yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-46910: An issue in the firmware update process of TP-Link TL-WA901ND V1 up to v3.11.2 and TL-WA901N V2 up to v3.12.16 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
Key phrases: execute arbitrary code, Denial of Service (DoS), execute arbitrary code or cause a Denial of, denial of service (dos)
CVE-2022-46912: An issue in the firmware update process of TP-Link TL-WR841N / TL-WA841ND V7 3.13.9 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
Key phrases: execute arbitrary code, Denial of Service (DoS), execute arbitrary code or cause a Denial of, denial of service (dos)
CVE-2022-46914: An issue in the firmware update process of TP-LINK TL-WA801N / TL-WA801ND V1 v3.12.16 and earlier allows attackers to execute arbitrary code or cause a Denial of Service (DoS) via uploading a crafted firmware image.
Key phrases: execute arbitrary code, Denial of Service (DoS), execute arbitrary code or cause a Denial of, denial of service (dos)
CVE-2022-4692: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: cross-site scripting (xss)
CVE-2022-4693: The User Verification WordPress plugin before 1.0.94 was affected by an Auth Bypass security vulnerability. To bypass authentication, we only need to know the users username. Depending on whose username we know, which can be easily queried because it is usually public data, we may even be given an administrative role on the website.
Key phrases: Bypass security vulnerability, bypass authentication, Auth Bypass, auth bypass security
CVE-2022-46934: kkFileView v4.1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the url parameter at /controller/OnlinePreviewController.java.
Key phrases: cross-site scripting (xss)
CVE-2022-4694: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: cross-site scripting (xss)
CVE-2022-46945: Nagvis before 1.9.34 was discovered to contain an arbitrary file read vulnerability via the component /core/classes/NagVisHoverUrl.php.
Key phrases: arbitrary file read
CVE-2022-46946: Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_brand.
Key phrases: sql injection
CVE-2022-46947: Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_category.
Key phrases: sql injection
CVE-2022-46949: Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_helmet.
Key phrases: sql injection
CVE-2022-4695: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: cross-site scripting (xss)
CVE-2022-46950: Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_window.
Key phrases: sql injection
CVE-2022-46951: Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_uploads.
Key phrases: sql injection
CVE-2022-46952: Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_user.
Key phrases: sql injection
CVE-2022-46953: Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=save_window.
Key phrases: sql injection
CVE-2022-46954: Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=delete_transaction.
Key phrases: sql injection
CVE-2022-46955: Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?action=save_queue.
Key phrases: sql injection
CVE-2022-46956: Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/manage_user.php.
Key phrases: sql injection
CVE-2022-46957: Sourcecodester.com Online Graduate Tracer System V 1.0.0 is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2022-46959: An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal.
Key phrases: execute a directory traversal
CVE-2022-4696: There exists a use-after-free vulnerability in the Linux kernel through io_uring and theIORING_OP_SPLICE operation. IfIORING_OP_SPLICE ismissing the IO_WQ_WORK_FILES flag, which signals that the operation won't use current->nsproxy, so its reference counter is not increased. This assumption is not always true as calling io_splice on specific files will call the get_uts function which will use current->nsproxy leading to invalidly decreasing its reference counter later causing the use-after-free vulnerability. We recommend upgrading to version 5.10.160 or above
Key phrases: use-after-free, use after free
CVE-2022-46965: PrestaShop module, totadministrativemandate before v1.7.1 was discovered to contain a SQL injection vulnerability.
Key phrases: sql injection
CVE-2022-46966: Revenue Collection System v1.0 was discovered to contain a SQL injection vulnerability at step1.php.
Key phrases: sql injection
CVE-2022-46967: An access control issue in Revenue Collection System v1.0 allows unauthenticated attackers to view the contents of /admin/DBbackup/ directory.
Key phrases: view the contents of /admin/DBbackup/ directory, access control issue
CVE-2022-46968: A stored cross-site scripting (XSS) vulnerability in /index.php?page=help of Revenue Collection System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into sent messages.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-4697: The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_user_cover_default_image_url parameter in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2022-46973: Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability.
Key phrases: server-side request forgery (ssrf)
CVE-2022-4698: The ProfilePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several form fields in versions up to, and including, 4.5.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2022-4699: The MediaElement.js WordPress plugin through 4.2.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-46996: vSphere_selfuse commit 2a9fe074a64f6a0dd8ac02f21e2f10d66cac5749 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Key phrases: access sensitive user information and digital currency keys, code execution backdoor, escalate privileges
CVE-2022-46997: Passhunt commit 54eb987d30ead2b8ebbf1f0b880aa14249323867 was discovered to contain a code execution backdoor via the request package. This vulnerability allows attackers to access sensitive user information and digital currency keys, as well as escalate privileges.
Key phrases: access sensitive user information and digital currency keys, code execution backdoor, escalate privileges
CVE-2022-46998: An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).
Key phrases: execute a Server-Side Request Forgery (, server-side request forgery (ssrf)
CVE-2022-46999: Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \\\\App\\\\Manage\\\\Controller\\\\UserController.class.php.
Key phrases: sql injection
CVE-2022-4700: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_theme' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'royal-elementor-kit' theme. If no such theme is installed doing so can also impact site availability as the site attempts to load a nonexistent theme.
Key phrases: activate the 'royal-elementor-kit, insufficient access control, site availability
CVE-2022-47002: A vulnerability in the Remember Me function of Masa CMS v7.2, 7.3, and 7.4-beta allows attackers to bypass authentication via a crafted web request.
Key phrases: bypass authentication, bypass authentication via a crafted web request, remember me function
CVE-2022-47003: A vulnerability in the Remember Me function of Mura CMS before v10.0.580 allows attackers to bypass authentication via a crafted web request.
Key phrases: bypass authentication, bypass authentication via a crafted web request
CVE-2022-47007: An issue was discovered function stab_demangle_v3_arg in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.
Key phrases: cause a denial of service due to memory, memory leaks
CVE-2022-47008: An issue was discovered function make_tempdir, and make_tempname in bucomm.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.
Key phrases: cause a denial of service due to memory, memory leaks
CVE-2022-4701: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'contact-form-7', 'media-library-assistant', or 'woocommerce' plugins if they are installed on the site.
Key phrases: activate the 'contact-form-7', insufficient access control
CVE-2022-47010: An issue was discovered function pr_function_type in prdbg.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.
Key phrases: cause a denial of service due to memory, memory leaks
CVE-2022-47011: An issue was discovered function parse_stab_struct_fields in stabs.c in Binutils 2.34 thru 2.38, allows attackers to cause a denial of service due to memory leaks.
Key phrases: cause a denial of service due to memory, memory leaks
CVE-2022-47012: Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21.
Key phrases: uninitialized variable
CVE-2022-47015: MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service. It is possible for function spider_db_mbase::print_warnings to dereference a null pointer.
Key phrases: denial of service, null pointer
CVE-2022-4702: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on the site unless it is part of an extremely limited hardcoded selection. This also switches the site to the 'royal-elementor-kit' theme, potentially resulting in availability issues.
Key phrases: deactivate every plugin on the site unless it, insufficient access control, availability issues, hardcoded
CVE-2022-47021: A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows attackers to cause denial of service or other unspecified impacts.
Key phrases: cause denial of service or other unspecified impacts, null pointer dereference
CVE-2022-47022: An issue was discovered in open-mpi hwloc 2.1.0 allows attackers to cause a denial of service or other unspecified impacts via glibc-cpuset in topology-linux.c.
Key phrases: cause a denial of service or other unspecified, unspecified impacts
CVE-2022-47024: A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows attackers to cause denial of service or other unspecified impacts.
Key phrases: cause denial of service or other unspecified impacts, null pointer dereference
CVE-2022-47027: Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionary traversal vulnerability and achieve arbitrary code execution.
Key phrases: achieve arbitrary code execution, overwrite arbitrary files in its internal storage via, dictionary traversal
CVE-2022-47028: An issue discovered in Action Launcher for Android v50.5 allows an attacker to cause a denial of service via arbitary data injection to function insert.
Key phrases: cause a denial of service via arbitary data, arbitary data injection
CVE-2022-47029: An issue was found in Action Launcher v50.5 allows an attacker to escalate privilege via modification of the intent string to function update.
Key phrases: escalate privilege via modification of the intent string
CVE-2022-4703: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to reset previously imported data.
Key phrases: reset previously imported data, insufficient access control
CVE-2022-47034: A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.
Key phrases: bypass authentication, type juggling
CVE-2022-47035: Buffer Overflow Vulnerability in D-Link DIR-825 v1.33.0.44ebdd4-embedded and below allows attacker to execute arbitrary code via the GetConfig method to the /CPE endpoint.
Key phrases: execute arbitrary code, execute arbitrary code via the GetConfig method to, buffer overflow
CVE-2022-4704: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site configuration templates including images and settings.
Key phrases: import preset site configuration templates including images and, insufficient access control
CVE-2022-47040: An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command after placing a crafted file in the /tmp directory and sending crafted packets through port 80.
Key phrases: escalate privileges via running the tcpdump command after
CVE-2022-47042: MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.
Key phrases: arbitrary file write
CVE-2022-4705: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to finalize activation of preset site configuration templates, which can be chosen and imported via a separate action documented in CVE-2022-4704.
Key phrases: finalize activation of preset site configuration templates, insufficient access control
CVE-2022-47052: The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perform Reflected XSS and HTML Injection. A malicious unauthenticated attacker can exploit this vulnerability using a specially crafted URL. This affects firmware versions: V1.1.0.112_1.0.1, V1.1.0.114_1.0.1.
Key phrases: crlf injection, reflected xss, html injection
CVE-2022-47053: An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to execute arbitrary code via a crafted SVG file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted SVG file, arbitrary file upload
CVE-2022-4706: The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47065: TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload, stack overflow, affects products
CVE-2022-47069: p7zip 16.02 was discovered to contain a heap-buffer-overflow vulnerability via the function NArchive::NZip::CInArchive::FindCd(bool) at CPP/7zip/Archive/Zip/ZipIn.cpp.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2022-4707: The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenticated attackers to create Mega Menu templates, granted they can trick an administrator into performing an action, such as clicking a link.
Key phrases: create Mega Menu templates, cross-site request forgery
CVE-2022-47070: NVS365 V01 is vulnerable to Incorrect Access Control. After entering a wrong password, the url will be sent to the server twice. In the second package, the server will return the correct password information.
Key phrases: incorrect access control
CVE-2022-47071: In NVS365 V01, the background network test function can trigger command execution.
Key phrases: command execution
CVE-2022-47073: A cross-site scripting (XSS) vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-47075: An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.
Key phrases: download sensitive information via the action name parameter
CVE-2022-47076: An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx.
Key phrases: view sensitive information via DisplayParallelLogData.aspx
CVE-2022-4708: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to modify the conditions under which templates are displayed.
Key phrases: modify the conditions under which templates are displayed, insufficient access control
CVE-2022-47083: Spitfire CMS 1.0.475 is vulnerable to PHP Object Injection.
Key phrases: php object injection
CVE-2022-47085: An issue was discovered in ostree before 2022.7 allows attackers to cause a denial of service or other unspecified impacts via the print_panic function in repo_checkout_filter.rs.
Key phrases: cause a denial of service or other unspecified, unspecified impacts
CVE-2022-47086: GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentation violation via the function gf_sm_load_init_swf at scene_manager/swf_parse.c
Key phrases: segmentation violation
CVE-2022-47087: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b has a Buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c
Key phrases: buffer overflow
CVE-2022-47088: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow.
Key phrases: buffer overflow
CVE-2022-47089: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow via gf_vvc_read_sps_bs_internal function of media_tools/av_parsers.c
Key phrases: buffer overflow
CVE-2022-4709: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import and activate templates from the plugin's template library.
Key phrases: import and activate templates from the plugin's, insufficient access control
CVE-2022-47091: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow in gf_text_process_sub function of filters/load_text.c
Key phrases: buffer overflow
CVE-2022-47092: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is contains an Integer overflow vulnerability in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8316
Key phrases: integer overflow
CVE-2022-47093: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to heap use-after-free via filters/dmx_m2ts.c:470 in m2tsdmx_declare_pid
Key phrases: heap use-after-free, use after free
CVE-2022-47094: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Null pointer dereference via filters/dmx_m2ts.c:343 in m2tsdmx_declare_pid
Key phrases: null pointer dereference
CVE-2022-47095: GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer overflow in hevc_parse_vps_extension function of media_tools/av_parsers.c
Key phrases: buffer overflow
CVE-2022-4710: The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter in the 'data_fetch' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is occurring because 'sanitize_text_field' is insufficient to prevent attribute-based Cross-Site Scripting
Key phrases: inject arbitrary web scripts, reflected cross-site scripting, attribute-based cross-site scripting
CVE-2022-47100: A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802.15.4 frame.
Key phrases: arbitrarily perform a factory reset on the device
CVE-2022-47102: A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the name parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-47105: Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.
Key phrases: sql injection
CVE-2022-4711: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to enable and modify Mega Menu settings for any menu item.
Key phrases: enable and modify Mega Menu settings for any, insufficient access control
CVE-2022-47115: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47116: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the SYSPS parameter at /goform/SysToolChangePwd.
Key phrases: stack overflow
CVE-2022-47117: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47118: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47119: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-4712: The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site in versions up to, and including, 9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, cross-site scripting
CVE-2022-47120: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47121: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47122: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd_5g parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47123: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey3 parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47124: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey4 parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47125: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47126: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47127: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wrlPwd parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47128: Tenda A15 V15.13.07.13 was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasicSet.
Key phrases: stack overflow
CVE-2022-47129: PHPOK v6.3 was discovered to contain a remote code execution (RCE) vulnerability.
Key phrases: remote code execution (rce)
CVE-2022-47130: A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows a discount coupon to be arbitrarily created if an attacker with administrative privileges interacts on the CSRF page.
Key phrases: be arbitrarily created if an attacker with administrative, cross-site request forgery (csrf), discount coupon
CVE-2022-47131: A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows an attacker to arbitrarily create a page.
Key phrases: arbitrarily create a page, cross-site request forgery (csrf)
CVE-2022-47132: A Cross-Site Request Forgery (CSRF) in Academy LMS before v5.10 allows attackers to arbitrarily add Administrator users.
Key phrases: arbitrarily add Administrator users, cross-site request forgery (csrf)
CVE-2022-47134: Cross-Site Request Forgery (CSRF) vulnerability in Bill Erickson Gallery Metabox plugin <=1.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47135: Cross-Site Request Forgery (CSRF) vulnerability in chronoengine.Com Chronoforms plugin <=7.0.9 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47136: Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables  Best Data Table Plugin for WordPress plugin <=4.3.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47137: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPManageNinja LLC Ninja Tables plugin <=4.3.4 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47138: Cross-Site Request Forgery (CSRF) vulnerability in German Krutov LOGIN AND REGISTRATION ATTEMPTS LIMIT plugin <=2.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47139: Cross-Site Request Forgery (CSRF) vulnerability in Damir Calusic WP Basic Elements plugin <=5.2.15 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-4714: The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-47140: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember plugin <=4.0.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-47141: Cross-Site Request Forgery (CSRF) vulnerability in Seerox WP Dynamic Keywords Injector plugin <=2.3.15 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47142: Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic  Media Library Folders plugin <=2.8.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47143: Cross-Site Request Forgery (CSRF) vulnerability in Themeisle Multiple Page Generator Plugin  MPG plugin <=3.3.9 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47144: Cross-Site Request Forgery (CSRF) vulnerability in Plugincraft Mediamatic  Media Library Folders plugin <=2.8.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47145: Reflected Cross-Site Scripting (XSS) vulnerability in Blockonomics WordPress Bitcoin Payments  Blockonomics plugin <=3.5.7 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-47146: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Contempoinc Real Estate 7 WordPress theme <=3.3.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-47147: Cross-Site Request Forgery (CSRF) vulnerability in Kesz1 Technologies ipBlockList plugin <=1.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47148: Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <=3.2.5 leading to popup dismiss.
Key phrases: cross-site request forgery (csrf), popup dismiss
CVE-2022-47149: Cross-Site Request Forgery (CSRF) vulnerability in Pretty Links plugin <=3.4.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-4715: The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47152: Cross-Site Request Forgery (CSRF) vulnerability in Etison, LLC ClickFunnels plugin <=3.1.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47154: Cross-Site Request Forgery (CSRF) vulnerability in Pi Websolution CSS JS Manager, Async JavaScript, Defer Render Blocking CSS supports WooCommerce plugin <=2.4.49 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47155: Cross-Site Request Forgery (CSRF) vulnerability in Supsystic Slider by Supsystic plugin<= 1.8.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47157: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Don Benjamin WP Custom Fields Search plugin <=1.2.34 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47158: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Pakpobox alfred24 Click & Collect plugin <=1.1.7 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47159: Cross-Site Request Forgery (CSRF) vulnerability in Logaster Logaster Logo Generator plugin <=1.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-4716: The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47161: Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <=1.5.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47162: Cross-Site Request Forgery (CSRF) vulnerability in Dannie Herdyawan DH  Anti AdBlocker plugin <=36 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47163: Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database  Insert CSV file content into WordPress plugin <=2.6 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47164: Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <=3.7.7 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47165: Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule plugin <=3.3.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47166: Cross-Site Request Forgery (CSRF) vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin <=2.1.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47167: Cross-Site Request Forgery (CSRF) vulnerability in Aram Kocharyan Crayon Syntax Highlighter plugin <=2.8.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47169: Cross-Site Request Forgery (CSRF) vulnerability in StaxWP Visibility Logic for Elementor plugin <=2.3.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-4717: The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47170: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <=1.5.48 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47171: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul C. Schroeder IP Vault  WP Firewall plugin <=1.1 versions.
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2022-47172: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <=2.6.2 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47173: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nasirahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms  Advanced Form Integration plugin <=1.62.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47174: Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <=2.2.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47175: Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <=1.3.75 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47177: Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay  Square for WordPress plugin <=4.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47178: Cross-Site Request Forgery (CSRF) vulnerability in Simple Share Buttons Simple Share Buttons Adder plugin <=8.4.7 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47179: Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <=5.6.11leads to post duplicationas a draft.
Key phrases: cross-site request forgery (csrf), post duplicationas
CVE-2022-4718: The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47180: Cross-Site Request Forgery (CSRF) vulnerability in Kopa Theme Kopa Framework plugin <=1.3.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47181: Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2.
Key phrases: Cross Site Request Forgery, cross-site request forgery (csrf), cross site request forgery
CVE-2022-47183: Cross-Site Request Forgery (CSRF) vulnerability in StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin <=0.2.6 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47184: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0.
Key phrases: exposure of sensitive information
CVE-2022-47185: Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1.
Key phrases: improper input validation
CVE-2022-47186: There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory.
Key phrases: unrestricted upload of file
CVE-2022-47187: There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file.
Key phrases: upload a file with HTML content, file upload xss
CVE-2022-47188: There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path.
Key phrases: obtain the content of this path., arbitrary file reading, default credentials,
CVE-2022-47189: Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device.
Key phrases: disrupt the normal functionality of the device, incorrect configuration
CVE-2022-4719: Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Key phrases: business logic errors
CVE-2022-47190: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root.
Key phrases: execute arbitrary code, upload a firmware file containing a webshell that, execute arbitrary code as root
CVE-2022-47191: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a file with modified permissions, allowing him to escalate privileges.
Key phrases: upload a firmware file containing a file with, escalate privileges, modified permissions
CVE-2022-47192: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a backup file containing a modified "users.json" to the web server of the device, allowing him to replace the administrator password.
Key phrases: upload a backup file containing a modified ", replace the administrator password
CVE-2022-47194: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `twitter` field for a user.
Key phrases: inject arbitrary Javascript, inject arbitrary Javascript in posts, administrator via XSS, insecure default, privilege escalation, xss, arbitrary javascript
CVE-2022-47195: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `facebook` field for a user.
Key phrases: inject arbitrary Javascript, inject arbitrary Javascript in posts, administrator via XSS, insecure default, privilege escalation, xss, arbitrary javascript
CVE-2022-47196: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_head` for a post.
Key phrases: inject arbitrary Javascript, inject arbitrary Javascript in posts, administrator via XSS, privilege escalation, xss, arbitrary javascript
CVE-2022-47197: An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. Default installations of Ghost allow non-administrator users to inject arbitrary Javascript in posts, which allow privilege escalation to administrator via XSS. To trigger this vulnerability, an attacker can send an HTTP request to inject Javascript in a post to trick an administrator into visiting the post.A stored XSS vulnerability exists in the `codeinjection_foot` for a post.
Key phrases: inject arbitrary Javascript, inject arbitrary Javascript in posts, administrator via XSS, privilege escalation, xss, arbitrary javascript
CVE-2022-4720: Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Key phrases: open redirect
CVE-2022-47208: The puhttpsniff service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication.
Key phrases: execute arbitrary commands, command injection
CVE-2022-47209: A support user exists on the device and appears to be a backdoor for Technical Support staff. The default password for this account is support and cannot be changed by a user via any normally accessible means.
Key phrases: backdoor, default password
CVE-2022-4721: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Key phrases: special element injection
CVE-2022-47210: The default console presented to users over telnet (when enabled) is restricted to a subset of commands. Commands issued at this console, however, appear to be fed directly into a system call or other similar function. This allows any authenticated user to execute arbitrary commands on the device.
Key phrases: execute arbitrary commands, execute arbitrary commands on the device
CVE-2022-47211: Microsoft Office Graphics Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-47212: Microsoft Office Graphics Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-47213: Microsoft Office Graphics Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-4722: Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Key phrases: Bypass by Primary Weakness in GitHub repository ikus060, Authentication Bypass, authentication bypass
CVE-2022-4723: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Key phrases: allocation of resources
CVE-2022-4724: Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5.
Key phrases: improper access control
CVE-2022-4725: A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affected component. The identifier VDB-216737 was assigned to this vulnerability.
Key phrases: server-side request forgery, server side request forgery
CVE-2022-4726: A vulnerability classified as critical was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-216739.
Key phrases: sql injection
CVE-2022-4727: A vulnerability, which was classified as problematic, was found in OpenMRS Appointment Scheduling Module up to 1.16.x. This affects the function getNotes of the file api/src/main/java/org/openmrs/module/appointmentscheduling/AppointmentRequest.java of the component Notes Handler. The manipulation of the argument notes leads to cross site scripting. It is possible to initiate the attack remotely. Upgrading to version 1.17.0 is able to address this issue. The name of the patch is 2ccbe39c020809765de41eeb8ee4c70b5ec49cc8. It is recommended to upgrade the affected component. The identifier VDB-216741 was assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-4728: A vulnerability has been found in Graphite Web and classified as problematic. This vulnerability affects unknown code of the component Cookie Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. VDB-216742 is the identifier assigned to this vulnerability.