yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-24165: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetQvlanList. This vulnerability allows attackers to execute arbitrary commands via the qvlanIP parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the qvlanIP parameter, command injection
CVE-2022-24166: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formSetSysTime. This vulnerability allows attackers to cause a Denial of Service (DoS) via the manualTime parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2022-24167: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 parameter.
Key phrases: execute arbitrary commands, execute arbitrary commands via the dmzHost1 parameter, command injection
CVE-2022-24168: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability allows attackers to execute arbitrary commands via the IPGroupStartIP and IPGroupEndIP parameters.
Key phrases: execute arbitrary commands, execute arbitrary commands via the IPGroupStartIP and IPGroupEndIP, command injection
CVE-2022-24169: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formIPMacBindAdd. This vulnerability allows attackers to cause a Denial of Service (DoS) via the IPMacBindRule parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2022-2417: Insufficient validation in GitLab CE/EE affecting all versions from 12.10 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1 allows an authenticated and authorised user to import a project that includes branch names which are 40 hexadecimal characters, which could be abused in supply chain attacks where a victim pinned to a specific Git commit of the project.
Key phrases: import a project that includes branch names which, insufficient validation, supply chain
CVE-2022-24170: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerability allows attackers to execute arbitrary commands via the IPsecLocalNet and IPsecRemoteNet parameters.
Key phrases: execute arbitrary commands, execute arbitrary commands via the IPsecLocalNet and IPsecRemoteNet, command injection
CVE-2022-24171: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP parameters.
Key phrases: execute arbitrary commands, execute arbitrary commands via the pppoeServerIP, command injection
CVE-2022-24172: Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a stack overflow in the function formAddDhcpBindRule. This vulnerability allows attackers to cause a Denial of Service (DoS) via the addDhcpRules parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2022-24177: A cross-site scripting (XSS) vulnerability in the component cgi-bin/ej.cgi of Ex libris ALEPH 500 v18.1 and v20 allows attackers to execute arbitrary web scripts or HTML.
Key phrases: execute arbitrary web scripts or HTML, cross-site scripting (xss)
CVE-2022-2418: A vulnerability was found in URVE Web Manager. It has been classified as critical. This affects an unknown part of the file kreator.html5/img_upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack. The exploit has been disclosed to the public and may be used.
Key phrases: unrestricted upload
CVE-2022-24181: Cross-site scripting (XSS) via Host Header injection in PKP Open Journals System 2.4.8 >= 3.3 allows remote attackers to inject arbitary code via the X-Forwarded-Host Header.
Key phrases: inject arbitary code via the X-Forwarded, cross-site scripting (xss), host header injection
CVE-2022-24187: The user_id and device_id on the Ourphoto App version 1.4.1 /device/* end-points both suffer from insecure direct object reference vulnerabilities. Other end-users user_id and device_id values can be enumerated by incrementing or decrementing id numbers. The impact of this vulnerability allows an attacker to discover sensitive information such as end-user email addresses, and their unique frame_token value of all other Ourphoto App end-users.
Key phrases: discover sensitive information such as end-user, direct object reference, insecure direct object reference
CVE-2022-24188: The /device/signin end-point for the Ourphoto App version 1.4.1 discloses clear-text password information for functionality within the picture frame devices. The deviceVideoCallPassword and mqttPassword are returned in clear-text. The lack of sessions management and presence of insecure direct object references allows to return password information for other end-users devices. Many of the picture frame devices offer video calling, and it is likely this information can be used to abuse that functionality.
Key phrases: return password information for other end-users, insecure direct object references, clear text password
CVE-2022-24189: The user_token authorization header on the Ourphoto App version 1.4.1 /apiv1/* end-points is not implemented properly. Removing the value causes all requests to succeed, bypassing authorization and session management. The impact of this vulnerability allows an attacker POST api calls with other users unique identifiers and enumerate information of all other end-users.
Key phrases: an attacker POST api calls with other users, enumerate information, bypass authorization
CVE-2022-2419: A vulnerability was found in URVE Web Manager. It has been declared as critical. This vulnerability affects unknown code of the file _internal/collector/upload.php. The manipulation leads to unrestricted upload. Access to the local network is required for this attack to succeed. The exploit has been disclosed to the public and may be used.
Key phrases: unrestricted upload
CVE-2022-24190: The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture frame, then send a POST request to accept their own bind request, without the end-users approval or interaction.
CVE-2022-24191: In HTMLDOC 1.9.14, an infinite loop in the gif_read_lzw function can lead to a pointer arbitrarily pointing to heap memory and resulting in a buffer overflow.
Key phrases: buffer overflow, infinite loop
CVE-2022-24193: CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.
Key phrases: command injection
CVE-2022-24196: iText v7.1.17, up to (exluding)": 7.1.18 and 7.2.2 was discovered to contain an out-of-memory error via the component readStreamBytesRaw, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), out-of-memory error, denial of service (dos)
CVE-2022-24197: iText v7.1.17 was discovered to contain a stack-based buffer overflow via the component ByteBuffer.append, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack-based buffer overflow, denial of service (dos), stack based buffer overflow
CVE-2022-24198: iText v7.1.17 was discovered to contain an out-of-bounds exception via the component ARCFOUREncryption.encryptARCFOUR, which allows attackers to cause a Denial of Service (DoS) via a crafted PDF file. NOTE: Vendor does not view this as a vulnerability and has not found it to be exploitable.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), out-of-bounds exception, denial of service (dos)
CVE-2022-2420: A vulnerability was found in URVE Web Manager. It has been rated as critical. This issue affects some unknown processing of the file _internal/uploader.php. The manipulation leads to unrestricted upload. The attack needs to be approached within the local network. The exploit has been disclosed to the public and may be used.
Key phrases: unrestricted upload
CVE-2022-24206: Tongda2000 v11.10 was discovered to contain a SQL injection vulnerability in /mobile_seal/get_seal.php via the DEVICE_LIST parameter.
Key phrases: sql injection
CVE-2022-2421: Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.
Key phrases: place references to functions at arbitrary places in, improper type validation
CVE-2022-24218: An issue in /admin/delete_image.php of eliteCMS v1.0 allows attackers to delete arbitrary files.
Key phrases: delete arbitrary files
CVE-2022-24219: eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_page.php.
Key phrases: sql injection
CVE-2022-2422: Due to improper input validation in the Feathers js library, it is possible to perform a SQL injection attack on the back-end database, in case the feathers-sequelize package is used.
Key phrases: sql injection, improper input validation
CVE-2022-24220: eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_post.php.
Key phrases: sql injection
CVE-2022-24221: eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php.
Key phrases: sql injection
CVE-2022-24222: eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/edit_user.php.
Key phrases: sql injection
CVE-2022-24223: AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.
Key phrases: sql injection
CVE-2022-24226: Hospital Management System v4.0 was discovered to contain a blind SQL injection vulnerability via the register function in func2.php.
Key phrases: sql injection
CVE-2022-24227: A cross-site scripting (XSS) vulnerability in BoltWire v7.10 and v 8.00 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the name and lastname parameters.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-24229: A cross-site scripting (XSS) vulnerability in ONLYOFFICE Document Server Example before v7.0.0 allows remote attackers inject arbitrary HTML or JavaScript through /example/editor.
Key phrases: inject arbitrary HTML or JavaScript, remote attackers inject arbitrary HTML or JavaScript through, cross-site scripting (xss)
CVE-2022-2423: The DW Promobar WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks when, stored cross-site scripting, unfiltered_html capability
CVE-2022-24231: Simple Student Information System v1.0 was discovered to contain a SQL injection vulnerability via add/Student.
Key phrases: sql injection
CVE-2022-24232: A local file inclusion in Hospital Patient Record Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, local file inclusion
CVE-2022-24235: A Cross-Site Request Forgery (CSRF) in the management portal of Snapt Aria v12.8 allows attackers to escalate privileges and execute arbitrary code via unspecified vectors.
Key phrases: execute arbitrary code, escalate privileges and execute arbitrary code via unspecified, cross-site request forgery (csrf), unspecified vectors
CVE-2022-24236: An insecure permissions vulnerability in Snapt Aria v12.8 allows unauthenticated attackers to send e-mails from spoofed users' accounts.
Key phrases: send e-mails from spoofed users', insecure permissions
CVE-2022-24237: The snaptPowered2 component of Snapt Aria v12.8 was discovered to contain a command injection vulnerability. This vulnerability allows authenticated attackers to execute arbitrary commands.
Key phrases: execute arbitrary commands, command injection
CVE-2022-24238: ACEweb Online Portal 3.5.065 was discovered to contain a cross-site scripting (XSS) vulnerability via the txtNmName1 parameter in person.awp.
Key phrases: cross-site scripting (xss)
CVE-2022-24239: ACEweb Online Portal 3.5.065 was discovered to contain an unrestricted file upload vulnerability via attachments.awp.
Key phrases: unrestricted file upload
CVE-2022-2424: The Google Maps Anywhere WordPress plugin through 1.2.6.3 does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks when, stored cross-site scripting, unfiltered_html capability
CVE-2022-24240: ACEweb Online Portal 3.5.065 was discovered to contain a SQL injection vulnerability via the criteria parameter in showschedule.awp.
Key phrases: sql injection
CVE-2022-24241: ACEweb Online Portal 3.5.065 was discovered to contain an External Controlled File Path and Name vulnerability via the txtFilePath parameter in attachments.awp.
Key phrases: external controlled file path and name
CVE-2022-24247: RiteCMS version 3.1.0 and below suffers from an arbitrary file overwrite via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to overwrite any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to write) resulting a remote code execution.
Key phrases: overwrite any file in the web root (, arbitrary file overwrite, path traversal, remote code execution
CVE-2022-24248: RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. Exploiting the vulnerability allows an authenticated attacker to delete any file in the web root (along with any other file on the server that the PHP process user has the proper permissions to delete). Furthermore, an attacker might leverage the capability of arbitrary file deletion to circumvent certain web server security mechanisms such as deleting .htaccess file that would deactivate those security constraints.
Key phrases: delete any file in the web root (, arbitrary file deletion via path traversal
CVE-2022-24249: A Null Pointer Dereference vulnerability exists in GPAC 1.1.0 via the xtra_box_write function in /box_code_base.c, which causes a Denial of Service. This vulnerability was fixed in commit 71f9871.
Key phrases: null pointer dereference, denial of service
CVE-2022-2425: The WP DS Blog Map WordPress plugin through 3.1.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks when, stored cross-site scripting, unfiltered_html capability
CVE-2022-24251: Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the Catalog Asset Upload function.
Key phrases: authenticated unrestricted file upload
CVE-2022-24252: An unrestricted file upload vulnerability in the FileTransferServlet component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted file, file upload, unrestricted file upload
CVE-2022-24253: Extensis Portfolio v4.0 was discovered to contain an authenticated unrestricted file upload vulnerability via the component AdminFileTransferServlet.
Key phrases: authenticated unrestricted file upload
CVE-2022-24254: An unrestricted file upload vulnerability in the Backup/Restore Archive component of Extensis Portfolio v4.0 allows remote attackers to execute arbitrary code via a crafted ZIP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted ZIP file, file upload, unrestricted file upload
CVE-2022-24255: Extensis Portfolio v4.0 was discovered to contain hardcoded credentials which allows attackers to gain administrator privileges.
Key phrases: gain administrator privileges, hardcoded credentials
CVE-2022-24259: An incorrect check in the component cdr.php of Voipmonitor GUI before v24.96 allows unauthenticated attackers to escalate privileges via a crafted request.
Key phrases: escalate privileges via a crafted request, incorrect check
CVE-2022-2426: The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators.
Key phrases: perform Stored Cross-Site Scripting attacks against, stored cross-site scripting
CVE-2022-24260: A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level.
Key phrases: escalate privileges to the Administrator level, sql injection
CVE-2022-24262: The config restore function of Voipmonitor GUI before v24.96 does not properly check files sent as restore archives, allowing remote attackers to execute arbitrary commands via a crafted file in the web root.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted file in
CVE-2022-24263: Hospital Management System v4.0 was discovered to contain a SQL injection vulnerability in /Hospital-Management-System-master/func.php via the email parameter.
Key phrases: sql injection
CVE-2022-24264: Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the search_word parameter.
Key phrases: sql injection
CVE-2022-24265: Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/menu/ via the path=component/menu/&menu_filter=3 parameter.
Key phrases: sql injection
CVE-2022-24266: Cuppa CMS v1.0 was discovered to contain a SQL injection vulnerability in /administrator/components/table_manager/ via the order_by parameter.
Key phrases: sql injection
CVE-2022-24272: An authenticated user may trigger an invariant assertion during command dispatch due to incorrect validation on the $external database. This may result in mongod denial of service or server crash. This issue affects: MongoDB Inc. MongoDB Server v5.0 versions, prior to and including v5.0.6.
Key phrases: invariant assertion, mongod denial of service, server crash
CVE-2022-24278: The package convert-svg-core before 0.6.4 are vulnerable to Directory Traversal due to improper sanitization of SVG tags. Exploiting this vulnerability is possible by using a specially crafted SVG file.
Key phrases: directory traversal
CVE-2022-24279: The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes into it. *Note:* This vulnerability derives from an incomplete fix of [CVE-2020-7701](https://security.snyk.io/vuln/SNYK-JS-MADLIBOBJECTUTILS-598676)
Key phrases: merge object prototypes into it, prototype pollution
CVE-2022-2428: A crafted tag in the Jupyter Notebook viewer in GitLab EE/CE affecting all versions before 15.1.6, 15.2 to 15.2.4, and 15.3 to 15.3.2 allows an attacker to issue arbitrary HTTP requests
Key phrases: issue arbitrary HTTP requests, arbitrary http requests
CVE-2022-24280: Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address. When the Apache Pulsar Proxy component is used, it is possible to attempt to open TCP/IP connections to any IP address and port that the Pulsar Proxy can connect to. An attacker could use this as a way for DoS attacks that originate from the Pulsar Proxy's IP address. It hasnt been detected that the Pulsar Proxy authentication can be bypassed. The attacker will have to have a valid token to a properly secured Pulsar Proxy. This issue affects Apache Pulsar Proxy versions 2.7.0 to 2.7.4; 2.8.0 to 2.8.2; 2.9.0 to 2.9.1; 2.6.4 and earlier.
Key phrases: make TCP/IP connection attempts that originate, improper input validation, dos, authentication bypass
CVE-2022-24281: A vulnerability has been identified in SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). A privileged authenticated attacker could execute arbitrary commands in the local database by sending specially crafted requests to the webserver of the affected application.
Key phrases: execute arbitrary commands, sinec nms
CVE-2022-24282: A vulnerability has been identified in SINEC NMS (All versions >= V1.0.3 < V2.0), SINEC NMS (All versions < V1.0.3), SINEMA Server V14 (All versions). The affected system allows to upload JSON objects that are deserialized to Java objects. Due to insecure deserialization of user-supplied content by the affected software, a privileged attacker could exploit this vulnerability by sending a maliciously crafted serialized Java object. This could allow the attacker to execute arbitrary code on the device with root privileges.
Key phrases: execute arbitrary code, upload JSON objects that are deserialized to Java, execute arbitrary code on the device with root, insecure deserialization, root privilege
CVE-2022-24285: Acer Care Center 4.00.30xx before 4.00.3042 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority called ACCsvc through a named pipe. In this case, the Named Pipe is also given Read and Write rights to the general user. In addition, the service program does not verify the user when communicating. A thread may exist with a specific command. When the path of the program to be executed is sent, there is a local privilege escalation in which the service program executes the path with system privileges.
Key phrases: local privilege escalation
CVE-2022-24286: Acer QuickAccess 2.01.300x before 2.01.3030 and 3.00.30xx before 3.00.3038 contains a local privilege escalation vulnerability. The user process communicates with a service of system authority through a named pipe. In this case, the Named Pipe is also given Read and Write rights to the general user. In addition, the service program does not verify the user when communicating. A thread may exist with a specific command. When the path of the program to be executed is sent, there is a local privilege escalation in which the service program executes the path with system privileges.
Key phrases: local privilege escalation
CVE-2022-24287: A vulnerability has been identified in SIMATIC PCS 7 V8.2 (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3 UC06), SIMATIC PCS 7 V9.1 (All versions < V9.1 SP1 UC01), SIMATIC WinCC Runtime Professional V16 and earlier (All versions), SIMATIC WinCC Runtime Professional V17 (All versions < V17 Upd4), SIMATIC WinCC V7.3 (All versions), SIMATIC WinCC V7.4 (All versions < V7.4 SP1 Update 21), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 8). A missing printer configuration on the host could allow an authenticated attacker to escape the WinCC Kiosk Mode.
Key phrases: escape the WinCC Kiosk Mode
CVE-2022-24288: In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI.
Key phrases: os command injection
CVE-2022-24289: Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functionality to 'remote' applications. In Apache Cayenne 4.1 and earlier, running on non-current patch versions of Java, an attacker with client access to Cayenne ROP can transmit a malicious payload to any vulnerable third-party dependency on the server. This can result in arbitrary code execution.
Key phrases: malicious payload, vulnerable third-party dependency, arbitrary code execution
CVE-2022-2429: The Ultimate SMS Notifications for WooCommerce plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 1.4.1 via the 'Export Utility' functionality. This makes it possible for authenticated attackers, such as a subscriber, to add untrusted input into billing information like their First Name that will embed into the exported CSV file triggered by an administrator and can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
Key phrases: csv injection, code execution
CVE-2022-24290: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All versions), Teamcenter V13.2 (All versions < V13.2.0.8), Teamcenter V13.3 (All versions < V13.3.0.3), Teamcenter V14.0 (All versions < V14.0.0.2). The tcserver.exe binary in affected applications is vulnerable to a stack overflow condition during the parsing of user input that may lead the binary to crash.
Key phrases: stack overflow condition, crash
CVE-2022-24291: Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
Key phrases: information disclosure, denial of service, remote code execution
CVE-2022-24292: Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
Key phrases: information disclosure, denial of service, remote code execution
CVE-2022-24293: Certain HP Print devices may be vulnerable to potential information disclosure, denial of service, or remote code execution.
Key phrases: information disclosure, denial of service, remote code execution
CVE-2022-24294: A regular expression used in Apache MXNet (incubating) is vulnerable to a potential denial-of-service by excessive resource consumption. The bug could be exploited when loading a model in Apache MXNet that has a specially crafted operator name that would cause the regular expression evaluation to use excessive resources to attempt a match. This issue affects Apache MXNet versions prior to 1.9.1.
Key phrases: denial-of-service, denial of service, resource consumption
CVE-2022-24295: Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL.
Key phrases: command injection
CVE-2022-24296: Use of a Broken or Risky Cryptographic Algorithm vulnerability in Air Conditioning System G-150AD Ver. 3.21 and prior, Air Conditioning System AG-150A-A Ver. 3.21 and prior, Air Conditioning System AG-150A-J Ver. 3.21 and prior, Air Conditioning System GB-50AD Ver. 3.21 and prior, Air Conditioning System GB-50ADA-A Ver. 3.21 and prior, Air Conditioning System GB-50ADA-J Ver. 3.21 and prior, Air Conditioning System EB-50GU-A Ver. 7.10 and prior, Air Conditioning System EB-50GU-J Ver. 7.10 and prior, Air Conditioning System AE-200J Ver. 7.97 and prior, Air Conditioning System AE-200A Ver. 7.97 and prior, Air Conditioning System AE-200E Ver. 7.97 and prior, Air Conditioning System AE-50J Ver. 7.97 and prior, Air Conditioning System AE-50A Ver. 7.97 and prior, Air Conditioning System AE-50E Ver. 7.97 and prior, Air Conditioning System EW-50J Ver. 7.97 and prior, Air Conditioning System EW-50A Ver. 7.97 and prior, Air Conditioning System EW-50E Ver. 7.97 and prior, Air Conditioning System TE-200A Ver. 7.97 and prior, Air Conditioning System TE-50A Ver. 7.97 and prior and Air Conditioning System TW-50A Ver. 7.97 and prior allows a remote unauthenticated attacker to cause a disclosure of encrypted message of the air conditioning systems by sniffing encrypted communications.
Key phrases: cause a disclosure of encrypted message of the
CVE-2022-24297: Improper buffer restrictions in firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper buffer restrictions, escalation privilege
CVE-2022-24298: All versions of package freeopcua/freeopcua are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive memory consumption by sending multiple CloseSession requests with the deleteSubscription parameter equal to False.
Key phrases: Denial of Service (DoS), denial of service (dos), memory consumption
CVE-2022-24299: Improper input validation vulnerability in pfSense CE and pfSense Plus (pfSense CE software versions prior to 2.6.0 and pfSense Plus software versions prior to 22.01) allows a remote attacker with the privilege to change OpenVPN client or server settings to execute an arbitrary command.
Key phrases: change OpenVPN client or server settings to execute, improper input validation, arbitrary command, execute arbitrary, arbitrary commands
CVE-2022-2430: The Visual Composer Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Text Block' feature in versions up to, and including, 45.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with access to the visual composer editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2022-24300: Minetest before 5.4.0 allows attackers to add or modify arbitrary meta fields of the same item stack as saved user input, aka ItemStack meta injection.
Key phrases: add or modify arbitrary meta fields of the, itemstack meta injection
CVE-2022-24301: In Minetest before 5.4.0, players can add or subtract items from a different player's inventory.
CVE-2022-24302: In Paramiko before 2.10.1, a race condition (between creation and chmod) in the write_private_key_file function could allow unauthorized information disclosure.
Key phrases: unauthorized information disclosure, race condition
CVE-2022-24303: Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled.
Key phrases: delete files because spaces in temporary pathnames are
CVE-2022-24305: Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation.
Key phrases: sensitive data leak, privilege escalation
CVE-2022-24306: Zoho ManageEngine SharePoint Manager Plus before 4329 allows account takeover because authorization is mishandled.
Key phrases: account takeover because authorization is mishandled
CVE-2022-24307: Mastodon before 3.3.2 and 3.4.x before 3.4.6 has incorrect access control because it does not compact incoming signed JSON-LD activities. (JSON-LD signing has been supported since version 1.6.0.)
Key phrases: incorrect access control
CVE-2022-24308: Automox Agent prior to version 37 on Windows and Linux and Version 36 on OSX could allow for a non privileged user to obtain sensitive information during the install process.
Key phrases: obtain sensitive information, obtain sensitive information during the install process, non privileged user
CVE-2022-24309: A vulnerability has been identified in Mendix Applications using Mendix 7 (All versions < V7.23.29), Mendix Applications using Mendix 8 (All versions < V8.18.16), Mendix Applications using Mendix 9 (All deployments with Runtime Custom Setting *DataStorage.UseNewQueryHandler* set to False). If an entity has an association readable by the user, then in some cases, Mendix Runtime may not apply checks for XPath constraints that parse said associations, within apps running on affected versions. A malicious user could use this to dump and manipulate sensitive data.
CVE-2022-2431: The Download Manager plugin for WordPress is vulnerable to arbitrary file deletion in versions up to, and including 3.2.50. This is due to insufficient file type and path validation on the deleteFiles() function found in the ~/Admin/Menu/Packages.php file that triggers upon download post deletion. This makes it possible for contributor level users and above to supply an arbitrary file path via the 'file[files]' parameter when creating a download post and once the user deletes the post the supplied arbitrary file will be deleted. This can be used by attackers to delete the /wp-config.php file which will reset the installation and make it possible for an attacker to achieve remote code execution on the server.
Key phrases: supplied arbitrary file, arbitrary file deletion, remote code execution
CVE-2022-24310: A CWE-190: Integer Overflow or Wraparound vulnerability exists that could cause heap-based buffer overflow, leading to denial of service and potentially remote code execution when an attacker sends multiple specially crafted messages. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
Key phrases: cwe-190, integer overflow, wraparound, heap-based buffer overflow, denial of service, heap based buffer overflow, remote code execution
CVE-2022-24311: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by inserting at beginning of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
Key phrases: cwe-22, remote code execution
CVE-2022-24312: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding at end of file or create a new file in the context of the Data Server potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
Key phrases: cwe-22, remote code execution
CVE-2022-24313: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
Key phrases: cwe-120, stack-based buffer overflow, stack based buffer overflow, remote code execution
CVE-2022-24314: A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
Key phrases: cwe-125, denial of service, memory leak
CVE-2022-24315: A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
Key phrases: cwe-125, denial of service
CVE-2022-24316: A CWE-665: Improper Initialization vulnerability exists that could cause information exposure when an attacker sends a specially crafted message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
Key phrases: cwe-665, information exposure
CVE-2022-24317: A CWE-862: Missing Authorization vulnerability exists that could cause information exposure when an attacker sends a specific message. Affected Product: Interactive Graphical SCADA System Data Server (V15.0.0.22020 and prior)
Key phrases: cwe-862, information exposure
CVE-2022-24318: A CWE-326: Inadequate Encryption Strength vulnerability exists that could cause non-encrypted communication with the server when outdated versions of the ViewX client are used. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)
Key phrases: cwe-326
CVE-2022-24319: A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA web server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)
Key phrases: a Man-in-theMiddle attack when, cwe-295
CVE-2022-2432: The Ecwid Ecommerce Shopping Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 6.10.23. This is due to missing or incorrect nonce validation on the ecwid_update_plugin_params function. This makes it possible for unauthenticated attackers to update plugin options granted they can trick a site administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2022-24320: A CWE-295: Improper Certificate Validation vulnerability exists that could allow a Man-in-theMiddle attack when communications between the client and Geo SCADA database server are intercepted. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)
Key phrases: a Man-in-theMiddle attack when, cwe-295
CVE-2022-24321: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause Denial of Service against the Geo SCADA server when receiving a malformed HTTP request. Affected Product: ClearSCADA (All Versions), EcoStruxure Geo SCADA Expert 2019 (All Versions), EcoStruxure Geo SCADA Expert 2020 (All Versions)
Key phrases: cwe-754, denial of service
CVE-2022-24322: A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Control Expert (V15.0 SP1 and prior)
Key phrases: cwe-119, disruption of communication
CVE-2022-24323: A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause a disruption of communication between the Modicon controller and the engineering software, when an attacker is able to intercept and manipulate specific Modbus response data. Affected Product: EcoStruxure Process Expert (V2021 and prior), EcoStruxure Control Expert (V15.0 SP1 and prior)
Key phrases: cwe-754, disruption of communication
CVE-2022-24324: A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. Affected Products: IGSS Data Server - IGSSdataServer.exe (Versions prior to V15.0.0.22073)
Key phrases: cwe-120, stack-based buffer overflow, stack based buffer overflow, remote code execution
CVE-2022-24327: In JetBrains Hub before 2021.1.13890, integration with JetBrains Account exposed an API key with excessive permissions.
Key phrases: api key, excessive permissions
CVE-2022-24328: In JetBrains Hub before 2021.1.13956, an unprivileged user could perform DoS.
Key phrases: dos
CVE-2022-24329: In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
CVE-2022-2433: The WordPress Infinite Scroll  Ajax Load More plugin for WordPress is vulnerable to deserialization of untrusted input via the 'alm_repeaters_export' parameter in versions up to, and including 5.5.3. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Key phrases: call arbitrary PHP Objects, deserialization, untrusted input, malicious actions, pop chain
CVE-2022-24330: In JetBrains TeamCity before 2021.2.1, a redirection to an external site was possible.
Key phrases: redirection
CVE-2022-24331: In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible.
Key phrases: gitlab authentication impersonation
CVE-2022-24332: In JetBrains TeamCity before 2021.2, a logout action didn't remove a Remember Me cookie.
Key phrases: remember me cookie
CVE-2022-24333: In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.
Key phrases: blind ssrf
CVE-2022-24334: In JetBrains TeamCity before 2021.2.1, the Agent Push feature allowed selection of any private key on the server.
CVE-2022-24335: JetBrains TeamCity before 2021.2 was vulnerable to a Time-of-check/Time-of-use (TOCTOU) race-condition attack in agent registration via XML-RPC.
Key phrases: time-of-check time-of-use (toctou), race condition
CVE-2022-24336: In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.
CVE-2022-24337: In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.
CVE-2022-24338: JetBrains TeamCity before 2021.2.1 was vulnerable to reflected XSS.
Key phrases: reflected xss
CVE-2022-24339: JetBrains TeamCity before 2021.2.1 was vulnerable to stored XSS.
Key phrases: stored xss
CVE-2022-2434: The String Locator plugin for WordPress is vulnerable to deserialization of untrusted input via the 'string-locator-path' parameter in versions up to, and including 2.5.0. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Key phrases: call arbitrary PHP Objects, deserialization of untrusted input, malicious actions, pop chain
CVE-2022-24340: In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.
Key phrases: xxe
CVE-2022-24341: In JetBrains TeamCity before 2021.2.1, editing a user account to change its password didn't terminate sessions of the edited user.
CVE-2022-24342: In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible.
Key phrases: url injection, csrf
CVE-2022-24343: In JetBrains YouTrack before 2021.4.31698, a custom logo could be set by a user who has read-only permissions.
CVE-2022-24344: JetBrains YouTrack before 2021.4.31698 was vulnerable to stored XSS on the Notification templates page.
Key phrases: xss
CVE-2022-24345: In JetBrains IntelliJ IDEA before 2021.2.4, local code execution (without permission from a user) upon opening a project was possible.
Key phrases: local code execution
CVE-2022-24346: In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible.
Key phrases: local code execution
CVE-2022-24347: JetBrains YouTrack before 2021.4.36872 was vulnerable to stored XSS via a project icon.
Key phrases: stored xss
CVE-2022-24348: Argo CD before 2.1.9 and 2.2.x before 2.2.4 allows directory traversal related to Helm charts because of an error in helmTemplate in repository.go. For example, an attacker may be able to discover credentials stored in a YAML file.
Key phrases: Helm charts because of an error in helmTemplate, directory traversal
CVE-2022-24349: An authenticated user can create a link with reflected XSS payload for actions pages, and send it to other users. Malicious code has access to all the same objects as the rest of the web page and can make arbitrary modifications to the contents of the page being displayed to a victim. This attack can be implemented with the help of social engineering and expiration of a number of factors - an attacker should have authorized access to the Zabbix Frontend and allowed network connection between a malicious server and victims computer, understand attacked infrastructure, be recognized by the victim as a trustee and use trusted communication channel.
Key phrases: make arbitrary modifications, xss payload, social engineering
CVE-2022-2435: The AnyMind Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.1. This is due to missing nonce protection on the createDOMStructure() function found in the ~/anymind-widget-id.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a sites administrator into performing an action such as clicking on a link.
Key phrases: cross-site request forgery
CVE-2022-24350: An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. IHISI function 0x17 verifies that the output buffer lies within the command buffer but does not verify that output data does not go beyond the end of the command buffer. In particular, the GetFlashTable function is called directly on the Command Buffer before the DataSize is check, leading to possible circumstances where the data immediately following the command buffer could be destroyed before returning a buffer size error.
CVE-2022-24351: TOCTOU race-condition vulnerability in Insyde InsydeH2O with Kernel 5.2 before version 05.27.29, Kernel 5.3 before version 05.36.29, Kernel 5.4 version before 05.44.13, and Kernel 5.5 before version 05.52.13 allows an attacker to alter data and code used by the remainder of the boot process.
Key phrases: alter data and code used by the remainder, toctou race-condition, race condition
CVE-2022-24352: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 prior to 211210 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB.ko kernel module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15773.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of TP, execute code
CVE-2022-24353: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 1.1.4 Build 20211022 rel.59103(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB.ko module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the root user. Was ZDI-CAN-15769.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of TP, execute code
CVE-2022-24354: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 prior to 1.1.4 Build 20211022 rel.59103(5553) routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB.ko module. The issue results from the lack of proper validation of user-supplied data, which can result in an integer overflow before allocating a buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15835.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of TP, integer overflow, execute code