclose information in the products or cause a denial of service (DoS) condition as a result by sniffing credential information (username and password).The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability.As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
Key phrases: denial of service (DoS), disclose information in the products or cause a, cleartext transmission of sensitive information, denial of service (dos) condition
CVE-2022-33322: Cross-site scripting vulnerability in Mitsubishi Electric consumer electronics products (Air Conditioning, Wi-Fi Interface, Refrigerator, HEMS adapter, Remote control with Wi-Fi Interface, BATHROOM THERMO VENTILATOR, Rice cooker, Mitsubishi Electric HEMS control adapter, Energy Recovery Ventilator, Smart Switch and Air Purifier) allows a remote unauthenticated attacker to execute an malicious script on a user's browser to disclose information, etc. The wide range of models/versions of Mitsubishi Electric consumer electronics products are affected by this vulnerability. As for the affected product models/versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
Key phrases: execute an malicious script on a user's, cross-site scripting
CVE-2022-33323: Active Debug Code vulnerability in robot controller of Mitsubishi Electric Corporation industrial robot MELFA SD/SQ Series and MELFA F-Series allows a remote unauthenticated attacker to gain unauthorized access by authentication bypass through an unauthorized telnet login. As for the affected model names, controller types and firmware versions, see the Mitsubishi Electric's advisory which is listed in [References] section.
Key phrases: bypass through an unauthorized telnet login, authentication bypass, gain unauthorized access, gain unauthorized access by authentication bypass through an, active debug code
CVE-2022-33324: Improper Resource Shutdown or Release vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series R00/01/02CPU Firmware versions "32" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R04/08/16/32/120(EN)CPU Firmware versions "65" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R08/16/32/120SFCPU Firmware versions "29" and prior, Mitsubishi Electric Corporation MELSEC iQ-R Series R12CCPU-V Firmware versions "17" and prior, Mitsubishi Electric Corporation MELSEC iQ-L Series L04/08/16/32HCPU all versions and Mitsubishi Electric Corporation MELIPC Series MI5122-VW all versions allows a remote unauthenticated attacker to cause a Denial of Service condition in Ethernet communication on the module by sending specially crafted packets. A system reset of the module is required for recovery.
Key phrases: cause a Denial of Service condition in Ethernet, improper resource shutdown, denial of service condition
CVE-2022-33325: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/clear_tools_log/` API is affected by command injection vulnerability.
Key phrases: command injection, arbitrary commands, arbitrary command execution
CVE-2022-33326: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/config_rollback/` API is affected by a command injection vulnerability.
Key phrases: command injection, arbitrary commands, arbitrary command execution
CVE-2022-33327: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/remove_sniffer_raw_log/` API is affected by a command injection vulnerability.
Key phrases: command injection, arbitrary commands, arbitrary command execution
CVE-2022-33328: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/remove/` API is affected by a command injection vulnerability.
Key phrases: command injection, arbitrary commands, arbitrary command execution
CVE-2022-33329: Multiple command injection vulnerabilities exist in the web_server ajax endpoints functionalities of Robustel R1510 3.3.0. A specially-crafted network packets can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these vulnerabilities.The `/ajax/set_sys_time/` API is affected by a command injection vulnerability.
Key phrases: command injection, arbitrary commands, arbitrary command execution
CVE-2022-3333: A vulnerability, which was classified as problematic, was found in Zephyr Project Manager up to 3.2.4. Affected is an unknown function of the file /v1/tasks/create/ of the component REST Call Handler. The manipulation of the argument onanimationstart leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.2.5 is able to address this issue. It is recommended to upgrade the affected component. VDB-209370 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-3334: The Easy WP SMTP WordPress plugin before 1.5.0 unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Key phrases: php object injection, gadget chain
CVE-2022-3335: The Kadence WooCommerce Email Designer WordPress plugin before 1.5.7 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog.
Key phrases: php object injections issues
CVE-2022-3336: The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack
Key phrases: delete arbitrary visitors, make logged in admin delete arbitrary visitors via, csrf check
CVE-2022-3337: It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the  Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Zero Trust Platform. This led to bypassing policies and restrictions enforced for enrolled devices by the Zero Trust platform.
CVE-2022-3338: An External XML entity (XXE) vulnerability in ePO prior to 5.10 Update 14 can lead to an unauthenticated remote attacker to potentially trigger a Server Side Request Forgery attack. This can be exploited by mimicking the Agent Handler call to ePO and passing the carefully constructed XML file through the API.
Key phrases: external xml entity (xxe), server side request forgery
CVE-2022-3339: A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 Update 14 allows a remote unauthenticated attacker to potentially obtain access to an ePO administrator's session by convincing the authenticated ePO administrator to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO.
Key phrases: obtain access, potentially obtain access to an ePO administrator's, reflected cross-site scripting (xss), limited access, convince, access sensitive information
CVE-2022-3340: XML External Entity (XXE) vulnerability in Trellix IPS Manager prior to 10.1 M8 allows a remote authenticated administrator to perform XXE attack in the administrator interface part of the interface, which allows a saved XML configuration file to be imported.
Key phrases: perform XXE attack in the administrator interface part, be imported, xml external entity (xxe)
CVE-2022-3341: A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file. The flaw occurs because the function lacks check of the return value of avformat_new_stream() and triggers the null pointer dereference error, causing an application to crash.
Key phrases: null pointer dereference issue, crash, application crash
CVE-2022-3342: The Jetpack CRM plugin for WordPress is vulnerable to PHAR deserialization via the zbscrmcsvimpf parameter in the 'zeroBSCRM_CSVImporterLitehtml_app' function in versions up to, and including, 5.3.1. While the function performs a nonce check, steps 2 and 3 of the check do not take any action upon a failed check. These steps then perform a 'file_exists' check on the value of 'zbscrmcsvimpf'. If a phar:// archive is supplied, its contents will be deserialized and an object injected in the execution stream. This allows an unauthenticated attacker to obtain object injection if they are able to upload a phar archive (for instance if the site supports image uploads) and then trick an administrator into performing an action, such as clicking a link.
Key phrases: obtain object injection if they are able to upload, phar deserialization
CVE-2022-3343: The WPQA Builder WordPress plugin before 5.9.3 (which is a companion plugin used with Discy and Himer Discy WordPress themes) incorrectly tries to validate that a user already follows another in the wpqa_following_you_ajax action, allowing a user to inflate their score on the site by having another user send repeated follow actions to them.
Key phrases: inflate their score on the site by having