yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-3513: An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. A specially crafted payload could lead to a reflected XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims on self-hosted instances running without strict CSP.
Key phrases: perform arbitrary actions, perform arbitrary actions on behalf of victims on, xss
CVE-2022-35131: Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted payload injected
CVE-2022-35132: Usermin through 1.850 allows a remote authenticated user to execute OS commands via command injection in a filename for the GPG module.
Key phrases: execute OS commands via command injection in a
CVE-2022-35133: A cross-site scripting (XSS) vulnerability in CherryTree v0.99.30 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name text field when creating a node.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-35134: Boodskap IoT Platform v4.4.9-02 contains a cross-site scripting (XSS) vulnerability.
Key phrases: cross-site scripting (xss)
CVE-2022-35135: Boodskap IoT Platform v4.4.9-02 allows attackers to escalate privileges via a crafted request sent to /api/user/upsert/<uuid>.
Key phrases: escalate privileges via a crafted request sent to, boodskap iot platform
CVE-2022-35136: Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.
Key phrases: make unauthenticated API requests, unauthenticated api requests
CVE-2022-35137: DGIOT Lightweight industrial IoT v4.5.4 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.
Key phrases: cross-site scripting (xss)
CVE-2022-3514: An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in the submodule URL parser.
Key phrases: denial of service, regex issue
CVE-2022-35142: An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-35143: Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.
Key phrases: crack user passwords via brute-force attacks, weak password complexity requirements
CVE-2022-35144: Renato v0.17.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
Key phrases: cross-site scripting (xss)
CVE-2022-35147: DoraCMS v2.18 and earlier allows attackers to bypass login authentication via a crafted HTTP request.
Key phrases: bypass login authentication, bypass login authentication via a crafted HTTP request
CVE-2022-35148: maccms10 v2021.1000.1081 to v2022.1000.3031 was discovered to contain a SQL injection vulnerability via the table parameter at database/columns.html.
Key phrases: sql injection
CVE-2022-3515: A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. The vulnerability can be exploited remotely for code execution on the target system by passing specially crafted data to the application, for example, a malicious S/MIME attachment.
Key phrases: integer overflow, code execution
CVE-2022-35150: Baijicms v4 was discovered to contain an arbitrary file upload vulnerability.
Key phrases: arbitrary file upload
CVE-2022-35151: kkFileView v4.1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the urls and currentUrl parameters at /controller/OnlinePreviewController.java.
Key phrases: cross-site scripting (xss)
CVE-2022-35153: FusionPBX 5.0.1 was discovered to contain a command injection vulnerability via /fax/fax_send.php.
Key phrases: command injection
CVE-2022-35154: Shopro Mall System v1.3.8 was discovered to contain a SQL injection vulnerability via the value parameter.
Key phrases: sql injection
CVE-2022-35155: Bus Pass Management System v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the searchdata parameter.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-35156: Bus Pass Management System 1.0 was discovered to contain a SQL Injection vulnerability via the searchdata parameter at /buspassms/download-pass.php..
Key phrases: sql injection
CVE-2022-35158: A vulnerability in the lua parser of TscanCode tsclua v2.15.01 allows attackers to cause a Denial of Service (DoS) via a crafted lua script.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-3516: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0.
Key phrases: cross-site scripting (xss)
CVE-2022-35161: GVRET Stable Release as of Aug 15, 2015 was discovered to contain a buffer overflow via the handleConfigCmd function at SerialConsole.cpp.
Key phrases: buffer overflow
CVE-2022-35162: Complete Online Job Search System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the CATEGORY parameter at /category/controller.php?action=edit.
Key phrases: cross-site scripting (xss)
CVE-2022-35163: Complete Online Job Search System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the U_NAME parameter at /category/controller.php?action=edit.
Key phrases: cross-site scripting (xss)
CVE-2022-35164: LibreDWG v0.12.4.4608 & commit f2dea29 was discovered to contain a heap use-after-free via bit_copy_chain.
Key phrases: heap use-after-free, use after free
CVE-2022-35165: An issue in AP4_SgpdAtom::AP4_SgpdAtom() of Bento4-1.6.0-639 allows attackers to cause a Denial of Service (DoS) via a crafted mp4 input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-35166: libjpeg commit 842c7ba was discovered to contain an infinite loop via the component JPEG::ReadInternal.
Key phrases: infinite loop
CVE-2022-35167: Printix Cloud Print Management v1.3.1149.0 for Windows was discovered to contain insecure permissions.
Key phrases: insecure permissions
CVE-2022-35168: Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative.
Key phrases: improper input sanitization, denial-of-service, temporarily inoperative, denial of service
CVE-2022-35169: SAP BusinessObjects Business Intelligence Platform (LCM) - versions 420, 430, allows an attacker with an admin privilege to read and decrypt LCMBIAR file's password under certain conditions, enabling the attacker to modify the password or import the file into another system causing high impact on confidentiality but a limited impact on the availability and integrity of the application.
Key phrases: read and decrypt LCMBIAR file's password under, confidentiality, availability, integrity
CVE-2022-3517: A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.
Key phrases: Denial of Service (ReDoS), a Regular Expression Denial of Service (ReDoS, regular expression denial of service (redos)
CVE-2022-35170: SAP NetWeaver Enterprise Portal does - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. This leads to limited impact on confidentiality and integrity of data.
Key phrases: cross-site scripting (xss), limited impact on confidentiality and integrity of data
CVE-2022-35171: When a user opens manipulated JPEG 2000 (.jp2, jp2k.x3d) files received from untrusted sources in SAP 3D Visual Enterprise Viewer, the application crashes and becomes temporarily unavailable to the user until restart of the application. The file format details along with their CVE relevant information can be found below
Key phrases: temporarily unavailable, application crash
CVE-2022-35172: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in reflected Cross-Site Scripting (XSS) vulnerability.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-35173: An issue was discovered in Nginx NJS v0.7.5. The JUMP offset for a break instruction was not set to a correct offset during code generation, leading to a segmentation violation.
Key phrases: segmentation violation
CVE-2022-35174: A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Tags field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-35175: Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /blotter/blotter.php.
Key phrases: sql injection
CVE-2022-3518: A vulnerability classified as problematic has been found in SourceCodester Sanitization Management System 1.0. Affected is an unknown function of the component User Creation Handler. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-211014 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-3519: A vulnerability classified as problematic was found in SourceCodester Sanitization Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Quote Requests Tab. The manipulation of the argument Manage Remarks leads to cross site scripting. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-211015.
Key phrases: cross site scripting
CVE-2022-35191: D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service (DoS) via a crafted HTTP connection request.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-35192: D-Link Wireless AC1200 Dual Band VDSL ADSL Modem Router DSL-3782 Firmware v1.01 allows unauthenticated attackers to cause a Denial of Service (DoS) via the User parameter or Pwd parameter to Login.asp.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos), user parameter, pwd parameter
CVE-2022-35193: TestLink v1.9.20 was discovered to contain a SQL injection vulnerability via /lib/execute/execNavigator.php.
Key phrases: sql injection
CVE-2022-35194: TestLink v1.9.20 was discovered to contain a stored cross-site scripting (XSS) vulnerability via /lib/inventory/inventoryView.php.
Key phrases: stored cross-site scripting (xss)
CVE-2022-35195: TestLink 1.9.20 Raijin was discovered to contain a broken access control vulnerability at /lib/attachments/attachmentdownload.php
Key phrases: broken access control
CVE-2022-35196: TestLink v1.9.20 was discovered to contain a Cross-Site Request Forgery (CSRF) via /lib/plan/planView.php.
Key phrases: cross-site request forgery (csrf)
CVE-2022-35198: Contract Management System v2.0 contains a weak default password which gives attackers to access database connection information.
Key phrases: weak default password
CVE-2022-3520: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0765.
Key phrases: heap-based buffer overflow
CVE-2022-35201: Tenda-AC18 V15.03.05.05 was discovered to contain a remote command execution (RCE) vulnerability.
Key phrases: remote command execution (rce)
CVE-2022-35203: An access control issue in TrendNet TV-IP572PI v1.0 allows unauthenticated attackers to access sensitive system information.
Key phrases: access sensitive system information, access control issue
CVE-2022-35204: Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.
Key phrases: perform a directory traversal via a crafted URL
CVE-2022-35205: An issue was discovered in Binutils readelf 2.38.50, reachable assertion failure in function display_debug_names allows attackers to cause a denial of service.
Key phrases: cause a denial of service, assertion failure
CVE-2022-35206: Null pointer dereference vulnerability in Binutils readelf 2.38.50 via function read_and_display_attr_value in file dwarf.c.
Key phrases: null pointer dereference
CVE-2022-3521: A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function kcm_tx_work of the file net/kcm/kcmsock.c of the component kcm. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211018 is the identifier assigned to this vulnerability.
Key phrases: race condition
CVE-2022-35212: osCommerce2 before v2.3.4.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the function tep_db_error().
Key phrases: cross-site scripting (xss)
CVE-2022-35213: Ecommerce-CodeIgniter-Bootstrap before commit 56465f was discovered to contain a cross-site scripting (XSS) vulnerability via the function base_url() at /blog/blogpublish.php.
Key phrases: cross-site scripting (xss)
CVE-2022-35216: OMICARD EDMs mail image relay function has a path traversal vulnerability. An unauthenticated remote attacker can exploit this vulnerability to by-pass authentication and access arbitrary system files.
Key phrases: access arbitrary system files, path traversal
CVE-2022-35217: The NHI cards web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet header length. A local area network attacker with general user privilege can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service.
Key phrases: execute arbitrary code, stack-based buffer overflow, disrupt service, stack based buffer overflow
CVE-2022-35218: The NHI cards web service component has a heap-based buffer overflow vulnerability due to insufficient validation for packet origin parameter length. A LAN attacker with general user privilege can exploit this vulnerability to disrupt service.
Key phrases: heap-based buffer overflow, disrupt service, heap based buffer overflow
CVE-2022-35219: The NHI cards web service component has a stack-based buffer overflow vulnerability due to insufficient validation for network packet key parameter. A LAN attacker with general user privilege can exploit this vulnerability to disrupt service.
Key phrases: stack-based buffer overflow, disrupt service, stack based buffer overflow
CVE-2022-35220: Teamplus Pro community discussion function has an allocation of resource without limits or throttling vulnerability. A remote attacker with general user privilege posting a thread with large content can cause the receiving client device to allocate too much memory, leading to abnormal termination of this clients Teamplus Pro application.
Key phrases: allocation of resource without limits or throttling, abnormal termination
CVE-2022-35221: Teamplus Pro community discussion has an allocation of resource without limits or throttling vulnerability on thread subject field. A remote attacker with general user privilege posting a thread subject with large content can cause the server to allocate too much memory, leading to missing partial post content and disrupt partial service.
Key phrases: allocation of resource without limits or throttling, disrupt partial service
CVE-2022-35222: HiCOS Citizen verification component has a stack-based buffer overflow vulnerability due to insufficient parameter length validation. An unauthenticated physical attacker can exploit this vulnerability to execute arbitrary code, manipulate system command or disrupt service.
Key phrases: execute arbitrary code, stack-based buffer overflow, disrupt service, stack based buffer overflow
CVE-2022-35223: EasyUse MailHunter Ultimates cookie deserialization function has an inadequate validation vulnerability. Deserializing a cookie containing malicious payload will trigger this insecure deserialization vulnerability, allowing an unauthenticated remote attacker to execute arbitrary code, manipulate system command or interrupt service.
Key phrases: execute arbitrary code, validation, insecure deserialization, interrupt service
CVE-2022-35224: SAP Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. This attack can be used to non-permanently deface or modify portal content. The execution of script content by a victim registered on the portal could compromise the confidentiality and integrity of victim?s web browser session.
Key phrases: cross-site scripting (xss), non-permanently deface, confidentiality, confidentiality and integrity
CVE-2022-35225: SAP NetWeaver Enterprise Portal - versions 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability, therefore changing the scope of the attack. This leads to limited impact on confidentiality and integrity of data.
Key phrases: cross-site scripting (xss), limited impact on confidentiality and integrity of data
CVE-2022-35226: SAP Data Services Management allows an attacker to copy the data from a request and echoed into the application's immediate response, it will lead to a Cross-Site Scripting vulnerability. The attacker would have to log in to the management console to perform such as an attack, only few of the pages are vulnerable in the DS management console.
Key phrases: copy the data from a request and echoed, cross-site scripting
CVE-2022-35227: A vulnerability in SAP NW EP (WPC) - versions 7.30, 7.31, 7.40, 7.50, which does not sufficiently validate user-controlled input, allows a remote attacker to conduct a Cross-Site (XSS) scripting attack. A successful exploit could allow the attacker to execute arbitrary script code which could lead to stealing or modifying of authentication information of the user, such as data relating to his or her current session.
Key phrases: execute arbitrary script code, conduct a Cross-Site (XSS), execute arbitrary script code which could lead to, cross-site (xss) scripting
CVE-2022-35228: SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffing or social engineering. On successful exploitation, the attacker can completely compromise the application.
Key phrases: retrieve token information over the network which would, local compromise, social engineering, exploitation, completely compromise
CVE-2022-35229: An authenticated user can create a link with reflected Javascript code inside it for the discovery page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
Key phrases: difficult to predict
CVE-2022-3523: A vulnerability was found in Linux Kernel. It has been classified as problematic. Affected is an unknown function of the file mm/memory.c of the component Driver Handler. The manipulation leads to use after free. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211020.
Key phrases: use after free
CVE-2022-35230: An authenticated user can create a link with reflected Javascript code inside it for the graphs page and send it to other users. The payload can be executed only with a known CSRF token value of the victim, which is changed periodically and is difficult to predict.
Key phrases: difficult to predict
CVE-2022-35234: Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure Vulnerability that could allow an attacker to read sensitive information from other memory locations and cause a crash on an affected machine.
Key phrases: read sensitive information from other memory locations and, out-of-bounds read information disclosure, crash
CVE-2022-35235: Authenticated (admin+) Arbitrary File Read vulnerability in XplodedThemes WPide plugin <= 2.6 at WordPress.
Key phrases: arbitrary file read
CVE-2022-35236: In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an HTTP2 profile is configured on a virtual server, undisclosed traffic can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: undisclosed traffic, increase in memory resource utilization
CVE-2022-35238: Unauthenticated Plugin Settings Change vulnerability in Awesome Filterable Portfolio plugin <= 1.9.7 at WordPress.
Key phrases: unauthenticated plugin settings change
CVE-2022-35239: The image file management page of SolarView Compact SV-CPT-MC310 Ver.7.23 and earlier, and SV-CPT-MC310F Ver.7.23 and earlier contains an insufficient verification vulnerability when uploading files. If this vulnerability is exploited, arbitrary PHP code may be executed if a remote authenticated attacker uploads a specially crafted PHP file.
Key phrases: insufficient verification
CVE-2022-3524: A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function ipv6_renew_options of the component IPv6 Handler. The manipulation leads to memory leak. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211021 was assigned to this vulnerability.
Key phrases: memory leak
CVE-2022-35240: In BIG-IP Versions 16.1.x before 16.1.2.2, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when the Message Routing (MR) Message Queuing Telemetry Transport (MQTT) profile is configured on a virtual server, undisclosed requests can cause an increase in memory resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: undisclosed requests, memory resource utilization
CVE-2022-35241: In versions 2.x before 2.3.1 and all versions of 1.x, when NGINX Instance Manager is in use, undisclosed requests can cause an increase in disk resource utilization. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: undisclosed requests, disk resource utilization
CVE-2022-35242: Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin <= 3.4.1 at WordPress.
Key phrases: unauthenticated plugin settings
CVE-2022-35243: In BIG-IP Versions 16.1.x before 16.1.3, 15.1.x before 15.1.5.1, 14.1.x before 14.1.5, and all versions of 13.1.x, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, using an undisclosed iControl REST endpoint. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: bypass Appliance mode restrictions, cross a security boundary
CVE-2022-35244: A format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X and 6.9Z. A specially-crafted XCMD can lead to memory corruption, information disclosure, and denial of service. An attacker can send a malicious XML payload to trigger this vulnerability.
Key phrases: format string injection, memory corruption, information disclosure, denial of service, malicious xml payload
CVE-2022-35245: In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5.1, when a BIG-IP APM access policy is configured on a virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: undisclosed traffic
CVE-2022-35246: A NoSQL-Injection information disclosure vulnerability vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 in the getS3FileUrl Meteor server method that can disclose arbitrary file upload URLs to users that should not be able to access.
Key phrases: disclose arbitrary file, nosql-injection, information disclosure, arbitrary file upload
CVE-2022-35247: A information disclosure vulnerability exists in Rocket.chat <v5, <v4.8.2 and <v4.7.5 where the lack of ACL checks in the getRoomRoles Meteor method leak channel members with special roles to unauthorized clients.
Key phrases: information disclosure
CVE-2022-35248: A improper authentication vulnerability exists in Rocket.Chat <v5, <v4.8.2 and <v4.7.5 that allowed two factor authentication can be bypassed when telling the server to use CAS during login.
Key phrases: improper authentication, authentication bypass
CVE-2022-35249: A information disclosure vulnerability exists in Rocket.Chat <v5 where the getUserMentionsByChannel meteor server method discloses messages from private channels and direct messages regardless of the users access permission to the room.
Key phrases: information disclosure
CVE-2022-3525: Deserialization of Untrusted Data in GitHub repository librenms/librenms prior to 22.10.0.
Key phrases: deserialization of untrusted data
CVE-2022-35250: A privilege escalation vulnerability exists in Rocket.chat <v5 which made it possible to elevate privileges for any authenticated user to view Direct messages without appropriate permissions.
Key phrases: privilege escalation, elevate privileges
CVE-2022-35251: A cross-site scripting vulnerability exists in Rocket.chat <v5 due to style injection in the complete chat window, an adversary is able to manipulate not only the style of it, but will also be able to block functionality as well as hijacking the content of targeted users. Hence the payloads are stored in messages, it is a persistent attack vector, which will trigger as soon as the message gets viewed.
Key phrases: cross-site scripting, style injection, persistent attack vector, hijack
CVE-2022-35252: When curl is used to retrieve and parse cookies from a HTTP(S) server, itaccepts cookies using control codes that when later are sent back to a HTTPserver might make the server return 400 responses. Effectively allowing a"sister site" to deny service to all siblings.
Key phrases: deny service to all siblings
CVE-2022-35254: An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.
Key phrases: denial-of-service, denial of service
CVE-2022-35255: A weak randomness in WebCrypto keygen vulnerability exists in Node.js 18 due to a change with EntropySource() in SecretKeyGenTraits::DoKeyGen() in src/crypto/crypto_keygen.cc. There are two problems with this: 1) It does not check the return value, it assumes EntropySource() always succeeds, but it can (and sometimes will) fail. 2) The random data returned byEntropySource() may not be cryptographically strong and therefore not suitable as keying material.
Key phrases: webcrypto keygen
CVE-2022-35256: The llhttp parser in the http module in Node v18.7.0 does not correctly handle header fields that are not terminated with CLRF. This may result in HTTP Request Smuggling.
Key phrases: http request smuggling
CVE-2022-35257: A local privilege escalation vulnerability in UI Desktop for Windows (Version 0.55.1.2 and earlier) allows a malicious actor with local access to a Windows device with UI Desktop to run arbitrary commands as SYSTEM.
Key phrases: run arbitrary commands, a Windows device with UI Desktop to run, local privilege escalation
CVE-2022-35258: An unauthenticated attacker can cause a denial-of-service to the following products: Ivanti Connect Secure (ICS) in versions prior to 9.1R14.3, 9.1R15.2, 9.1R16.2, and 22.2R4, Ivanti Policy Secure (IPS) in versions prior to 9.1R17 and 22.3R1, and Ivanti Neurons for Zero-Trust Access in versions prior to 22.3R1.
Key phrases: denial-of-service, denial of service
CVE-2022-35259: XML Injection with Endpoint Manager 2022. 3 and below causing a download of a malicious file to run and possibly execute to gain unauthorized privileges.
Key phrases: gain unauthorized privileges, xml injection
CVE-2022-3526: A vulnerability classified as problematic was found in Linux Kernel. This vulnerability affects the function macvlan_handle_frame of the file drivers/net/macvlan.c of the component skb. The manipulation leads to memory leak. The attack can be initiated remotely. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211024.
Key phrases: memory leak
CVE-2022-35260: curl can be told to parse a `.netrc` file for credentials. If that file endsin a line with 4095 consecutive non-white space letters and no newline, curlwould first read past the end of the stack-based buffer, and if the readworks, write a zero byte beyond its boundary.This will in most cases cause a segfault or similar, but circumstances might also cause different outcomes.If a malicious user can provide a custom netrc file to an application or otherwise affect its contents, this flaw could be used as denial-of-service.
Key phrases: denial-of-service, denial of service
CVE-2022-35261: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_authorized_keys/` API.
Key phrases: denial of service
CVE-2022-35262: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_xml_file/` API.
Key phrases: denial of service
CVE-2022-35263: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_file/` API.
Key phrases: denial of service
CVE-2022-35264: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_aaa_cert_file/` API.
Key phrases: denial of service
CVE-2022-35265: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_nodejs_app/` API.
Key phrases: denial of service
CVE-2022-35266: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_firmware/` API.
Key phrases: denial of service
CVE-2022-35267: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_https_cert_file/` API.
Key phrases: denial of service
CVE-2022-35268: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_sdk_file/` API.
Key phrases: denial of service
CVE-2022-35269: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_e2c_json_file/` API.
Key phrases: denial of service
CVE-2022-35270: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_wireguard_cert_file/` API.
Key phrases: denial of service
CVE-2022-35271: A denial of service vulnerability exists in the web_server hashFirst functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to denial of service. An attacker can send a sequence of requests to trigger this vulnerability.This denial of service is in the `/action/import_cert_file/` API.
Key phrases: denial of service
CVE-2022-35272: In BIG-IP Versions 17.0.x before 17.0.0.1 and 16.1.x before 16.1.3.1, when source-port preserve-strict is configured on an HTTP Message Routing Framework (MRF) virtual server, undisclosed traffic may cause the Traffic Management Microkernel (TMM) to produce a core file and the connection to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: undisclosed traffic
CVE-2022-35273: OS command injection vulnerability in GUI setting page of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command.
Key phrases: execute an arbitrary OS command, os command injection, execute arbitrary, arbitrary os command
CVE-2022-35275: Authenticated (shop manager+) Reflected Cross-Site Scripting (XSS) vulnerability in AlgolPlus Advanced Order Export For WooCommerce plugin <= 3.3.1 at WordPress.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-35276: Improper access control in BIOS firmware for some Intel(R) NUC 8 Compute Elements before version CBWHL357.0096 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2022-35277: Cross-Site Request Forgery (CSRF) vulnerability in GetResponse plugin <= 5.5.20 at WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-35278: In Apache ActiveMQ Artemis prior to 2.24.0, an attacker could show malicious content and/or redirect users to a malicious URL in the web console by using HTML in the name of an address or queue.
CVE-2022-35279: "IBM Business Automation Workflow 18.0.0.0, 18.0.0.1, 18.0.0.2, 19.0.0.1, 19.0.0.2, 19.0.0.3, 20.0.0.1, 20.0.0.2, 21.0.2, 21.0.3, and 22.0.1 could disclose sensitive version information to authenticated users which could be used in further attacks against the system. IBM X-Force ID: 230537."
Key phrases: sensitive version information
CVE-2022-35280: IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts. IBM X-Force ID: 230634.
Key phrases: compromise
CVE-2022-35281: IBM Maximo Asset Management 7.6.1.1, 7.6.1.2, 7.6.1.3 and the IBM Maximo Manage 8.3, 8.4 application in IBM Maximo Application Suite are vulnerable to CSV injection.  IBM X-Force ID:  2306335.
Key phrases: csv injection
CVE-2022-35282: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to server-side request forgery (SSRF). By sending a specially crafted request, an attacker with local network access could exploit this vulnerability to obtain sensitive data.
Key phrases: obtain sensitive data, server-side request forgery (ssrf), server side request forgery
CVE-2022-35283: IBM Security Verify Information Queue 10.0.2 could allow an authenticated user to cause a denial of service with a specially crafted HTTP request.
Key phrases: cause a denial of service with a specially
CVE-2022-35284: IBM Security Verify Information Queue 10.0.2 could disclose sensitive information due to a missing or insecure SameSite attribute for a sensitive cookie. IBM X-Force ID: 230811.
Key phrases: sensitive information, insecure samesite attribute
CVE-2022-35285: IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230812.
Key phrases: execute malicious and unauthorized actions transmitted from a, cross-site request forgery, cross site request forgery
CVE-2022-35286: IBM Security Verify Information Queue 10.0.2 is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts. IBM X-Force ID: 230814.
Key phrases: execute malicious and unauthorized actions transmitted from a, cross-site request forgery, cross site request forgery
CVE-2022-35287: IBM Security Verify Information Queue 10.0.2 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 230817.
Key phrases: hard-coded credentials, hard coded credentials
CVE-2022-35288: IBM Security Verify Information Queue 10.0.2 could allow a user to obtain sensitive information that could be used in further attacks against the system. IBM X-Force ID: 230818.
Key phrases: obtain sensitive information, obtain sensitive information that could be used in
CVE-2022-35289: A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.
Key phrases: execute arbitrary code, potentially execute arbitrary code via crafted JavaScript, write-what-where condition, integer overflow
CVE-2022-35290: Under certain conditions SAP Authenticator for Android allows an attacker to access information which would otherwise be restricted.
Key phrases: access information which would otherwise be restricted
CVE-2022-35291: Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC Workflow, and Benefits. On successful exploitation, the attacker can read/write attachments. Thus, compromising the confidentiality and integrity of the application
Key phrases: perform activities with admin privileges over the network, misconfigured application endpoints, confidentiality, confidentiality and integrity
CVE-2022-35292: In SAP Business One application when a service is created, the executable path contains spaces and isnt enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to gain privileged permissions on a system or network leading to high impact on Confidentiality, Integrity, and Availability.
Key phrases: gain SYSTEM privileges, gain privileged, unquoted service path, high impact on confidentiality, integrity, and availability
CVE-2022-35293: Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the application.
Key phrases: gain access, gain access to user's account, insecure session management, limited impact, confidentiality, confidentiality and integrity
CVE-2022-35294: An attacker with basic business user privileges could craft and upload a malicious file to SAP NetWeaver Application Server ABAP, which is then downloaded and viewed by other users resulting in a stored Cross-Site-Scripting attack. This could lead to information disclosure including stealing authentication information and impersonating the affected user.
Key phrases: cross-site-scripting, information disclosure, impersonate
CVE-2022-35295: In SAP Host Agent (SAPOSCOL) - version 7.22, an attacker may use files created by saposcol to escalate privileges for themselves.
Key phrases: escalate privileges
CVE-2022-35296: Under certain conditions, the application SAP BusinessObjects Business Intelligence Platform (Version Management System) exposes sensitive information to an actor over the network with high privileges that is not explicitly authorized to have access to that information, leading to a high impact on Confidentiality.
Key phrases: sensitive information, confidentiality
CVE-2022-35297: The application SAP Enable Now does not sufficiently encode user-controlled inputs over the network before it is placed in the output being served to other users, thereby expanding the attack scope, resulting in Stored Cross-Site Scripting (XSS) vulnerability leading to limited impact on Confidentiality, Integrity and Availability.
Key phrases: attack scope, stored cross-site scripting (xss), limited impact on confidentiality, integrity and availability
CVE-2022-35298: SAP NetWeaver Enterprise Portal (KMC) - version 7.50, does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting vulnerability. KMC servlet is vulnerable to XSS attack. The execution of script content by a victim registered on the portal could compromise the confidentiality and integrity of victims web browser session.
Key phrases: cross-site scripting, xss, confidentiality, confidentiality and integrity
CVE-2022-35299: SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory management to cause a memory corruption, such as Stack-based buffer overflow.
Key phrases: leverage logical errors in memory management to cause, memory corruption, stack-based buffer overflow
CVE-2022-3533: A vulnerability was found in Linux Kernel. It has been rated as problematic. This issue affects the function parse_usdt_arg of the file tools/lib/bpf/usdt.c of the component BPF. The manipulation of the argument reg_name leads to memory leak. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211031.
Key phrases: memory leak
CVE-2022-3534: A vulnerability classified as critical has been found in Linux Kernel. Affected is the function btf_dump_name_dups of the file tools/lib/bpf/btf_dump.c of the component libbpf. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211032.
Key phrases: use after free
CVE-2022-3536: The Role Based Pricing for WooCommerce WordPress plugin before 1.6.3 does not have authorisation and proper CSRF checks, as well as does not validate path given via user input, allowing any authenticated users like subscriber to perform PHAR deserialization attacks when they can upload a file, and a suitable gadget chain is present on the blog
Key phrases: perform PHAR deserialization attacks when they can upload, csrf checks, phar deserialization, gadget chain
CVE-2022-3537: The Role Based Pricing for WooCommerce WordPress plugin before 1.6.2 does not have authorisation and proper CSRF checks, and does not validate files to be uploaded, allowing any authenticated users like subscriber to upload arbitrary files, such as PHP
Key phrases: upload arbitrary files, file upload
CVE-2022-3538: The Webmaster Tools Verification WordPress plugin through 1.2 does not have authorisation and CSRF checks when disabling plugins, allowing unauthenticated users to disable arbitrary plugins
Key phrases: disable arbitrary plugins
CVE-2022-3539: The Testimonials WordPress plugin before 2.7, super-testimonial-pro WordPress plugin before 1.0.8 do not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-3540: An issue has been discovered in hunter2 affecting all versions before 2.1.0. Improper handling of auto-completion input allows an authenticated attacker to extract other users email addresses
Key phrases: extract other users email addresses, auto-completion input
CVE-2022-35401: An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_49674-ge182230. A specially-crafted HTTP request can lead to full administrative access to the device. An attacker would need to send a series of HTTP requests to exploit this vulnerability.
Key phrases: authentication bypass, administrative access, series of http requests
CVE-2022-35403: Zoho ManageEngine ServiceDesk Plus before 13008, ServiceDesk Plus MSP before 10606, and SupportCenter Plus before 11022 are affected by an unauthenticated local file disclosure vulnerability via ticket-creation email. (This also affects Asset Explorer before 6977 with authentication.)
Key phrases: unauthenticated local file disclosure
CVE-2022-35404: ManageEngine Password Manager Pro 12100 and prior and OPManager 126100 and prior are vulnerable to unauthorized file and directory creation on a server machine.
Key phrases: unauthorized file and directory creation
CVE-2022-35405: Zoho ManageEngine Password Manager Pro before 12101 and PAM360 before 5510 are vulnerable to unauthenticated remote code execution. (This also affects ManageEngine Access Manager Plus before 4303 with authentication.)
Key phrases: unauthenticated remote code execution
CVE-2022-35406: A URL disclosure issue was discovered in Burp Suite before 2022.6. If a user views a crafted response in the Repeater or Intruder, it may be incorrectly interpreted as a redirect.
Key phrases: url disclosure issue
CVE-2022-35407: An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. A stack buffer overflow leads to arbitrary code execution in the SetupUtility driver on Intel platforms. An attacker can change the values of certain UEFI variables. If the size of the second variable exceeds the size of the first, then the buffer will be overwritten. This issue affects the SetupUtility driver of InsydeH2O.
Key phrases: stack buffer overflow, arbitrary code, arbitrary code execution, buffer overwrite