yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-2387: The Easy Digital Downloads WordPress plugin before 3.0 does not have CSRF check in place when deleting payment history, and does not ensure that the post to be deleted is actually a payment history. As a result, attackers could make a logged in admin delete arbitrary post via a CSRF attack
Key phrases: csrf check
CVE-2022-23871: Multiple cross-site scripting (XSS) vulnerabilities in the component outcomes_addProcess.php of Gibbon CMS v22.0.01 allow attackers to execute arbitrary web scripts or HTML via a crafted payload insterted into the name, category, description parameters.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-23872: Emlog pro v1.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /admin/configure.php via the parameter footer_info.
Key phrases: stored cross-site scripting (xss)
CVE-2022-23873: Victor CMS v1.0 was discovered to contain a SQL injection vulnerability that allows attackers to inject arbitrary commands via 'user_firstname' parameter.
Key phrases: inject arbitrary commands, inject arbitrary commands via 'user_firstname' parameter, sql injection
CVE-2022-23878: seacms V11.5 is affected by an arbitrary code execution vulnerability in admin_config.php.
Key phrases: arbitrary code execution
CVE-2022-2388: The WP Coder WordPress plugin before 2.5.3 does not have CSRF check in place when deleting code created by the plugin, which could allow attackers to make a logged in admin delete arbitrary ones via a CSRF attack
Key phrases: make a logged in admin delete arbitrary ones, csrf check
CVE-2022-23880: An arbitrary file upload vulnerability in the File Management function module of taoCMS v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-23881: ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.
Key phrases: remote command execution (rce)
CVE-2022-23882: TuziCMS 2.0.6 is affected by SQL injection in \\\\App\\\\Manage\\\\Controller\\\\BannerController.class.php.
Key phrases: sql injection
CVE-2022-23884: Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::_read (packet deserializer).
Key phrases: bypass caused by PurchaseReceiptPacket::_read (packet deserializer), bound check bypass, integer overflow
CVE-2022-23887: YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily delete user accounts via /admin/admin_manage/delete.
Key phrases: arbitrarily delete user accounts via /admin/admin_manage, cross-site request forgery (csrf)
CVE-2022-23888: YzmCMS v6.3 was discovered to contain a Cross-Site Request Forgey (CSRF) via the component /yzmcms/comment/index/init.html.
Key phrases: cross-site request forgey (csrf)
CVE-2022-23889: The comment function in YzmCMS v6.3 was discovered as being able to be operated concurrently, allowing attackers to create an unusually large number of comments.
Key phrases: create an unusually large number of comments
CVE-2022-2389: The Abandoned Cart Recovery for WooCommerce, Follow Up Emails, Newsletter Builder & Marketing Automation By Autonami WordPress plugin before 2.1.2 does not have authorisation and CSRF checks in one of its AJAX action, allowing any authenticated users, such as subscriber to create automations
Key phrases: create automations
CVE-2022-23896: Admidio 4.1.2 version is affected by stored cross-site scripting (XSS).
Key phrases: stored cross-site scripting (xss)
CVE-2022-23898: MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via the categoryId parameter in the file IContentDao.xml.
Key phrases: sql injection
CVE-2022-23899: MCMS v5.2.5 was discovered to contain a SQL injection vulnerability via search.do in the file /web/MCmsAction.java.
Key phrases: sql injection
CVE-2022-2390: Apps developed with Google Play Services SDK incorrectly had the mutability flag set to PendingIntents that were passed to the Notification service. As Google Play services SDK is so widely used, this bug affects many applications. For an application affected, this bug will let the attacker, gain the access to all non-exported providers and/or gain the access to other providers the victim has permissions. We recommend upgrading to version 18.0.2 of the Play Service SDK as well as rebuilding and redeploying apps.
Key phrases: gain the access
CVE-2022-23900: A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote code execution via a malicious POST request through /cgi-bin/adm.cgi.
Key phrases: achieve unauthorized remote code execution via a malicious, command injection
CVE-2022-23901: A stack overflow re2c 2.2 exists due to infinite recursion issues in src/dfa/dead_rules.cc.
Key phrases: stack overflow
CVE-2022-23902: Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in export_data.php via the d_name parameter.
Key phrases: sql injection
CVE-2022-23903: A Cross Site Scripting (XSS) vulnerability exists in pearadmin pear-admin-think <=5.0.6, which allows a login account to access arbitrary functions and cause stored XSS through a fake User-Agent.
Key phrases: access arbitrary functions, access arbitrary functions and cause stored XSS through, cross site scripting (xss), stored xss
CVE-2022-23904: Rainworx Auctionworx < 3.1R2 is vulnerable to a Cross-Site Request Forgery (CSRF) attack that allows an authenticated user to upgrade his account to admin and gain access to the auctionworx admin control panel. This vulnerability affects AuctionWorx Enterprise and AuctionWorx: Events Edition.
Key phrases: gain access, upgrade his account to admin and gain access, cross-site request forgery (csrf)
CVE-2022-23906: CMS Made Simple v2.2.15 was discovered to contain a Remote Command Execution (RCE) vulnerability via the upload avatar function. This vulnerability is exploited via a crafted image file.
Key phrases: remote command execution (rce)
CVE-2022-23907: CMS Made Simple v2.2.15 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the parameter m1_fmmessage.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-23909: There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\\\\Program Files\\\\Sherpa Software\\\\Sherpa.exe" file.
Key phrases: escalate privileges by creating a "C:\\\\Program Files\\\\Sherpa, unquoted service path
CVE-2022-2391: The Inspiro PRO WordPress plugin does not sanitize the portfolio slider description, allowing users with privileges as low as Contributor to inject JavaScript into the description.
Key phrases: inject JavaScript into the description
CVE-2022-23911: The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL Injection
Key phrases: sql injection
CVE-2022-23912: The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-23913: In Apache ActiveMQ Artemis prior to 2.20.0 or 2.19.1, an attacker could partially disrupt availability (DoS) through uncontrolled resource consumption of memory.
Key phrases: availability, dos, uncontrolled resource consumption
CVE-2022-23915: The package weblate from 0 and before 4.11.1 are vulnerable to Remote Code Execution (RCE) via argument injection when using git or mercurial repositories. Authenticated users, can change the behavior of the application in an unintended way, leading to command execution.
Key phrases: remote code execution (rce), argument injection, unintended way, command execution
CVE-2022-23916: Cross-site scripting vulnerability in a-blog cms Ver.2.8.x series versions prior to Ver.2.8.75, Ver.2.9.x series versions prior to Ver.2.9.40, Ver.2.10.x series versions prior to Ver.2.10.44, Ver.2.11.x series versions prior to Ver.2.11.42, and Ver.3.0.x series versions prior to Ver.3.0.1 allows a remote authenticated attacker to inject an arbitrary script via unspecified vectors. This vulnerability is different from CVE-2022-24374.
Key phrases: inject an arbitrary script via unspecified vectors, cross-site scripting
CVE-2022-23918: A stack-based buffer overflow vulnerability exists in the confsrv set_mf_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability leverages the ethAddr field within the protobuf message to cause a buffer overflow.
Key phrases: stack-based buffer overflow, malicious packet, stack based buffer overflow
CVE-2022-23919: A stack-based buffer overflow vulnerability exists in the confsrv set_mf_rule functionality of TCL LinkHub Mesh Wifi MS1G_00_01.00_14. A specially-crafted network packet can lead to stack-based buffer overflow. An attacker can send a malicious packet to trigger this vulnerability.This vulnerability leverages the name field within the protobuf message to cause a buffer overflow.
Key phrases: buffer overflow, malicious packet, stack based buffer overflow
CVE-2022-2392: The Lana Downloads Manager WordPress plugin before 1.8.0 is affected by an arbitrary file download vulnerability that can be exploited by users with "Contributor" permissions or higher.
Key phrases: arbitrary file download
CVE-2022-23921: Exploitation of this vulnerability may result in local privilege escalation and code execution. GE maintains exploitation of this vulnerability is only possible if the attacker has login access to a machine actively running CIMPLICITY, the CIMPLICITY server is not already running a project, and the server is licensed for multiple projects.
Key phrases: exploitation, local privilege escalation, code execution
CVE-2022-23922: WIN-911 2021 R1 and R2 are vulnerable to a permissions misconfiguration that may allow an attacker to locally write files to the Program Announcer directory and elevate permissions whenever the program is executed.
Key phrases: locally write files to the Program Announcer directory, permissions misconfiguration, to write files
CVE-2022-23923: All versions of package jailed are vulnerable to Sandbox Bypass via an exported alert() method which can access the main application. Exported methods are stored in the application.remote object.
Key phrases: Bypass via an exported alert() method, Sandbox Bypass, sandbox bypass
CVE-2022-23924: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-23925: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-23926: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-23927: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-23928: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-23929: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-2393: A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content.
Key phrases: get a certificate for another user identity when, impersonate another user within the scope of the, decrypt message
CVE-2022-23930: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-23931: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-23932: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-23933: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-23934: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products which may allow Escalation of Privilege, Arbitrary Code Execution, Unauthorized Code Execution, Denial of Service, and Information Disclosure.
Key phrases: Escalation of Privilege, escalation of privilege, arbitrary code execution, unauthorized code execution, denial of service, information disclosure
CVE-2022-23935: lib/Image/ExifTool.pm in ExifTool before 12.38 mishandles a $file =~ /\\\\|$/ check, leading to command injection.
Key phrases: command injection
CVE-2022-23937: In Wind River VxWorks 6.9 and 7, a specific crafted packet may lead to an out-of-bounds read during an IKE initial exchange scenario.
Key phrases: out-of-bounds read, out of bounds read
CVE-2022-2394: Puppet Bolt prior to version 3.24.0 will print sensitive parameters when planning a run resulting in them potentially being logged when run programmatically, such as via Puppet Enterprise.
Key phrases: sensitive parameters
CVE-2022-23940: SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution.
Key phrases: the Scheduled Reports module can achieve this by, remote code execution
CVE-2022-23942: Apache Doris, prior to 1.0.0, used a hardcoded key and IV to initialize the cipher used for ldap password, which may lead to information disclosure.
Key phrases: hardcoded key, information disclosure
CVE-2022-23943: Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. This issue affects Apache HTTP Server 2.4 version 2.4.52 and prior versions.
Key phrases: overwrite heap memory with possibly attacker provided data, out-of-bounds write, out of bounds write
CVE-2022-23944: User can access /plugin api without authentication. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
CVE-2022-23945: Missing authentication on ShenYu Admin when register by HTTP. This issue affected Apache ShenYu 2.4.0 and 2.4.1.
Key phrases: missing authentication
CVE-2022-23946: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon GCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: stack-based buffer overflow, code execution, stack based buffer overflow
CVE-2022-23947: A stack-based buffer overflow vulnerability exists in the Gerber Viewer gerber and excellon DCodeNumber parsing functionality of KiCad EDA 6.0.1 and master commit de006fc010. A specially-crafted gerber or excellon file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: stack-based buffer overflow, code execution, stack based buffer overflow
CVE-2022-23948: A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host.
Key phrases: be leaked to other processes on the host
CVE-2022-23949: In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar.
Key phrases: unsanitized uuids, log spoofing
CVE-2022-2395: The weForms WordPress plugin before 1.6.14 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-23950: In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations.
Key phrases: prohibit keylime operations, fixed tmp path
CVE-2022-23951: In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs.
Key phrases: untrusted zip data, zip bombs
CVE-2022-23952: In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable.
Key phrases: world-readable
CVE-2022-23953: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Key phrases: denial of service, potential
CVE-2022-23954: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Key phrases: denial of service, potential
CVE-2022-23955: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Key phrases: denial of service, potential
CVE-2022-23956: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Key phrases: denial of service, potential
CVE-2022-23957: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Key phrases: denial of service, potential
CVE-2022-23958: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service.
Key phrases: denial of service, potential
CVE-2022-23959: In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections.
Key phrases: request smuggling
CVE-2022-2396: A vulnerability classified as problematic was found in SourceCodester Simple e-Learning System 1.0. Affected by this vulnerability is an unknown functionality of the file /vcs/claire_blake. The manipulation of the argument Bio with the input "><script>alert(document.cookie)</script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Key phrases: cross site scripting
CVE-2022-23960: Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information.
Key phrases: obtain sensitive information, cache speculation, spectre-bhb
CVE-2022-23968: Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot, but image parsing is restarted as soon as the boot process finishes. However, this boot loop can be resolved by a field technician. The TIFF file must have an incomplete Image Directory. Affected firmware versions include xx.42.01 and xx.50.61. NOTE: the 2022-01-24 NeoSmart article included "believed to affect all previous and later versions as of the date of this posting" but a 2022-01-26 vendor statement reports "the latest versions of firmware are not vulnerable to this issue."
Key phrases: brick the device via a crafted TIFF file, denial of service, reboot
CVE-2022-23970: ASUS RT-AX56Us update_json function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another file with the same file name, which results in service disruption.
Key phrases: path traversal, service disruption, file upload
CVE-2022-23971: ASUS RT-AX56Us update_PLC/PORT file has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another PLC/PORT file with the same file name, which results in service disruption.
Key phrases: path traversal, service disruption, file upload
CVE-2022-23972: ASUS RT-AX56Us SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject arbitrary SQL code to read, modify and delete database.
Key phrases: inject arbitrary SQL code, sql injection
CVE-2022-23973: ASUS RT-AX56Us user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient validation for parameter length. An unauthenticated LAN attacker can execute arbitrary code to perform arbitrary operations or disrupt service.
Key phrases: perform arbitrary operations or disrupt, stack-based buffer overflow, disrupt service, stack based buffer overflow, execute arbitrary, execute arbitrary code
CVE-2022-23974: In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0
Key phrases: the controller a specially crafted request can potentially, segment upload path, open access, disruption in pinot service
CVE-2022-23975: Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin.
Key phrases: activate any installed plugin, cross-site request forgery (csrf)
CVE-2022-23976: Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media).
Key phrases: reset all data (posts / pages /, cross-site request forgery (csrf)
CVE-2022-23979: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15).
Key phrases: authenticated (admin+) stored cross-site scripting (xss)
CVE-2022-2398: The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, field error message, cross-site scripting
CVE-2022-23980: Cross-Site Scripting (XSS) vulnerability discovered in Yasr  Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter 'source'.
Key phrases: cross-site scripting (xss)
CVE-2022-23981: The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4).
Key phrases: create brands in WordPress Perfect Brands for WooCommerce
CVE-2022-23982: The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure.
Key phrases: server information exposure
CVE-2022-23983: Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4).
Key phrases: cross-site request forgery (csrf)
CVE-2022-23984: Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11).
Key phrases: sensitive information disclosure
CVE-2022-23985: The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution.
Key phrases: allow arbitrary code execution, craft a project file that would allow arbitrary, out-of-bounds write, out of bounds write
CVE-2022-23986: SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the database via unspecified vectors.
Key phrases: obtain the information, obtain the information in the database via unspecified, sql injection, unspecified vectors
CVE-2022-23987: The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-23988: The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission
Key phrases: submit XSS payloads which will get executed when, xss payloads
CVE-2022-23989: In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood of connections to the SSLVPN service might lead to saturation of the loopback interface. This could result in the blocking of almost all network traffic, making the firewall unreachable. An attacker could exploit this via forged and properly timed traffic to cause a denial of service.
Key phrases: denial of service
CVE-2022-2399: Use after free in WebGPU in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2022-23990: Expat (aka libexpat) before 2.4.4 has an integer overflow in the doProlog function.
Key phrases: integer overflow
CVE-2022-23992: XCOM Data Transport for Windows, Linux, and UNIX 11.6 releases contain a vulnerability due to insufficient input validation that could potentially allow remote attackers to execute arbitrary commands with elevated privileges.
Key phrases: execute arbitrary commands, execute arbitrary commands with elevated privileges, insufficient input validation
CVE-2022-23993: /usr/local/www/pkg.php in pfSense CE before 2.6.0 and pfSense Plus before 22.01 uses $_REQUEST['pkg_filter'] in a PHP echo call, causing XSS.
Key phrases: xss
CVE-2022-23994: An Improper access control vulnerability in StBedtimeModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to change bedtime mode without a proper permission.
Key phrases: change bedtime mode without a proper permission, improper access control
CVE-2022-23995: Unprotected component vulnerability in StBedtimeModeAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to change bedtime mode without a proper permission.
Key phrases: change bedtime mode without a proper permission, unprotected component
CVE-2022-23996: Unprotected component vulnerability in StTheaterModeReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to enable bedtime mode without a proper permission.
Key phrases: enable bedtime mode without a proper permission, unprotected component
CVE-2022-23997: Unprotected component vulnerability in StTheaterModeDurationAlarmReceiver in Wear OS 3.0 prior to Firmware update Feb-2022 Release allows untrusted applications to disable theater mode without a proper permission.
Key phrases: disable theater mode without a proper permission, unprotected component
CVE-2022-23998: Improper access control vulnerability in Camera prior to versions 11.1.02.16 in Android R(11), 10.5.03.77 in Android Q(10) and 9.0.6.68 in Android P(9) allows untrusted applications to take a picture in screenlock status.
Key phrases: take a picture in screenlock status, improper access control
CVE-2022-23999: PendingIntent hijacking vulnerability in CpaReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission in KnoxPrivacyNoticeReceiver via implicit Intent.
Key phrases: access media files without permission in KnoxPrivacyNoticeReceiver via, pendingintent hijacking
CVE-2022-2400: External Control of File Name or Path in GitHub repository dompdf/dompdf prior to 2.0.0.
Key phrases: external control
CVE-2022-24000: PendingIntent hijacking vulnerability in DataUsageReminderReceiver prior to SMR Feb-2022 Release 1 allows local attackers to access media files without permission in KnoxPrivacyNoticeReceiver via implicit Intent.
Key phrases: access media files without permission in KnoxPrivacyNoticeReceiver via, pendingintent hijacking
CVE-2022-24001: Information disclosure vulnerability in Edge Panel prior to Android S(12) allows physical attackers to access screenshot in clipboard via Edge Panel.
Key phrases: access screenshot in clipboard via Edge Panel, information disclosure
CVE-2022-24002: Improper Authorization vulnerability in Link Sharing prior to version 12.4.00.3 allows attackers to open protected activity via PreconditionActivity.
Key phrases: open protected activity via PreconditionActivity, improper authorization
CVE-2022-24003: Exposure of Sensitive Information vulnerability in Bixby Vision prior to version 3.7.50.6 allows attackers to access internal data of Bixby Vision via unprotected intent.
Key phrases: access internal data of Bixby Vision via unprotected, exposure of sensitive information
CVE-2022-24004: A Stored Cross-Site Scripting (XSS) vulnerability was discovered in Messenger/messenger_ajax.php in REDCap 12.0.11. This issue allows any authenticated user to inject arbitrary code into the messenger title (aka new_title) field when editing an existing conversation. The payload executes in the browser of any conversation participant with the sidebar shown.
Key phrases: inject arbitrary code, inject arbitrary code into the messenger title (, stored cross-site scripting (xss)
CVE-2022-24005: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the ap_steer binary.
Key phrases: buffer overflow
CVE-2022-24006: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the arpbrocast binary.
Key phrases: buffer overflow
CVE-2022-24007: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the cfm binary.
Key phrases: buffer overflow
CVE-2022-24008: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the confcli binary.
Key phrases: buffer overflow
CVE-2022-24009: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the confsrv binary.
Key phrases: buffer overflow
CVE-2022-2401: Unrestricted information disclosure of all users in Mattermost version 6.7.0 and earlier allows team members to access some sensitive information by directly accessing the APIs.
Key phrases: access some sensitive information by directly accessing the, unrestricted information disclosure, access sensitive information
CVE-2022-24010: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the cwmpd binary.
Key phrases: buffer overflow
CVE-2022-24011: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the device_list binary.
Key phrases: buffer overflow
CVE-2022-24012: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the fota binary.
Key phrases: buffer overflow
CVE-2022-24013: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the gpio_ctrl binary.
Key phrases: buffer overflow
CVE-2022-24014: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the logserver binary.
Key phrases: buffer overflow
CVE-2022-24015: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the log_upload binary.
Key phrases: buffer overflow
CVE-2022-24016: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the mesh_status_check binary.
Key phrases: buffer overflow
CVE-2022-24017: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the miniupnpd binary.
Key phrases: buffer overflow
CVE-2022-24018: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the multiWAN binary.
Key phrases: buffer overflow
CVE-2022-24019: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the netctrl binary.
Key phrases: buffer overflow
CVE-2022-2402: The vulnerability in the driver dlpfde.sys enables a user logged into the system to perform system calls leading to kernel stack overflow, resulting in a system crash, for instance, a BSOD.
Key phrases: kernel stack overflow, system crash, bsod
CVE-2022-24020: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the network_check binary.
Key phrases: buffer overflow
CVE-2022-24021: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the online_process binary.
Key phrases: buffer overflow
CVE-2022-24022: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the pannn binary.
Key phrases: buffer overflow
CVE-2022-24023: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the pppd binary.
Key phrases: buffer overflow
CVE-2022-24024: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the rtk_ate binary.
Key phrases: buffer overflow
CVE-2022-24025: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the sntp binary.
Key phrases: buffer overflow
CVE-2022-24026: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the telnet_ate_monitor binary.
Key phrases: buffer overflow
CVE-2022-24027: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the libcommon.so binary.
Key phrases: buffer overflow
CVE-2022-24028: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the libcommonprod.so binary.
Key phrases: buffer overflow
CVE-2022-24029: A buffer overflow vulnerability exists in the GetValue functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted configuration value can lead to a buffer overflow. An attacker can modify a configuration value to trigger this vulnerability.This vulnerability represents all occurances of the buffer overflow vulnerability within the rp-pppoe.so binary.
Key phrases: buffer overflow
CVE-2022-2403: A credentials leak was found in the OpenShift Container Platform. The private key for the external cluster certificate was stored incorrectly in the oauth-serving-cert ConfigMaps, and accessible to any authenticated OpenShift user or service-account. A malicious user could exploit this flaw by reading the oauth-serving-cert ConfigMap in the openshift-config-managed namespace, compromising any web traffic secured using that certificate.
Key phrases: credentials leak, web traffic
CVE-2022-24030: An issue was discovered in AhciBusDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
Key phrases: write fixed or predictable data to SMRAM, smm memory corruption, escalating privileges, escalate privilege
CVE-2022-24031: An issue was discovered in NvmExpressDxe in Insyde InsydeH2O with kernel 5.1 through 5.5. An SMM memory corruption vulnerability allows an attacker to write fixed or predictable data to SMRAM. Exploiting this issue could lead to escalating privileges to SMM.
Key phrases: write fixed or predictable data to SMRAM, smm memory corruption, escalating privileges, escalate privilege
CVE-2022-24032: Adenza AxiomSL ControllerView through 10.8.1 is vulnerable to user enumeration. An attacker can identify valid usernames on the platform because a failed login attempt produces a different error message when the username is valid.
Key phrases: user enumeration
CVE-2022-24035: An issue was discovered in ONOS 2.5.1. The purge-requested intent remains on the list, but it does not respond to changes in topology (e.g., link failure). In combination with other applications, it could lead to a failure of network management.
Key phrases: purge-requested intent, failure of network management
CVE-2022-24036: Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to modificate logs.
Key phrases: modificate logs, unauthenticated access
CVE-2022-24037: Karmasis Informatics Infraskope SIEM+ has an unauthenticated access vulnerability which could allow an unauthenticated attacker to obtain critical information.
Key phrases: obtain critical information, unauthenticated access
CVE-2022-24038: Karmasis Informatics Infraskope SIEM+has an unauthenticated access vulnerability which could allow an unauthenticated attacker to damage the page where the agents are listed.
Key phrases: damage the page where the agents are listed, unauthenticated access
CVE-2022-24039: A vulnerability has been identified in Desigo PXC4 (All versions < V02.20.142.10-10884), Desigo PXC5 (All versions < V02.20.142.10-10884). The addCell JavaScript function fails to properly sanitize user-controllable input before including it into the generated XML body of the XLS report document, such that it is possible to inject arbitrary content (e.g., XML tags) into the generated file. An attacker with restricted privileges, by poisoning any of the content used to generate XLS reports, could be able to leverage the application to deliver malicious files against higher-privileged users and obtain Remote Code Execution (RCE) against the administrators workstation.
Key phrases: inject arbitrary content, obtain Remote Code Execution, remote code execution (rce)
CVE-2022-2404: The WP Popup Builder WordPress plugin before 1.2.9 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting