yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-38161: The Gumstix Overo SBC on the VSKS board through 2022-08-09, as used on the Orlan-10 and other platforms, allows unrestricted remapping of the NOR flash memory containing the bitstream for the FPGA.
Key phrases: unrestricted remapping of the NOR flash memory containing
CVE-2022-38162: Reflected cross-site scripting (XSS) vulnerabilities in WithSecure through 2022-08-10) exists within the F-Secure Policy Manager due to an unvalidated parameter in the endpoint, which allows remote attackers to provide a malicious input.
Key phrases: provide a malicious input, reflected cross-site scripting (xss)
CVE-2022-38163: A Drag and Drop spoof vulnerability was discovered in F-Secure SAFE Browser for Android and iOS version 19.0 and below. Drag and drop operation by user on address bar could lead to a spoofing of the address bar.
Key phrases: drag and drop spoof, spoofing
CVE-2022-38164: WithSecure through 2022-08-10 allows attackers to cause a denial of service (issue 3 of 5).
Key phrases: denial of service (issue 3 of 5), cause a denial of service (issue 3
CVE-2022-38165: Arbitrary file write in F-Secure Policy Manager through 2022-08-10 allows unauthenticated users to write the file with the contents in arbitrary locations on the F-Secure Policy Manager Server.
Key phrases: write the file with the contents in arbitrary, arbitrary file write, to write files
CVE-2022-38166: In F-Secure Endpoint Protection for Windows and macOS before channel with Capricorn database 2022-11-22_07, the aerdl.dll unpacker handler crashes. This can lead to a scanning engine crash, triggerable remotely by an attacker for denial of service.
Key phrases: denial of service, crash
CVE-2022-38167: The Nintex Workflow plugin 5.2.2.30 for SharePoint allows XSS.
Key phrases: XSS, xss
CVE-2022-38168: Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification.
Key phrases: bypass the login page, broken access control, sensitive information, url modification, access sensitive information
CVE-2022-3817: A vulnerability has been found in Axiomatic Bento4 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component mp4mux. The manipulation leads to memory leak. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212683.
Key phrases: memory leak
CVE-2022-38170: In Apache Airflow prior to 2.3.4, an insecure umask was configured for numerous Airflow components when running with the `--daemon` flag which could result in a race condition giving world-writable files in the Airflow home directory and allowing local users to expose arbitrary file contents via the webserver.
Key phrases: expose arbitrary file contents, expose arbitrary file contents via the webserver, insecure umask, race condition, world-writable files
CVE-2022-38171: Xpdf prior to version 4.04 contains an integer overflow in the JBIG2 decoder (JBIG2Stream::readTextRegionSeg() in JBIG2Stream.cc). Processing a specially crafted PDF file or JBIG2 image could lead to a crash or the execution of arbitrary code. This is similar to the vulnerability described by CVE-2021-30860 (Apple CoreGraphics).
Key phrases: integer overflow, (apple coregraphics), crash, arbitrary code
CVE-2022-38172: ServiceNow through San Diego Patch 3 allows XSS via the name field during creation of a new dashboard for the Performance Analytics dashboard.
Key phrases: XSS via the name field during creation of, xss
CVE-2022-38176: An issue was discovered in YSoft SAFEQ 6 before 6.0.72. Incorrect privileges were configured as part of the installer package for the Client V3 services, allowing for local user privilege escalation by overwriting the executable file via an alternative data stream. NOTE: this is not the same as CVE-2021-31859.
Key phrases: for local user privilege escalation by overwriting the
CVE-2022-38177: By spoofing the target resolver with responses that have a malformed ECDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
Key phrases: memory leak, crashes, spoofing
CVE-2022-38178: By spoofing the target resolver with responses that have a malformed EdDSA signature, an attacker can trigger a small memory leak. It is possible to gradually erode available memory to the point where named crashes for lack of resources.
Key phrases: memory leak, crashes, spoofing
CVE-2022-38179: JetBrains Ktor before 2.1.0 was vulnerable to the Reflect File Download attack
Key phrases: reflect file download
CVE-2022-3818: An uncontrolled resource consumption issue when parsing URLs in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows an attacker to cause performance issues and potentially a denial of service on the GitLab instance.
Key phrases: cause performance issues and potentially a denial of, uncontrolled resource consumption issue, denial of service
CVE-2022-38180: In JetBrains Ktor before 2.1.0 the wrong authentication provider could be selected in some cases
Key phrases: authentication provider
CVE-2022-38181: The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p0 through r38p1, and r39p0; Valhall r19p0 through r38p1, and r39p0; and Midgard r4p0 through r32p0.
Key phrases: access freed memory because GPU memory operations are
CVE-2022-38183: In Gitea before 1.16.9, it was possible for users to add existing issues to projects. Due to improper access controls, an attacker could assign any issue to any project in Gitea (there was no permission check for fetching the issue). As a result, the attacker would get access to private issue titles.
Key phrases: improper access controls
CVE-2022-38184: There is an improper access control vulnerability in Portal for ArcGIS versions 10.8.1 and below which could allow a remote, unauthenticated attacker to access an API that may induce Esri Portal for ArcGIS to read arbitrary URLs.
Key phrases: read arbitrary URLs, access an API that may induce Esri Portal, improper access control, arbitrary urls
CVE-2022-38186: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victims browser.
Key phrases: execute arbitrary JavaScript code, convince a user to click on a crafted, xss, arbitrary javascript code
CVE-2022-38187: Prior to version 10.9.0, the sharing/rest/content/features/analyze endpoint is always accessible to anonymous users, which could allow an unauthenticated attacker to induce Esri Portal for ArcGIS to read arbitrary URLs.
Key phrases: read arbitrary URLs, induce Esri Portal for ArcGIS to read arbitrary
CVE-2022-38188: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 which may allow a remote attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victims browser.
Key phrases: execute arbitrary JavaScript code, convince a user to click on a crafted, xss
CVE-2022-38189: A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the users browser.
Key phrases: execute arbitrary JavaScript code, pass and store malicious strings via crafted queries, cross site scripting (xss)
CVE-2022-3819: An improper authorization issue in GitLab CE/EE affecting all versions from 15.0 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a malicious users to set emojis on internal notes they don't have access to.
Key phrases: set emojis on internal notes they don't, authorization issue, improper authorization
CVE-2022-38190: A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS configurable apps may allow a remote, unauthenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the users browser
Key phrases: execute arbitrary JavaScript code, pass and store malicious strings via crafted queries, cross site scripting (xss), arbitrary javascript code
CVE-2022-38191: There is an HTML injection issue in Esri Portal for ArcGIS versions 10.9.0 and below which may allow a remote, authenticated attacker to inject HTML into some locations in the home application.
Key phrases: inject HTML into some locations in the home, html injection
CVE-2022-38192: A stored Cross Site Scripting (XSS) vulnerability in Esri Portal for ArcGIS may allow a remote, authenticated attacker to pass and store malicious strings via crafted queries which when accessed could potentially execute arbitrary JavaScript code in the users browser.
Key phrases: execute arbitrary JavaScript code, pass and store malicious strings via crafted queries, cross site scripting (xss)
CVE-2022-38193: There is a code injection vulnerability in Esri Portal for ArcGIS versions 10.8.1 and below that may allow a remote, unauthenticated attacker to pass strings which could potentially cause arbitrary code execution.
Key phrases: cause arbitrary code execution, pass strings which could potentially cause arbitrary code, code injection
CVE-2022-38194: In Esri Portal for ArcGIS versions 10.8.1, a system property is not properly encrypted. This may lead to a local user reading sensitive information from a properties file.
Key phrases: system property, sensitive information
CVE-2022-38195: There is as reflected cross site scripting issue in Esri ArcGIS Server versions 10.9.1 and below which may allow a remote unauthorized attacker able to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victims browser.
Key phrases: execute arbitrary JavaScript code, convince a user to click on a crafted, cross site scripting issue, cross-site scripting
CVE-2022-38196: Esri ArcGIS Server versions 10.9.1 and prior have a path traversal vulnerability that may result in a denial of service by allowing a remote, authenticated attacker to overwrite internal ArcGIS Server directory.
Key phrases: overwrite internal ArcGIS Server directory, path traversal, denial of service
CVE-2022-38197: Esri ArcGIS Server versions 10.9.1 and below have an unvalidated redirect issue that may allow a remote, unauthenticated attacker to phish a user into accessing an attacker controlled website via a crafted query parameter.
Key phrases: phish a user into accessing an attacker controlled, unvalidated redirect issue
CVE-2022-38198: There is a reflected cross site scripting issue in the Esri ArcGIS Server services directory versions 10.9.1 and below that may allow a remote, unauthenticated attacker to convince a user to click on a crafted link which could potentially execute arbitrary JavaScript code in the victims browser.
Key phrases: execute arbitrary JavaScript code, convince a user to click on a crafted, cross site scripting, cross-site scripting
CVE-2022-38199: A remote file download issue can occur in some capabilities of Esri ArcGIS Server web services that may in some edge cases allow a remote, unauthenticated attacker to induce an unsuspecting victim to launch a process in the victim's PATH environment. Current browsers provide users with warnings against running unsigned executables downloaded from the internet.
Key phrases: induce an unsuspecting victim to launch a process, remote file download issue
CVE-2022-3820: An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location.
Key phrases: misuse it from any location
CVE-2022-38200: A cross site scripting vulnerability exists in some map service configurations of ArcGIS Server versions 10.8.1 and 10.7.1. Specifically crafted web requests can execute arbitrary JavaScript in the context of the victim's browser.
Key phrases: execute arbitrary JavaScript, cross site scripting, cross-site scripting
CVE-2022-38201: An unvalidated redirect vulnerability exists in Esri Portal for ArcGIS Quick Capture Web Designer versions 10.8.1 to 10.9.1. A remote, unauthenticated attacker can potentially induce an unsuspecting authenticated user to access an an attacker controlled domain.
Key phrases: unvalidated redirect
CVE-2022-38202: There is a path traversal vulnerability in Esri ArcGIS Server versions 10.9.1 and below. Successful exploitation may allow a remote, unauthenticated attacker traverse the file system to access files outside of the intended directory on ArcGIS Server. This could lead to the disclosure of sensitive site configuration information (not user datasets).
Key phrases: access files outside of the intended directory on, path traversal, disclosure
CVE-2022-38203: Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
Key phrases: forge requests to arbitrary URLs from the system, server-side request forgery (ssrf), network enumeration, reading from hosts inside the network perimeter
CVE-2022-38204: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victims browser.
Key phrases: execute arbitrary JavaScript code, create a crafted link which when clicked could, xss, arbitrary javascript code
CVE-2022-38205: In some non-default installations of Esri Portal for ArcGIS versions 10.9.1 and below, a directory traversal issue may allow a remote, unauthenticated attacker to traverse the file system and lead to the disclosure of sensitive data (not customer-published content).
Key phrases: traverse the file system and lead to the, directory traversal issue, disclosure
CVE-2022-38206: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victims browser.
Key phrases: execute arbitrary JavaScript code, create a crafted link which when clicked could, xss, arbitrary javascript code
CVE-2022-38207: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.8.1 and 10.7.1 which may allow a remote remote, unauthenticated attacker to create a crafted link which when clicked which could execute arbitrary JavaScript code in the victims browser.
Key phrases: execute arbitrary JavaScript code, create a crafted link which when clicked which, xss, arbitrary javascript code
CVE-2022-38208: There is an unvalidated redirect vulnerability in Esri Portal for ArcGIS 11 and below that may allow a remote, unauthenticated attacker to craft a URL that could redirect a victim to an arbitrary website, simplifying phishing attacks.
Key phrases: craft a URL that could redirect a victim, unvalidated redirect, phishing
CVE-2022-38209: There is a reflected XSS vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could execute arbitrary JavaScript code in the victims browser.
Key phrases: execute arbitrary JavaScript code, create a crafted link which when clicked could, xss, arbitrary javascript code
CVE-2022-3821: An off-by-one Error issue was discovered in Systemd in format_timespan() function of time-util.c. An attacker could supply specific values for time and accuracy that leads to buffer overrun in format_timespan(), leading to a Denial of Service.
Key phrases: buffer overrun, denial of service
CVE-2022-38210: There is a reflected HTML injection vulnerability in Esri Portal for ArcGIS versions 10.9.1 and below that may allow a remote, unauthenticated attacker to create a crafted link which when clicked could render arbitrary HTML in the victims browser.
Key phrases: render arbitrary HTML, create a crafted link which when clicked could, html injection, arbitrary html
CVE-2022-38211: Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.9.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38212.
Key phrases: forge requests to arbitrary URLs from the system, server-side request forgery (ssrf), network enumeration, reading from hosts inside the network perimeter
CVE-2022-38212: Protections against potential Server-Side Request Forgery (SSRF) vulnerabilities in Esri Portal for ArcGIS versions 10.8.1 and below were not fully honored and may allow a remote, unauthenticated attacker to forge requests to arbitrary URLs from the system, potentially leading to network enumeration or reading from hosts inside the network perimeter, a different issue than CVE-2022-38211 and CVE-2022-38203.
Key phrases: forge requests to arbitrary URLs from the system, server-side request forgery (ssrf), network enumeration, reading from hosts inside the network perimeter
CVE-2022-38216: An integer overflow exists in Mapbox's closed source gl-native library prior to version 10.6.1, which is bundled with multiple Mapbox products including open source libraries. The overflow is caused by large image height and width values when creating a new Image and allows for out of bounds writes, potentially crashing the Mapbox process.
Key phrases: for out of bounds writes, integer overflow, crashing the mapbox process
CVE-2022-3822: The Donations via PayPal WordPress plugin before 1.9.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2022-38220: An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary web script or HTML.
Key phrases: remote injection of arbitrary web script or HTML, xss
CVE-2022-38221: A buffer overflow in the FTcpListener thread in The Isle Evrima (the dedicated server on Windows and Linux) 0.9.88.07 before 2022-08-12 allows a remote attacker to crash any server with an accessible RCON port, or possibly execute arbitrary code.
Key phrases: execute arbitrary code, crash any server with an accessible RCON port, buffer overflow
CVE-2022-38222: There is a use-after-free issue in JBIG2Stream::close() located in JBIG2Stream.cc in Xpdf 4.04. It can be triggered by sending a crafted PDF file to (for example) the pdfimages binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.
Key phrases: cause Denial of Service or possibly have unspecified, use-after-free issue, denial of service, unspecified other impact, use after free, unspecified impact
CVE-2022-38223: There is an out-of-bounds write in checkType located in etc.c in w3m 0.5.3. It can be triggered by sending a crafted HTML file to the w3m binary. It allows an attacker to cause Denial of Service or possibly have unspecified other impact.
Key phrases: cause Denial of Service or possibly have unspecified, out-of-bounds write, denial of service, unspecified other impact, out of bounds write, unspecified impact
CVE-2022-38227: XPDF commit ffaf11c was discovered to contain a stack overflow via __asan_memcpy at asan_interceptors_memintrinsics.cpp.
Key phrases: stack overflow
CVE-2022-38228: XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-38229: XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*) at /xpdf/Stream.cc.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-3823: The Beautiful Cookie Consent Banner WordPress plugin before 2.9.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2022-38230: XPDF commit ffaf11c was discovered to contain a floating point exception (FPE) via DCTStream::decodeImage() at /xpdf/Stream.cc.
Key phrases: floating point exception (fpe)
CVE-2022-38231: XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::getChar() at /xpdf/Stream.cc.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-38233: XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::readMCURow() at /xpdf/Stream.cc.
Key phrases: segmentation violation
CVE-2022-38234: XPDF commit ffaf11c was discovered to contain a segmentation violation via Lexer::getObj(Object*) at /xpdf/Lexer.cc.
Key phrases: segmentation violation
CVE-2022-38235: XPDF commit ffaf11c was discovered to contain a segmentation violation via DCTStream::getChar() at /xpdf/Stream.cc.
Key phrases: segmentation violation
CVE-2022-38236: XPDF commit ffaf11c was discovered to contain a global-buffer overflow via Lexer::getObj(Object*) at /xpdf/Lexer.cc.
Key phrases: global-buffer overflow
CVE-2022-38237: XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::readScan() at /xpdf/Stream.cc.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-38238: XPDF commit ffaf11c was discovered to contain a heap-buffer overflow via DCTStream::lookChar() at /xpdf/Stream.cc.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-3824: The WP Admin UI Customize WordPress plugin before 1.5.13 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2022-38247: Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Settings page under the Admin panel.
Key phrases: cross-site scripting (xss)
CVE-2022-38248: Nagios XI before v5.8.7 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at auditlog.php.
Key phrases: cross-site scripting (xss)
CVE-2022-38249: Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the MTR component in version 1.0.4.
Key phrases: cross-site scripting (xss)
CVE-2022-3825: A vulnerability was found in Huaxia ERP 2.3 and classified as critical. Affected by this issue is some unknown functionality of the component User Management. The manipulation of the argument login leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212792.
Key phrases: sql injection
CVE-2022-38250: Nagios XI v5.8.6 was discovered to contain a SQL injection vulnerability via the mib_name parameter at the Manage MIBs page.
Key phrases: sql injection
CVE-2022-38251: Nagios XI v5.8.6 was discovered to contain a cross-site scripting (XSS) vulnerability via the System Performance Settings page under the Admin panel.
Key phrases: cross-site scripting (xss)
CVE-2022-38254: Nagios XI before v5.8.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the ajax.php script in CCM 3.1.5.
Key phrases: cross-site scripting (xss)
CVE-2022-38255: Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /interview/editQuestion.php.
Key phrases: sql injection
CVE-2022-38256: TastyIgniter v3.5.0 was discovered to contain a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-38258: A local file inclusion (LFI) vulnerability in D-Link DIR 819 v1.06 allows attackers to cause a Denial of Service (DoS) or access sensitive server information via manipulation of the getpage parameter in a crafted web request.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), local file inclusion (lfi), denial of service (dos)
CVE-2022-3826: A vulnerability was found in Huaxia ERP. It has been classified as problematic. This affects an unknown part of the file /depotHead/list of the component Retail Management. The manipulation of the argument search leads to information disclosure. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212793 was assigned to this vulnerability.
Key phrases: information disclosure
CVE-2022-38260: Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=questiondelete&id=.
Key phrases: sql injection
CVE-2022-38265: Apartment Visitor Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter at /avms/edit-apartment.php.
Key phrases: sql injection
CVE-2022-38266: An issue in the Leptonica linked library (v1.79.0) allows attackers to cause an arithmetic exception leading to a Denial of Service (DoS) via a crafted JPEG file.
Key phrases: Denial of Service (DoS), cause an arithmetic exception leading to a Denial, denial of service (dos)
CVE-2022-38267: School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/user/index.php?view=edit&id=.
Key phrases: sql injection
CVE-2022-38268: School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/autonumber/index.php?view=edit&id=.
Key phrases: sql injection
CVE-2022-38269: School Activity Updates with SMS Notification v1.0 was discovered to contain a SQL injection vulnerability via the component /modules/modstudent/index.php?view=edit&id=.
Key phrases: sql injection
CVE-2022-3827: A vulnerability was found in centreon. It has been declared as critical. This vulnerability affects unknown code of the file formContactGroup.php of the component Contact Groups Form. The manipulation of the argument cg_id leads to sql injection. The attack can be initiated remotely. The name of the patch is 293b10628f7d9f83c6c82c78cf637cbe9b907369. It is recommended to apply a patch to fix this issue. VDB-212794 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-38272: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list.
Key phrases: sql injection
CVE-2022-38273: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/article/list_approve.
Key phrases: sql injection
CVE-2022-38274: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/comment/list.
Key phrases: sql injection
CVE-2022-38275: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/contact/list.
Key phrases: sql injection
CVE-2022-38276: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/foldernotice/list.
Key phrases: sql injection
CVE-2022-38277: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/folderrollpicture/list.
Key phrases: sql injection
CVE-2022-38278: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/friendlylink/list.
Key phrases: sql injection
CVE-2022-38279: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/imagealbum/list.
Key phrases: sql injection
CVE-2022-3828: The Video Thumbnails WordPress plugin through 2.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2022-38280: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/image/list.
Key phrases: sql injection
CVE-2022-38281: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/site/list.
Key phrases: sql injection
CVE-2022-38282: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list.
Key phrases: sql injection
CVE-2022-38283: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/video/list.
Key phrases: sql injection
CVE-2022-38284: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/department/list.
Key phrases: sql injection
CVE-2022-38285: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/menu/list.
Key phrases: sql injection
CVE-2022-38286: JFinal CMS 5.1.0 is vulnerable to SQL Injection via /system/role/list.
Key phrases: sql injection
CVE-2022-38291: SLiMS Senayan Library Management System v9.4.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Search function. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Search bar.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-38292: SLiMS Senayan Library Management System v9.4.2 was discovered to contain multiple Server-Side Request Forgeries via the components /bibliography/marcsru.php and /bibliography/z3950sru.php.
Key phrases: server-side request forgeries
CVE-2022-38295: Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting
CVE-2022-38296: Cuppa CMS v1.0 was discovered to contain an arbitrary file upload vulnerability via the File Manager.
Key phrases: arbitrary file upload
CVE-2022-38297: UCMS v1.6.0 contains an authentication bypass vulnerability which is exploited via cookie poisoning.
Key phrases: authentication bypass, cookie poisoning
CVE-2022-38298: Appsmith v1.7.11 was discovered to allow attackers to execute an authenticated Server-Side Request Forgery (SSRF) via redirecting incoming requests to the AWS internal metadata endpoint.
Key phrases: execute an authenticated Server-Side Request Forgery, server-side request forgery (ssrf)
CVE-2022-38299: An issue in the Elasticsearch plugin of Appsmith v1.7.11 allows attackers to connect disallowed hosts to the AWS/GCP internal metadata endpoint.
Key phrases: connect disallowed hosts to the AWS/GCP
CVE-2022-3830: The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-38301: Onedev v7.4.14 contains a path traversal vulnerability which allows attackers to access restricted files and directories via uploading a crafted JAR file into the directory /opt/onedev/lib.
Key phrases: access restricted files and directories via uploading a, path traversal
CVE-2022-38302: Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_department.php.
Key phrases: sql injection
CVE-2022-38303: Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /employees/manage_leave_type.php.
Key phrases: sql injection
CVE-2022-38304: Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /maintenance/manage_leave_type.php.
Key phrases: sql injection
CVE-2022-38305: AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the component /admin/profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-38306: LIEF commit 5d1d643 was discovered to contain a heap-buffer overflow in the component /core/CorePrPsInfo.tcc.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-38307: LIEF commit 5d1d643 was discovered to contain a segmentation violation via the function LIEF::MachO::SegmentCommand::file_offset() at /MachO/SegmentCommand.cpp.
Key phrases: segmentation violation
CVE-2022-38308: TOTOLink A700RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the lang parameter in the function cstesystem. This vulnerability allows attackers to execute arbitrary commands via a crafted payload.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted payload, command injection
CVE-2022-38309: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.
Key phrases: stack overflow
CVE-2022-3831: The reCAPTCHA WordPress plugin through 1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-38310: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg.
Key phrases: stack overflow
CVE-2022-38311: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/PowerSaveSet.
Key phrases: stack overflow
CVE-2022-38312: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the list parameter at /goform/SetIpMacBind.
Key phrases: stack overflow
CVE-2022-38313: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the time parameter at /goform/saveParentControlInfo.
Key phrases: stack overflow
CVE-2022-38314: Tenda AC18 router v15.03.05.19 and v15.03.05.05 was discovered to contain a stack overflow via the urls parameter at /goform/saveParentControlInfo.
Key phrases: stack overflow
CVE-2022-3832: The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-38323: Event Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /Royal_Event/update_image.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-38325: Tenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the filePath parameter at /goform/expandDlnaFile.
Key phrases: buffer overflow
CVE-2022-38326: Tenda AC15 WiFi Router V15.03.05.19_multi and AC18 WiFi Router V15.03.05.19_multi were discovered to contain a buffer overflow via the page parameter at /goform/NatStaticSetting.
Key phrases: buffer overflow
CVE-2022-38329: An issue was discovered in Shopxian CMS 3.0.0. There is a CSRF vulnerability that can delete the specified column via index.php/contents-admin_cat-finderdel-model-ContentsCat.html?id=17.
Key phrases: csrf
CVE-2022-3833: The Fancier Author Box by ThematoSoup WordPress plugin through 1.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2022-38333: Openwrt before v21.02.3 and Openwrt v22.03.0-rc6 were discovered to contain two skip loops in the function header_value(). This vulnerability allows attackers to access sensitive information via a crafted HTTP request.
Key phrases: access sensitive information via a crafted HTTP request, skip loops
CVE-2022-38334: XPDF v4.04 and earlier was discovered to contain a stack overflow via the function Catalog::countPageTree() at Catalog.cc.
Key phrases: stack overflow
CVE-2022-38335: Vtiger CRM v7.4.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the e-mail template modules.
Key phrases: stored cross-site scripting (xss)
CVE-2022-38336: An access control issue in MobaXterm before v22.1 allows attackers to make connections to the server via the SSH or SFTP protocols without authentication.
Key phrases: make connections to the server via the SSH, access control issue
CVE-2022-38337: When aborting a SFTP connection, MobaXterm before v22.1 sends a hardcoded password to the server. The server treats this as an invalid login attempt which can result in a Denial of Service (DoS) for the user if services like fail2ban are used.
Key phrases: Denial of Service (DoS), hardcoded password, denial of service (dos)
CVE-2022-38339: Safe Software FME Server v2021.2.5, v2022.0.0.2 and below contains a cross-site scripting (XSS) vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login page.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-3834: The Google Forms WordPress plugin through 0.95 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-38340: Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a Path Traversal vulnerability via the component fmedataupload.
Key phrases: path traversal
CVE-2022-38341: Safe Software FME Server v2021.2.5 and below does not employ server-side validation.
CVE-2022-38342: Safe Software FME Server v2021.2.5, v2022.0.0.2 and below was discovered to contain a XML External Entity (XXE) vulnerability which allows authenticated attackers to perform data exfiltration or Server-Side Request Forgery (SSRF) attacks.
Key phrases: perform data exfiltration or Server-Side Request, xml external entity (xxe), server-side request forgery (ssrf)
CVE-2022-38349: An issue was discovered in Poppler 22.08.0. There is a reachable assertion in Object.h, will lead to denial of service because PDFDoc::replacePageDict in PDFDoc.cc lacks a stream check before saving an embedded file.
Key phrases: reachable assertion, denial of service
CVE-2022-3835: The Kwayy HTML Sitemap WordPress plugin before 4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2022-38351: A vulnerability in Suprema BioStar (aka Bio Star) 2 v2.8.16 allows attackers to escalate privileges to System Administrator via a crafted PUT request to the update profile page.
Key phrases: escalate privileges to System Administrator via a crafted
CVE-2022-38352: ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\\\\Flysystem\\\\Cached\\\\Storage\\\\Psr6Cache. This vulnerability allows attackers to execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload, deserialization
CVE-2022-38355: Daikin SVMPC1 version 2.1.22 and prior and SVMPC2 version 1.2.3 and prior are vulnerable to attackers with access to the local area network (LAN) to disclose sensitive information stored by the affected product without requiring authentication.
Key phrases: sensitive information
CVE-2022-38356: Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes WordPress Header Builder Plugin  Pearl plugin <=1.3.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-38357: Improper neutralization of special elements leaves the Eyes of Network Web application vulnerable to an iFrame injection attack, via the url parameter of /module/module_frame/index.php.
Key phrases: improper neutralization of special elements, iframe injection
CVE-2022-38358: Improper neutralization of input during web page generation leaves the Eyes of Network web application vulnerable to cross-site scripting attacks at /module/admin_notifiers/rules.php and /module/report_event/indext.php via the parameters rule_notification, rule_name, and rule_name_old, and at /module/admin_user/add_modify_user.php via the parameters user_name and user_email.
Key phrases: improper neutralization of input, cross-site scripting, improper neutralization of input during web page generation
CVE-2022-38359: Cross-site request forgery attacks can be carried out against the Eyes of Network web application, due to an absence of adequate protections. An attacker can, for instance, delete the admin user by directing an authenticated user to the URL https://<target-address>/module/admin_user/index.php?DataTables_Table_0_length=10&user_selected%5B%5D=1&user_mgt_list=delete_user&action=submit by means of a crafted link.
Key phrases: cross-site request forgery, cross site request forgery
CVE-2022-38362: Apache Airflow Docker's Provider prior to 3.0.0 shipped with an example DAG that was vulnerable to (authenticated) remote code exploit of code on the Airflow worker host.
Key phrases: remote code exploit
CVE-2022-38367: The Netic User Export add-on before 2.0.6 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all users from Jira by making an HTTP request to the affected endpoint.
Key phrases: export all users from Jira by making an
CVE-2022-38368: An issue was discovered in Aviatrix Gateway before 6.6.5712 and 6.7.x before 6.7.1376. Because Gateway API functions mishandle authentication, an authenticated VPN user can inject arbitrary commands.
Key phrases: inject arbitrary commands
CVE-2022-38369: Apache IoTDB version 0.13.0 is vulnerable by session id attack. Users should upgrade to version 0.13.1 which addresses this issue.
Key phrases: session id
CVE-2022-3837: The Uji Countdown WordPress plugin before 2.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-38370: Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.
Key phrases: interface without authorization
CVE-2022-38371: A vulnerability has been identified in APOGEE MBC (PPC) (BACnet) (All versions), APOGEE MBC (PPC) (P2 Ethernet) (All versions), APOGEE MEC (PPC) (BACnet) (All versions), APOGEE MEC (PPC) (P2 Ethernet) (All versions), APOGEE PXC Compact (BACnet) (All versions), APOGEE PXC Compact (P2 Ethernet) (All versions), APOGEE PXC Modular (BACnet) (All versions), APOGEE PXC Modular (P2 Ethernet) (All versions), Desigo PXC00-E.D (All versions >= V2.3), Desigo PXC00-U (All versions >= V2.3), Desigo PXC001-E.D (All versions >= V2.3), Desigo PXC100-E.D (All versions >= V2.3), Desigo PXC12-E.D (All versions >= V2.3), Desigo PXC128-U (All versions >= V2.3), Desigo PXC200-E.D (All versions >= V2.3), Desigo PXC22-E.D (All versions >= V2.3), Desigo PXC22.1-E.D (All versions >= V2.3), Desigo PXC36.1-E.D (All versions >= V2.3), Desigo PXC50-E.D (All versions >= V2.3), Desigo PXC64-U (All versions >= V2.3), Desigo PXM20-E (All versions >= V2.3), Nucleus NET for Nucleus PLUS V1 (All versions < V5.2a), Nucleus NET for Nucleus PLUS V2 (All versions < V5.4), Nucleus ReadyStart V3 V2012 (All versions < V2012.08.1), Nucleus ReadyStart V3 V2017 (All versions < V2017.02.4), Nucleus Source Code (Versions including affected FTP server), TALON TC Compact (BACnet) (All versions), TALON TC Modular (BACnet) (All versions). The FTP server does not properly release memory resources that were reserved for incomplete connection attempts by FTP clients. This could allow a remote attacker to generate a denial of service condition on devices that incorporate a vulnerable version of the FTP server.
Key phrases: generate a denial of service condition on devices
CVE-2022-38372: A hidden functionality vulnerability [CWE-1242] in FortiTester CLI 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow a local, privileged user to obtain a root shell on the device via an undocumented command.
Key phrases: obtain a root shell on the device via, cwe-1242
CVE-2022-38373: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiDeceptor management interface 4.2.0, 4.1.0 through 4.1.1, 4.0.2 may allow an authenticated user to perform a cross site scripting (XSS) attack via sending requests with specially crafted lure resource ID.
Key phrases: perform a cross site scripting (XSS), web page generation, cross site scripting (xss), improper neutralization of input during web page generation
CVE-2022-38374: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiADC 7.0.0 - 7.0.2 and 6.2.0 - 6.2.4 allows an attacker to execute unauthorized code or commands via the URL and User fields observed in the traffic and event logviews.
Key phrases: execute unauthorized code or commands via the URL, cross-site scripting, improper neutralization of input during web page generation
CVE-2022-38375: An improper authorization vulnerability [CWE-285] in Fortinet FortiNAC version 9.4.0 through 9.4.1 and before 9.2.6 allows an unauthenticated user to perform some administrative operations over the FortiNAC instance via crafted HTTP POST requests.
Key phrases: perform some administrative operations over the FortiNAC instance, cwe-285, improper authorization