yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-47488: In spipe drive, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47489: In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-4749: The Posts List Designer by Category WordPress plugin before 3.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47490: In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Key phrases: permission check, local denial of service
CVE-2022-47491: In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47492: In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Key phrases: permission check, local denial of service
CVE-2022-47493: In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.
Key phrases: permission check, local denial of service
CVE-2022-47494: In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47495: In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47496: In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47497: In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47498: In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47499: In soter service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-4750: The WP Responsive Testimonials Slider And Widget WordPress plugin through 1.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47500: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Apache Software Foundation Apache Helix UI component.This issue affects Apache Helix all releases from 0.8.0 to 1.0.4.Solution: removed the the forward component since it was improper designed for UI embedding.User please upgrade to 1.1.0 to fix this issue.
Key phrases: url redirection to untrusted site, open redirect
CVE-2022-47501: Arbitrary file reading vulnerability in Apache Software Foundation Apache OFBiz when using the Solr plugin. This is apre-authentication attack.This issue affects Apache OFBiz: before 18.12.07.
Key phrases: arbitrary file reading
CVE-2022-47502: Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose.Links can be activated by clicks, or by automatic document events.The execution of such links must be subject to user approval.In the affected versions of OpenOffice, approval for certain links is not   requested; when activated, such links could therefore result in arbitrary script execution.
Key phrases: arbitrary script execution
CVE-2022-47503: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
Key phrases: execute arbitrary commands, SolarWinds Web Console to execute arbitrary commands, deserialization of untrusted data
CVE-2022-47504: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
Key phrases: execute arbitrary commands, SolarWinds Web Console to execute arbitrary commands, deserialization of untrusted data
CVE-2022-47505: The SolarWinds Platform was susceptible to the Local Privilege Escalation Vulnerability. This vulnerability allows a local adversary with a valid system user account to escalate local privileges.
Key phrases: escalate local privileges, local privilege escalation
CVE-2022-47506: SolarWinds Platform was susceptible to the Directory Traversal Vulnerability. This vulnerability allows a local adversary with authenticated account access to edit the default configuration, enabling the execution of arbitrary commands.
Key phrases: edit the default configuration, directory traversal, arbitrary commands
CVE-2022-47507: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
Key phrases: execute arbitrary commands, SolarWinds Web Console to execute arbitrary commands, deserialization of untrusted data
CVE-2022-47508: Customers who had configured their polling to occur via Kerberos did not expect NTLM Traffic on their environment, but since we were querying for data via IP address this prevented us from utilizing Kerberos.
Key phrases: ntlm traffic
CVE-2022-47509: The SolarWinds Platform was susceptible to the Incorrect Input Neutralization Vulnerability. This vulnerability allows a remote adversary with a valid SolarWinds Platform account to append URL parameters to inject HTML.
Key phrases: append URL parameters to inject HTML, incorrect input neutralization
CVE-2022-4751: The Word Balloon WordPress plugin before 4.19.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47512: Sensitive information was stored in plain text in a file that is accessible by a user with a local account in Hybrid Cloud Observability (HCO)/ SolarWinds Platform 2022.4. No other versions are affected
Key phrases: sensitive information, plain text
CVE-2022-47514: An XML external entity (XXE) injection vulnerability in XML-RPC.NET before 2.5.0 allows remote authenticated users to conduct server-side request forgery (SSRF) attacks, as demonstrated by a pingback.aspx POST request.
Key phrases: conduct server-side request forgery (SSRF, xml external entity (xxe) injection, server-side request forgery (ssrf), server side request forgery
CVE-2022-47515: An issue was discovered in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a long message in a TCP request that leads to std::length_error.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash, std::length_error
CVE-2022-47516: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.20. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that leads to a failure of the libsofia-sip-ua/tport/tport.c self assertion.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash, self assertion
CVE-2022-47517: An issue was discovered in the libsofia-sip fork in drachtio-server before 0.8.19. It allows remote attackers to cause a denial of service (daemon crash) via a crafted UDP message that causes a url_canonize2 heap-based buffer over-read because of an off-by-one error.
Key phrases: denial of service (daemon crash), cause a denial of service (daemon crash, heap-based buffer over-read, off-by-one error, buffer over read
CVE-2022-47518: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of the number of channels in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when copying the list of operating channels from Wi-Fi management frames.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2022-47519: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_OPER_CHANNEL in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger an out-of-bounds write when parsing the channel list attribute from Wi-Fi management frames.
Key phrases: out-of-bounds write, out of bounds write
CVE-2022-4752: The Opening Hours WordPress plugin through 2.3.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47520: An issue was discovered in the Linux kernel before 6.0.11. Missing offset validation in drivers/net/wireless/microchip/wilc1000/hif.c in the WILC1000 wireless driver can trigger an out-of-bounds read when parsing a Robust Security Network (RSN) information element from a Netlink packet.
Key phrases: out-of-bounds read, out of bounds read
CVE-2022-47521: An issue was discovered in the Linux kernel before 6.0.11. Missing validation of IEEE80211_P2P_ATTR_CHANNEL_LIST in drivers/net/wireless/microchip/wilc1000/cfg80211.c in the WILC1000 wireless driver can trigger a heap-based buffer overflow when parsing the operating channel attribute from Wi-Fi management frames.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2022-47522: The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frames by spoofing a target's MAC address, sending Power Save frames to the access point, and then sending other frames to the access point (such as authentication frames or re-association frames) to remove the target's original security context. This behavior occurs because the specifications do not require an access point to purge its transmit queue before removing a client's pairwise encryption key.
Key phrases: intercept (possibly cleartext) target-destined, spoofing
CVE-2022-47523: Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.
Key phrases: sql injection
CVE-2022-47524: F-Secure SAFE Browser 19.1 before 19.2 for Android allows an IDN homograph attack.
Key phrases: an IDN homograph attack, idn homograph
CVE-2022-47525: Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a Divide-by-Zero vulnerability in the packet parser. A remote attacker could leverage this vulnerability to cause a denial-of-service. Exploitation of this issue does not require user interaction.
Key phrases: divide-by-zero, denial-of-service, denial of service
CVE-2022-47526: Fox-IT DataDiode (aka Fox DataDiode) 3.4.3 suffers from a path traversal vulnerability with resultant arbitrary writing of files. A remote attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the downstream node user. Exploitation of this issue does not require user interaction.
Key phrases: achieve arbitrary code execution, path traversal, arbitrary writing of files
CVE-2022-47529: Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protection features via ACL modification.
Key phrases: modify the endpoint agent service configuration: to, memory objects
CVE-2022-4753: The Print-O-Matic WordPress plugin before 2.1.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47531: An issue was discovered in Ericsson Evolved Packet Gateway (EPG) versions 3.x before 3.25 and 2.x before 2.16, allows authenticated users to bypass system CLI and execute commands they are authorized to execute directly in the UNIX shell.
Key phrases: bypass system CLI and execute commands they are authorized
CVE-2022-47532: FileRun 20220519 allows SQL Injection via the "dir" parameter in a /?module=users&section=cpanel&page=list request.
Key phrases: SQL Injection via the "dir" parameter, sql injection
CVE-2022-4754: The Easy Social Box / Page Plugin WordPress plugin through 4.1.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47542: Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privileges.
Key phrases: incorrect access control, escalation of privileges
CVE-2022-47543: An issue was discovered in Siren Investigate before 12.1.7. There is an ACL bypass on global objects.
Key phrases: bypass on global objects, ACL bypass, acl bypass
CVE-2022-47544: An issue was discovered in Siren Investigate before 12.1.7. Script variable whitelisting is insufficiently sandboxed.
Key phrases: script variable whitelisting, insufficiently sandboxed
CVE-2022-47547: GossipSub 1.1, as used for Ethereum 2.0, allows a peer to maintain a positive score (and thus not be pruned from the network) even though it continuously misbehaves by never forwarding topic messages.
Key phrases: maintain a positive score (and thus not
CVE-2022-47549: An unprotected memory-access operation in optee_os in TrustedFirmware Open Portable Trusted Execution Environment (OP-TEE) before 3.20 allows a physically proximate adversary to bypass signature verification and install malicious trusted applications via electromagnetic fault injections.
Key phrases: bypass signature verification, bypass signature verification and install malicious trusted applications, unprotected memory-access operation, electromagnetic fault injections
CVE-2022-4755: A vulnerability was found in FlatPress and classified as problematic. This issue affects the function main of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component Media Manager Plugin. The manipulation of the argument mm-newgallery-name leads to cross site scripting. The attack may be initiated remotely. The name of the patch is d3f329496536dc99f9707f2f295d571d65a496f5. It is recommended to apply a patch to fix this issue. The identifier VDB-216869 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2022-47551: Apiman 1.5.7 through 2.2.3.Final has insufficient checks for read permissions within the Apiman Manager REST API. The root cause of the issue is the Apiman project's accidental acceptance of a large contribution that was not fully compatible with the security model of Apiman versions before 3.0.0.Final. Because of this, 3.0.0.Final is not affected by the vulnerability.
CVE-2022-47553: Incorrect authorisation in ekorCCP and ekorRCI, which could allow a remote attacker to obtain resources with sensitive information for the organisation, without being authenticated within the web server.
Key phrases: obtain resources with sensitive information, obtain resources with sensitive information for the organisation, incorrect authorisation
CVE-2022-47554: Exposure of sensitive information in ekorCCP and ekorRCI, potentially allowing a remote attacker to obtain critical information from various .xml files, including .xml files containing credentials, without being authenticated within the web server.
Key phrases: obtain critical information, obtain critical information from various .xml files, exposure of sensitive information
CVE-2022-47555: Operating system command injection in ekorCCP and ekorRCI, which could allow an authenticated attacker to execute commands, create new users with elevated privileges or set up a backdoor.
Key phrases: execute commands, operating system command injection, elevated privileges
CVE-2022-47556: Uncontrolled resource consumption in ekorRCI, allowing an attacker with low-privileged access to the web server to send continuous legitimate web requests to a functionality that is not properly validated, in order to cause a denial of service (DoS) on the device.
Key phrases: denial of service (DoS), the web server to send continuous legitimate web, uncontrolled resource consumption, denial of service (dos)
CVE-2022-47557: Vulnerability in ekorCCP and ekorRCI that could allow an attacker with access to the network where the device is located to decrypt the credentials of privileged users, and subsequently gain access to the system to perform malicious actions.
Key phrases: gain access, the network where the device is located to, ekorrci
CVE-2022-47558: Devices ekorCCP and ekorRCI are vulnerable due to access to the FTP service using default credentials. Exploitation of this vulnerability can allow an attacker to modify critical files that could allow the creation of new users, delete or modify existing users, modify configuration files, install rootkits or backdoors.
Key phrases: modify critical files that could allow the creation, the creation of new users, ftp service, default credentials, default credentials,
CVE-2022-47559: Lack of device control over web requests in ekorCCP and ekorRCI, allowing an attacker to create customised requests to execute malicious actions when a user is logged in, affecting availability, privacy and integrity.
Key phrases: create customised requests to execute malicious actions when, availability, privacy, integrity
CVE-2022-4756: The My YouTube Channel WordPress plugin before 3.23.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47560: The lack of web request control on ekorCCP and ekorRCI devices allows a potential attacker to create custom requests to execute malicious actions when a user is logged in.
Key phrases: create custom requests to execute malicious actions when, web request control
CVE-2022-47561: The web application stores credentials in clear text in the "admin.xml" file, which can be accessed without logging into the website, which could allow an attacker to obtain credentials related to all users, including admin users, in clear text, and use them to subsequently execute malicious actions.
Key phrases: obtain credentials, obtain credentials related to all users, clear text, malicious actions
CVE-2022-47562: Vulnerability in the RCPbind service running on UDP port (111), allowing a remote attacker to create a denial of service (DoS) condition.
Key phrases: denial of service (DoS), create a denial of service (DoS), denial of service (dos) condition
CVE-2022-4757: The List Pages Shortcode WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47577: An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by making use of a virtual machine (VM). This allows a file to be exchanged outside the laptop/system. VMs can be created by any user (even without admin rights). The data exfiltration can occur without any record in the audit trail of Windows events on the host machine. NOTE: the vendor's position is "it's not a vulnerability in our product."
Key phrases: bypass the USB restrictions, be exchanged outside the laptop/system, data exfiltration
CVE-2022-47578: An issue was discovered in the endpoint protection agent in Zoho ManageEngine Device Control Plus 10.1.2228.15. Despite configuring complete restrictions on USB pendrives, USB HDD devices, memory cards, USB connections to mobile devices, etc., it is still possible to bypass the USB restrictions by booting into Safe Mode. This allows a file to be exchanged outside the laptop/system. Safe Mode can be launched by any user (even without admin rights). Data exfiltration can occur, and also malware might be introduced onto the system. NOTE: the vendor's position is "it's not a vulnerability in our product."
Key phrases: bypass the USB restrictions, be exchanged outside the laptop/system, data exfiltration
CVE-2022-4758: The 10WebMapBuilder WordPress plugin before 1.0.72 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47581: Isode M-Vault 16.0v0 through 17.x before 17.0v24 can crash upon an LDAP v1 bind request.
Key phrases: crash, ldap bind request
CVE-2022-47583: Terminal character injection in Mintty before 3.6.3 allows code execution via unescaped output to the terminal.
Key phrases: the terminal, terminal character injection, unescaped output, code execution
CVE-2022-47586: Unauth. SQL Injection (SQLi) vulnerability in Themefic Ultimate Addons for Contact Form 7 plugin <=3.1.23 versions.
Key phrases: sql injection (sqli)
CVE-2022-47587: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Cornel Raiu WP Search Analytics plugin <=1.4.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47588: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1.8.1.
Key phrases: SQL Injection, sql command, sql injection
CVE-2022-47589: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in this.Functional CTT Expresso para WooCommerce plugin<= 3.2.11 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-4759: The GigPress WordPress plugin before 2.3.28 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47590: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Fugu Maintenance Switch plugin <=1.5.2 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-47591: Reflected Cross-Site Scripting (XSS) vulnerability in Mickael Austoni Map Multi Marker plugin<= 3.2.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-47592: Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <=0.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-47593: Auth. (subscriber+) SQL Injection (SQLi) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize plugin <=1.6.35 versions.
Key phrases: sql injection (sqli)
CVE-2022-47595: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Go Maps (formerly WP Google Maps) plugin <=9.0.15 versions.
Key phrases: path traversal
CVE-2022-47596: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin<= 1.9.9 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47597: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker  Popup for opt-ins, lead gen, & more.This issue affects Popup Maker  Popup for opt-ins, lead gen, & more: from n/a through 1.17.1.
Key phrases: exposure of sensitive information
CVE-2022-47598: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Plugins Pro WP Super Popup plugin<= 1.1.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47599: Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager  100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager  100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7.
Key phrases: deserialization of untrusted data
CVE-2022-4760: The OneClick Chat to Order WordPress plugin before 1.0.4.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47600: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Mass Email To users plugin <=1.1.4 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-47602: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in JoomUnited WP Table Manager plugin <=3.5.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47603: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery  Image and Video Gallery with Thumbnails plugin <=2.0.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-47605: Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <=3.7.0 versions.
Key phrases: sql injection
CVE-2022-47606: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Stephenson WP-CORS plugin <=0.2.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47607: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Usersnap plugin <=4.16 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47608: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <=8.0.3.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47609: Cross-Site Request Forgery (CSRF) vulnerability in Nicearma DNUI plugin <=2.8.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-4761: The Post Views Count WordPress plugin through 3.0.2 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47610: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mr Digital Simple Image Popup plugin <=1.3.6 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47611: Cross-Site Request Forgery (CSRF) vulnerability in Julian Weinert // cs&m Hover Image plugin <=1.4.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47612: Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <=2.4.5 leads tolist column update.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47613: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud AI ChatBot plugin <=4.3.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47614: Unauth. SQL Injection (SQLi) vulnerability in InspireUI MStore API plugin <=3.9.7 versions.
Key phrases: sql injection (sqli)
CVE-2022-47615: Local File Inclusion vulnerability inLearnPress  WordPress LMS Plugin <= 4.1.7.3.2 versions.
Key phrases: local file inclusion
CVE-2022-47616: Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an administrator, can use the management page to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service.
Key phrases: execute arbitrary system command, insufficient filtering, command injection, disrupt service
CVE-2022-47617: Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an administrator can decrypt system files using the hard-coded keys for file access, modification, and cause service disruption.
Key phrases: hard-coded encryption decryption keys, hard-coded keys, service disruption
CVE-2022-47618: Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials. An unauthenticated remote attacker can use these credentials to log in administrator page, to manipulate system or disrupt service.
Key phrases: administrator credentials, disrupt service
CVE-2022-4762: The Materialis Companion WordPress plugin before 1.3.40 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47629: Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser.
Key phrases: integer overflow
CVE-2022-4763: The Icon Widget WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47630: Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state.
Key phrases: obtain sensitive information, out-of-bounds read, dangerous read side effects, out of bounds read
CVE-2022-47631: Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\\\\Razer\\\\Synapse3\\\\Service\\\\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if it detects malicious DLLs in this directory, attackers can exploit a race condition and replace a valid DLL (i.e., a copy of a legitimate Razer DLL) with a malicious DLL after the service has already checked the file. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows.
Key phrases: obtain administrative privileges, an unsafe installation path and improper privilege management, race condition, privilege escalation
CVE-2022-47632: Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\\\\Razer\\\\Synapse3\\\\Service\\\\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if the malicious DLLs are unsigned, it suffices to use self-signed DLLs. The validity of the DLL signatures is not checked. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows.
Key phrases: obtain administrative privileges, an unsafe installation path, privilege escalation, improper privilege management, improper certificate validation
CVE-2022-47633: An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations are available for impacted releases.
Key phrases: image signature validation bypass, inject unsigned arbitrary container images into a protected, impacted releases, man in the middle
CVE-2022-47634: M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access and manipulate archive data via certain HTTP endpoints, aka LINK-2867.
Key phrases: access and manipulate archive data via certain HTTP
CVE-2022-47635: Wildix WMS 6 before 6.02.20221216, WMS 5 before 5.04.20221214, and WMS4 before 4.04.45396.23 allows Server-side request forgery (SSRF) via ZohoClient.php.
Key phrases: Server-side request forgery (SSRF), server-side request forgery (ssrf)
CVE-2022-47636: A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Language), the application will load the following DLLs from the same directory av_libGLESv2.dll, libcef.DLL, user32.dll, and d3d10warp.dll. Using a crafted DLL, it is possible to execute arbitrary code in the context of the current logged in user.
Key phrases: execute arbitrary code, dll hijacking
CVE-2022-47637: The installer in XAMPP through 8.1.12 allows local users to write to the C:\\\\xampp directory. Common use cases execute files under C:\\\\xampp with administrative privileges.
Key phrases: write to the C:\\\\xampp directory
CVE-2022-4764: The Simple File Downloader WordPress plugin through 1.0.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47648: An Improper Access Control vulnerability allows an attacker to access the control panel of the B420 without requiring any sort of authorization or authentication due to the IP based authorization. If an authorized user has accessed a publicly available B420 product using valid credentials, an insider attacker can gain access to the same panel without requiring any sort of authorization. The B420 module was already obsolete at the time this vulnerability was found (The End of Life announcement was made in 2013).
Key phrases: gain access, access the control panel of the B420 without, improper access control
CVE-2022-4765: The Portfolio for Elementor WordPress plugin before 2.3.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47653: GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in eac3_update_channels function of media_tools/av_parsers.c:9113
Key phrases: buffer overflow
CVE-2022-47654: GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8261
Key phrases: buffer overflow
CVE-2022-47655: Libde265 1.0.9 is vulnerable to Buffer Overflow in function void put_qpel_fallback<unsigned short>
Key phrases: buffer overflow
CVE-2022-47656: GPAC MP4box 2.1-DEV-rev617-g85ce76efd is vulnerable to Buffer Overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:8273
Key phrases: buffer overflow
CVE-2022-47657: GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function hevc_parse_vps_extension of media_tools/av_parsers.c:7662
Key phrases: buffer overflow
CVE-2022-47658: GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function gf_hevc_read_vps_bs_internal of media_tools/av_parsers.c:8039
Key phrases: buffer overflow
CVE-2022-47659: GPAC MP4box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to Buffer Overflow in gf_bs_read_data
Key phrases: buffer overflow
CVE-2022-4766: A vulnerability was found in dolibarr_project_timesheet up to 4.5.5. It has been declared as problematic. This vulnerability affects unknown code of the component Form Handler. The manipulation leads to cross-site request forgery. The attack can be initiated remotely. Upgrading to version 4.5.6.a is able to address this issue. The name of the patch is 082282e9dab43963e6c8f03cfaddd7921de377f4. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216880.
Key phrases: cross-site request forgery, cross site request forgery
CVE-2022-47660: GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is has an integer overflow in isomedia/isom_write.c
Key phrases: integer overflow
CVE-2022-47661: GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 is vulnerable to Buffer Overflow via media_tools/av_parsers.c:4988 in gf_media_nalu_add_emulation_bytes
Key phrases: buffer overflow
CVE-2022-47662: GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault (/stack overflow) due to infinite recursion in Media_GetSample isomedia/media.c:662
Key phrases: segment fault, stack overflow
CVE-2022-47663: GPAC MP4box 2.1-DEV-rev649-ga8f438d20 is vulnerable to buffer overflow in h263dmx_process filters/reframe_h263.c:609
Key phrases: buffer overflow
CVE-2022-47664: Libde265 1.0.9 is vulnerable to Buffer Overflow in ff_hevc_put_hevc_qpel_pixels_8_sse
Key phrases: buffer overflow
CVE-2022-47665: Libde265 1.0.9 has a heap buffer overflow vulnerability in de265_image::set_SliceAddrRS(int, int, int)
Key phrases: heap buffer overflow
CVE-2022-4767: Denial of Service in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: denial of service
CVE-2022-47673: An issue was discovered in Binutils addr2line before 2.39.3, function parse_module contains multiple out of bound reads which may cause a denial of service or other unspecified impacts.
Key phrases: out of bound reads, denial of service, unspecified impacts
CVE-2022-4768: A vulnerability was found in Dropbox merou. It has been classified as critical. Affected is the function add_public_key of the file grouper/public_key.py of the component SSH Public Key Handler. The manipulation of the argument public_key_str leads to injection. It is possible to launch the attack remotely. The name of the patch is d93087973afa26bc0a2d0a5eb5c0fde748bdd107. It is recommended to apply a patch to fix this issue. VDB-216906 is the identifier assigned to this vulnerability.
Key phrases: injection
CVE-2022-4769: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the target path on host when a file is uploaded with an invalid character in its name.
Key phrases: invalid character, file upload
CVE-2022-47695: An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function bfd_mach_o_get_synthetic_symtab in match-o.c.
Key phrases: cause a denial of service or other unspecified, unspecified impacts
CVE-2022-47696: An issue was discovered Binutils objdump before 2.39.3 allows attackers to cause a denial of service or other unspecified impacts via function compare_symbols.
Key phrases: cause a denial of service or other unspecified, unspecified impacts
CVE-2022-47697: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Account takeover. Anyone can reset the password of the admin accounts.
Key phrases: account takeover
CVE-2022-47698: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS) via the URL filtering feature in the router.
Key phrases: cross site scripting (xss)
CVE-2022-47699: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Incorrect Access Control.
Key phrases: incorrect access control
CVE-2022-4770: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.0 and 9.3.0.2, including 8.3.x display the full parametrized SQL query in an error message when an invalid character is used within a Pentaho Report (*.prpt).
Key phrases: invalid character
CVE-2022-47700: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 and before is vulnerable to Incorrect Access Control. Improper authentication allows requests to be made to back-end scripts without a valid session or authentication.
Key phrases: be made to back-end scripts without, incorrect access control, improper authentication
CVE-2022-47701: COMFAST (Shenzhen Sihai Zhonglian Network Technology Co., Ltd) CF-WR623N Router firmware V2.3.0.1 is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2022-47703: TIANJIE CPE906-3 is vulnerable to password disclosure. This is present on Software Version WEB5.0_LCD_20200513, Firmware Version MV8.003, and Hardware Version CPF906-V5.0_LCD_20200513.
Key phrases: password disclosure
CVE-2022-4771: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow a malicious URL to inject content into the Pentaho User Console through session variables.
Key phrases: inject content into the Pentaho User Console through, session variables
CVE-2022-47714: Last Yard 22.09.8-1 does not enforce HSTS headers
Key phrases: hsts headers
CVE-2022-47715: In Last Yard 22.09.8-1, the cookie can be stolen via via unencrypted traffic.
Key phrases: cookie, unencrypted traffic
CVE-2022-47717: Last Yard 22.09.8-1 is vulnerable to Cross-origin resource sharing (CORS).
Key phrases: cross-origin resource sharing (cors)
CVE-2022-4772: A vulnerability was found in Widoco and classified as critical. Affected by this issue is the function unZipIt of the file src/main/java/widoco/WidocoUtils.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is f2279b76827f32190adfa9bd5229b7d5a147fa92. It is recommended to apply a patch to fix this issue. VDB-216914 is the identifier assigned to this vulnerability.
Key phrases: path traversal
CVE-2022-4773: ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as problematic was found in cloudsync. Affected by this vulnerability is the function getItem of the file src/main/java/cloudsync/connector/LocalFilesystemConnector.java. The manipulation leads to path traversal. It is possible to launch the attack on the local host. The name of the patch is 3ad796833398af257c28e0ebeade68518e0e612a. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216919. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: path traversal
CVE-2022-47732: In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing admin hash, allowing, once cracked, to login inside the Configuration Panel, otherwise, replacing the hash in the archive and restoring it on the device which will change admin password granting access to the device.
Key phrases: login inside the Configuration Panel
CVE-2022-4774: The Bit Form WordPress plugin before 1.9 does not validate the file types uploaded via it's file upload form field, allowing unauthenticated users to upload arbitrary files types such as PHP or HTML files to the server, leading to Remote Code Execution.
Key phrases: upload arbitrary files types, upload arbitrary files types such as PHP or, remote code execution, file upload
CVE-2022-47740: Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.
Key phrases: sql injection
CVE-2022-47745: ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. After logging in with any user, you can complete SQL injection by constructing a special request and sending it to function importNotice.
Key phrases: sql injection
CVE-2022-47747: kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.
Key phrases: arbitrary file read
CVE-2022-4775: The GeoDirectory WordPress plugin before 2.2.22 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47757: In imo.im 2022.11.1051, a path traversal vulnerability delivered via an unsanitized deeplink can force the application to write a file into the application's data directory. This may allow an attacker to save a shared library under a special directory which the app uses to dynamically load modules. Loading the library can lead to arbitrary code execution.
Key phrases: save a shared library under a special directory, path traversal, arbitrary code execution, to write files
CVE-2022-47758: Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.
Key phrases: execute arbitrary code, execute arbitrary code via a DNS hijacking attack, tls verification, dns hijacking
CVE-2022-4776: The CC Child Pages WordPress plugin before 1.43 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47762: In gin-vue-admin < 2.5.5, the download module has a Path Traversal vulnerability.
Key phrases: path traversal