yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-47766: PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.
Key phrases: file upload
CVE-2022-47767: A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. This affects all Solar-Log devices that use firmware version v4.2.7 up to v5.1.1 (included).
Key phrases: the attacker, backdoor
CVE-2022-47768: Serenissima Informatica Fast Checkin 1.0 is vulnerable to Directory Traversal.
Key phrases: directory traversal
CVE-2022-47769: An arbitrary file write vulnerability in Serenissima Informatica Fast Checkin v1.0 allows unauthenticated attackers to upload malicious files in the web root of the application to gain access to the server via the web shell.
Key phrases: gain access, upload malicious files in the web root of, arbitrary file write
CVE-2022-4777: The Bootstrap Shortcodes WordPress plugin through 3.4.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47770: Serenissima Informatica Fast Checkin version v1.0 is vulnerable to Unauthenticated SQL Injection.
Key phrases: unauthenticated sql injection
CVE-2022-4778: StreamX applications from versions 6.02.01 to 6.04.34 are affected by a path traversal vulnerability that allows authenticated users to get unauthorized access to files on the server's filesystem.StreamX applications using StreamView HTML component with the public web server feature activated are affected.
Key phrases: get unauthorized access to files on the server, path traversal
CVE-2022-47780: SQL Injection vulnerability in Bangresto 1.0 via the itemID parameter.
Key phrases: sql injection
CVE-2022-4779: StreamX applications from versions 6.02.01 to 6.04.34 are affected by a logic bug that allows to bypass the implemented authentication scheme.StreamX applications using StreamView HTML component with the public web server feature activated are affected. 
Key phrases: bypass the implemented authentication, bypass the implemented authentication scheme, logic bug
CVE-2022-47790: Sourcecodester Dynamic Transaction Queuing System v1.0 is vulnerable to SQL Injection via /queuing/index.php?page=display&id=.
Key phrases: sql injection
CVE-2022-4780: ISOS firmwares from versions 1.81 to 2.00 contain hardcoded credentials from embedded StreamX installer that integrators are not forced to change.
Key phrases: hardcoded credentials
CVE-2022-4781: The Accordion Shortcodes WordPress plugin through 2.4.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-4782: The ClickFunnels WordPress plugin through 3.1.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-4783: The Youtube Channel Gallery WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-4784: The Hueman Addons WordPress plugin through 2.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47848: An issue was discovered in Bezeq Vtech NB403-IL version BZ_2.02.07.09.13.01 and Vtech IAD604-IL versions BZ_2.02.07.09.13.01, BZ_2.02.07.09.13T, and BZ_2.02.07.09.09T, allows remote attackers to gain sensitive information via rootDesc.xml page of the UPnP service.
Key phrases: gain sensitive information, gain sensitive information via rootDesc.xml page of the
CVE-2022-4785: The Video Sidebar Widgets WordPress plugin through 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47853: TOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell through a specially constructed payload.
Key phrases: obtain a stable root shell through a specially constructed payload, command injection
CVE-2022-47854: i-librarian 4.10 is vulnerable to Arbitrary file upload in ajaxsupplement.php.
Key phrases: arbitrary file upload
CVE-2022-47859: Lead Management System v1.0 is vulnerable to SQL Injection via the user_id parameter in changePassword.php.
Key phrases: sql injection
CVE-2022-4786: The Video.js WordPress plugin through 4.5.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47860: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeProduct.php.
Key phrases: sql injection
CVE-2022-47861: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeLead.php.
Key phrases: sql injection
CVE-2022-47862: Lead Management System v1.0 is vulnerable to SQL Injection via the customer_id parameter in ajax_represent.php.
Key phrases: sql injection
CVE-2022-47864: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeCategories.php.
Key phrases: sql injection
CVE-2022-47865: Lead Management System v1.0 is vulnerable to SQL Injection via the id parameter in removeOrder.php.
Key phrases: sql injection
CVE-2022-47866: Lead management system v1.0 is vulnerable to SQL Injection via the id parameter in removeBrand.php.
Key phrases: sql injection
CVE-2022-4787: Themify Shortcodes WordPress plugin before 2.0.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-47870: A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows remote attackers to inject arbitrary web Script or HTML via the returnUrl parameter.
Key phrases: inject arbitrary web Script or HTML, inject arbitrary web Script or HTML via the, cross site scripting (xss)
CVE-2022-47872: maccms10 2021.1000.2000 is vulnerable to Server-side request forgery (SSRF).
Key phrases: server-side request forgery (ssrf)
CVE-2022-47873: Netcad KEOS 1.0 is vulnerable to XML External Entity (XXE) resulting in SSRF with XXE (remote).
Key phrases: xml external entity (xxe)
CVE-2022-47874: Improper Access Control in /tc/rpc in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to view details of database connections via class 'com.jedox.etl.mngr.Connections' and method 'getGlobalConnection'.
Key phrases: view details of database connections via class ', improper access control
CVE-2022-47875: A Directory Traversal vulnerability in /be/erpc.php in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to execute arbitrary code.
Key phrases: execute arbitrary code, directory traversal
CVE-2022-47876: The integrator in Jedox GmbH Jedox 2020.2.5 allows remote authenticated users to create Jobs to execute arbitrary code via Groovy-scripts.
Key phrases: execute arbitrary code, create Jobs to execute arbitrary code via Groovy
CVE-2022-47877: A Stored cross-site scripting vulnerability in Jedox 2020.2.5 allows remote, authenticated users to inject arbitrary web script or HTML in the Logs page via the log module 'log'.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML in the, stored cross-site scripting
CVE-2022-47878: Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify the location as Webroot directory. Consecutive file uploads can lead to the execution of arbitrary code.
Key phrases: specify the location as Webroot directory, incorrect input validation, arbitrary code, file upload
CVE-2022-47879: A Remote Code Execution (RCE) vulnerability in /be/rpc.php in Jedox 2020.2.5 allows remote authenticated users to load arbitrary PHP classes from the 'rtn' directory and execute its methods.
Key phrases: load arbitrary PHP classes, load arbitrary PHP classes from the 'rtn, remote code execution (rce)
CVE-2022-4788: The Embed PDF WordPress plugin through 1.0.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47880: An Information disclosure vulnerability in /be/rpc.php in Jedox GmbH Jedox 2020.2.5 allow remote, authenticated users with permissions to modify database connections to disclose a connections' cleartext password via the 'test connection' function.
Key phrases: modify database connections to disclose a connections', information disclosure, cleartext password
CVE-2022-47881: Foxit PDF Reader and PDF Editor 11.2.1.53537 and earlier has an Out-of-Bounds Read vulnerability.
Key phrases: out-of-bounds read
CVE-2022-4789: The WPZOOM Portfolio WordPress plugin before 1.2.2 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-47891: All versions of NetMan 204 allow an attacker that knows the MAC and serial number of the device to reset the administrator password via the legitimate recovery function.
Key phrases: reset the administrator password via the legitimate recovery
CVE-2022-47892: All versions of NetMan 204 could allow an unauthenticated remote attacker to read a file (config.cgi) containing sensitive information, like credentials.
Key phrases: read a file (config.cgi) containing sensitive, sensitive information
CVE-2022-47893: There is a remote code execution vulnerability that affects all versions of NetMan 204. A remote attacker could upload a firmware file containing a webshell, that could allow him to execute arbitrary code as root.
Key phrases: execute arbitrary code, execute arbitrary code as root, remote code execution
CVE-2022-47895: In JetBrains IntelliJ IDEA before 2022.3.1 the "Validate JSP File" action used the HTTP protocol to download required JAR files.
CVE-2022-47896: In JetBrains IntelliJ IDEA before 2022.3.1 code Templates were vulnerable to SSTI attacks.
Key phrases: code templates
CVE-2022-4790: The WP Google My Business Auto Publish WordPress plugin before 3.4 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-47908: Stack-based buffer overflow vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.
Key phrases: execute arbitrary code, obtain the information, obtain the information and/or execute arbitrary code by, stack-based buffer overflow, stack based buffer overflow
CVE-2022-47909: Livestatus Query Language (LQL) injection in the AuthUser HTTP query header ofTribe29's Checkmk <= 2.1.0p11, Checkmk <= 2.0.0p28, and all versions of Checkmk 1.6.0 (EOL) allows an attacker to perform direct queries to the application's core from localhost.
Key phrases: perform direct queries to the application's core, livestatus query language (lql) injection
CVE-2022-4791: The Product Slider and Carousel with Category for WooCommerce WordPress plugin before 2.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-47911: Sewios Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 does not properly validate the input module name to the backup services of the software. This could allow a remote attacker to access sensitive functions of the application and execute arbitrary system commands.
Key phrases: execute arbitrary system commands, access sensitive functions of the application and execute
CVE-2022-47915: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2022-47917: Sewios Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to improper input validation of user input to several modules and services of the software. This could allow an attacker to delete arbitrary files and cause a denial-of-service condition.
Key phrases: delete arbitrary files, delete arbitrary files and cause a denial-, improper input validation, denial-of-service condition, denial of service
CVE-2022-4792: The News & Blog Designer Pack WordPress plugin before 3.3 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-47924: An high privileged attacker may pass crafted arguments to the validate function of csaf-validator-lib of a locally installed Secvisogram in versions < 0.1.0 wich can result in arbitrary code execution and DoS once the users triggers the validation.
Key phrases: arbitrary code execution, dos
CVE-2022-47925: The validate JSON endpoint of the Secvisogram csaf-validator-service in versions < 0.1.0 processes tests with unexpected names. This insufficient input validation of requests by an unauthenticated remote user might lead to a partial DoS of the service. Only the request of the attacker is affected by this vulnerability.
Key phrases: insufficient input validation
CVE-2022-47926: AyaCMS 3.1.2 is vulnerable to file deletion via /aya/module/admin/fst_del.inc.php
Key phrases: file deletion
CVE-2022-47927: An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data.
Key phrases: weak permissions
CVE-2022-47928: In MISP before 2.4.167, there is XSS in the template file uploads in app/View/Templates/upload_file.ctp.
Key phrases: xss, file upload
CVE-2022-47929: In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a denial of service (system crash) via a crafted traffic control configuration that is set up with "tc qdisc" and "tc class" commands. This affects qdisc_graft in net/sched/sch_api.c.
Key phrases: denial of service (system crash), trigger a denial of service (system crash, null pointer dereference bug
CVE-2022-4793: The Blog Designer WordPress plugin before 2.4.1 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-47930: An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.
Key phrases: replay a valid proof sent in the past
CVE-2022-47931: IO FinNet tss-lib before 2.0.0 allows a collision of hash values.
Key phrases: a collision of hash values
CVE-2022-47932: Brave Browser before 1.43.34 allowed a remote attacker to cause a denial of service via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This vulnerability is caused by an incomplete fix for CVE-2022-47933.
Key phrases: denial of service
CVE-2022-47933: Brave Browser before 1.42.51 allowed a remote attacker to cause a denial of service via a crafted HTML file that references the IPFS scheme. This vulnerability is caused by an uncaught exception in the function ipfs::OnBeforeURLRequest_IPFSRedirectWork() in ipfs_redirect_network_delegate_helper.cc.
Key phrases: denial of service, uncaught exception
CVE-2022-47934: Brave Browser before 1.43.88 allowed a remote attacker to cause a denial of service in private and guest windows via a crafted HTML file that mentions an ipfs:// or ipns:// URL. This is caused by an incomplete fix for CVE-2022-47932 and CVE-2022-47934.
Key phrases: denial of service
CVE-2022-47935: A vulnerability has been identified in JT Open (All versions < V11.1.1.0), JT Utilities (All versions < V13.1.1.0), Solid Edge (All versions < V2023). The Jt1001.dll contains a memory corruption vulnerability while parsing specially crafted JT files. An attacker could leverage this vulnerability to execute code in the context of the current process. (ZDI-CAN-19078)
Key phrases: memory corruption, execute code
CVE-2022-47936: A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0), Parasolid V34.0 (All versions < V34.0.252), Parasolid V34.1 (All versions < V34.1.242), Parasolid V35.0 (All versions < V35.0.170), Parasolid V35.1 (All versions < V35.1.150). The affected application contains a stack overflow vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, stack overflow
CVE-2022-47937: ** UNSUPPORTED WHEN ASSIGNED ** Improper input validation in the Apache Sling Commons JSON bundle allows an attacker to trigger unexpected errors by supplying specially-crafted input.NOTE: This vulnerability only affects products that are no longer supported by the maintainerThe org.apache.sling.commons.json bundle has been deprecated as of March 2017 and should not be used anymore. Consumers are encouraged to consider the Apache Sling Commons Johnzon OSGi bundle provided by the Apache Sling project, but may of course use other JSON libraries.
Key phrases: trigger unexpected errors by supplying specially-crafted, improper input validation
CVE-2022-47938: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT.
Key phrases: out-of-bounds read, oops, out of bounds read
CVE-2022-47939: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after-free and OOPS for SMB2_TREE_DISCONNECT.
Key phrases: use-after-free, oops, use after free
CVE-2022-4794: The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.
Key phrases: bypass firewall rules, trusted domains, reflected file download
CVE-2022-47940: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.18 before 5.18.18. fs/ksmbd/smb2pdu.c lacks length validation in the non-padding case in smb2_write.
Key phrases: non-padding case
CVE-2022-47941: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c omits a kfree call in certain smb2_handle_negotiate error conditions, aka a memory leak.
Key phrases: memory leak
CVE-2022-47942: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is a heap-based buffer overflow in set_ntacl_dacl, related to use of SMB2_QUERY_INFO_HE after a malformed SMB2_SET_INFO_HE command.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2022-47943: An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. There is an out-of-bounds read and OOPS for SMB2_WRITE, when there is a large length in the zero DataOffset case.
Key phrases: out-of-bounds read, oops, out of bounds read
CVE-2022-47945: ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). An unauthenticated and remote attacker can exploit this to execute arbitrary operating system commands, as demonstrated by including pearcmd.php.
Key phrases: execute arbitrary operating system commands, local file inclusion
CVE-2022-47946: An issue was discovered in the Linux kernel 5.10.x before 5.10.155. A use-after-free in io_sqpoll_wait_sq in fs/io_uring.c allows an attacker to crash the kernel, resulting in denial of service. finish_wait can be skipped. An attack can occur in some situations by forking a process and then quickly terminating it. NOTE: later kernel versions, such as the 5.15 longterm series, substantially changed the implementation of io_sqpoll_wait_sq.
Key phrases: crash the kernel, use-after-free, denial of service, forking a process, use after free
CVE-2022-47949: The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. The victim must join a game session with the attacker. Other affected products include Mario Kart 7 before 1.2, Mario Kart 8, Mario Kart 8 Deluxe before 2.1.0, ARMS before 5.4.1, Splatoon, Splatoon 2 before 5.5.1, Splatoon 3 before late 2022, Super Mario Maker 2 before 3.0.2, and Nintendo Switch Sports before late 2022.
Key phrases: execute arbitrary code, execute arbitrary code via a large UDP packet, buffer overflow, enlbufferpwn
CVE-2022-4795: The Galleries by Angie Makes WordPress plugin through 1.67 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-47950: An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. By supplying crafted XML files, an authenticated user may coerce the S3 API into returning arbitrary file contents from the host server, resulting in unauthorized read access to potentially sensitive data. This impacts both s3api deployments (Rocky or later), and swift3 deployments (Queens and earlier, no longer actively developed).
Key phrases: returning arbitrary file contents, unauthorized read access
CVE-2022-47951: An issue was discovered in OpenStack Cinder before 19.1.2, 20.x before 20.0.2, and 21.0.0; Glance before 23.0.1, 24.x before 24.1.1, and 25.0.0; and Nova before 24.1.2, 25.x before 25.0.2, and 26.0.0. By supplying a specially created VMDK flat image that references a specific backing file path, an authenticated user may convince systems to return a copy of that file's contents from the server, resulting in unauthorized access to potentially sensitive data.
Key phrases: unauthorized access, convince
CVE-2022-47952: lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protected directory tree, because "Failed to open" often indicates that a file does not exist, whereas "does not refer to a network namespace path" often indicates that a file exists. NOTE: this is different from CVE-2018-6556 because the CVE-2018-6556 fix design was based on the premise that "we will report back to the user that the open() failed but the user has no way of knowing why it failed"; however, in many realistic cases, there are no plausible reasons for failing except that the file does not exist.
Key phrases: infer whether any file exists
CVE-2022-4796: Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: privileged apis
CVE-2022-47965: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2022-47966: Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache Santuario xmlsec (aka XML Security for Java) 1.4.1, because the xmlsec XSLT features, by design in that version, make the application responsible for certain security protections, and the ManageEngine applications did not provide those protections. This affects Access Manager Plus before 4308, Active Directory 360 before 4310, ADAudit Plus before 7081, ADManager Plus before 7162, ADSelfService Plus before 6211, Analytics Plus before 5150, Application Control Plus before 10.1.2220.18, Asset Explorer before 6983, Browser Security Plus before 11.1.2238.6, Device Control Plus before 10.1.2220.18, Endpoint Central before 10.1.2228.11, Endpoint Central MSP before 10.1.2228.11, Endpoint DLP before 10.1.2137.6, Key Manager Plus before 6401, OS Deployer before 1.1.2243.1, PAM 360 before 5713, Password Manager Pro before 12124, Patch Manager Plus before 10.1.2220.18, Remote Access Plus before 10.1.2228.11, Remote Monitoring and Management (RMM) before 10.1.41. ServiceDesk Plus before 14004, ServiceDesk Plus MSP before 13001, SupportCenter Plus before 11026, and Vulnerability Manager Plus before 10.1.2220.18. Exploitation is only possible if SAML SSO has ever been configured for a product (for some products, exploitation requires that SAML SSO is currently active).
Key phrases: use of Apache Santuario xmlsec (aka XML, remote code execution
CVE-2022-47967: A vulnerability has been identified in Solid Edge (All versions < V2023 MP1). The DOCMGMT.DLL contains a memory corruption vulnerability that could be triggered while parsing files in different file formats such as PAR, ASM, DFT. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, memory corruption
CVE-2022-47968: Heimdall Application Dashboard through 2.5.4 allows reflected and stored XSS via "Application name" to the "Add application" page. The stored XSS will be triggered in the "Application list" page.
Key phrases: the "Add application" page, stored xss
CVE-2022-4797: Improper Restriction of Excessive Authentication Attempts in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: improper restriction, excessive authentication attempts
CVE-2022-47974: The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the Bluetooth process to restart.
Key phrases: restart
CVE-2022-47975: The DUBAI module has a double free vulnerability. Successful exploitation of this vulnerability may affect system availability.
Key phrases: double free, system availability
CVE-2022-47976: The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this vulnerability may disconnect normal service connections.
Key phrases: disconnect normal service connections
CVE-2022-47977: A vulnerability has been identified in JT Open (All versions < V11.2.3.0), JT Utilities (All versions < V13.2.3.0). The affected application contains a memory corruption vulnerability while parsing specially crafted JT files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, memory corruption
CVE-2022-4798: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-47983: IBM InfoSphere Information Server 11.7 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.  IBM X-Force ID:  243161.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2022-47984: IBM InfoSphere Information Server 11.7 is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.  IBM X-Force ID:  243163.
Key phrases: view, sql injection
CVE-2022-47986: IBM Aspera Faspex 4.4.2 Patch Level 1 and earlier could allow a remote attacker to execute arbitrary code on the system, caused by a YAML deserialization flaw. By sending a specially crafted obsolete API call, an attacker could exploit this vulnerability to execute arbitrary code on the system. The obsolete API call was removed in Faspex 4.4.2 PL2. IBM X-Force ID: 243512.
Key phrases: execute arbitrary code, execute arbitrary code on the system, yaml deserialization flaw, obsolete api call
CVE-2022-4799: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-47990: IBM AIX 7.1, 7.2, 7.3 and VIOS , 3.1 could allow a non-privileged local user to exploit a vulnerability in X11 to cause a buffer overflow that could result in a denial of service or arbitrary code execution. IBM X-Force ID: 243556. 
Key phrases: exploit a vulnerability in X11 to cause a, buffer overflow, denial of service, arbitrary code execution
CVE-2022-4800: Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: improper verification of source of a communication channel
CVE-2022-48006: An arbitrary file upload vulnerability in taocms v3.0.2 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is exploited via manipulation of the upext variable at /include/Model/Upload.php.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-48007: A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the User-Agent.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-48008: An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-4801: Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: insufficient granularity of access control
CVE-2022-48010: LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministration/rendersidemenulink?subaction=surveytexts. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Welcome-message text fields. NOTE: the vendor indicates that this is not a vulnerability because the manipulation requires Superadministrator privileges, and Superadministrators are already allowed to customize surveys with JavaScript as they wish.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-48011: Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
Key phrases: sql injection
CVE-2022-48012: Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=settings&a=ajax_tags_upd.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-48013: Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description or Title text fields.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-48019: The components wfshbr64.sys and wfshbr32.sys in Another Eden before v3.0.20 and before v2.14.200 allows attackers to perform privilege escalation via a crafted payload.
Key phrases: perform privilege escalation via a crafted payload
CVE-2022-4802: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-48020: Vinteo VCC v2.36.4 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the conference parameter. This vulnerability allows attackers to inject arbitrary code which will be executed by the victim user's browser.
Key phrases: inject arbitrary code, inject arbitrary code which will be executed by, reflected cross-site scripting (xss)
CVE-2022-48021: A vulnerability in Zammad v5.3.0 allows attackers to execute arbitrary code or escalate privileges via a crafted message sent to the server.
Key phrases: execute arbitrary code, execute arbitrary code or escalate privileges via a
CVE-2022-48022: An issue in the component /api/v1/mentions of Zammad v5.3.0 allows authenticated attackers with agent permissions to view information about tickets they are not authorized to see.
Key phrases: view information about tickets they are not authorized
CVE-2022-48023: Insufficient privilege verification in Zammad v5.3.0 allows an authenticated attacker to perform changes on the tags of their customer tickets using the Zammad API. This is now corrected in v5.3.1 so that only agents with write permissions may change ticket tags.
Key phrases: perform changes on the tags of their customer, insufficient privilege verification
CVE-2022-4803: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-4804: Improper Authorization in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: improper authorization
CVE-2022-4805: Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: privileged apis
CVE-2022-4806: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-48063: GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function load_separate_debug_files at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.
Key phrases: excessive memory consumption, dns
CVE-2022-48064: GNU Binutils before 2.40 was discovered to contain an excessive memory consumption vulnerability via the function bfd_dwarf2_find_nearest_line_with_alt at dwarf2.c. The attacker could supply a crafted ELF file and cause a DNS attack.
Key phrases: excessive memory consumption, dns
CVE-2022-48065: GNU Binutils before 2.40 was discovered to contain a memory leak vulnerability var the function find_abstract_instance in dwarf2.c.
Key phrases: memory leak
CVE-2022-48066: An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie.
Key phrases: bypass authentication, bypass authentication via a crafted cookie
CVE-2022-48067: An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attack.
Key phrases: obtain the root password, obtain the root password via a brute-, information disclosure, brute-force
CVE-2022-48069: Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter.
Key phrases: command injection
CVE-2022-4807: Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: improper access control
CVE-2022-48070: Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function.
Key phrases: command injection
CVE-2022-48071: Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext.
Key phrases: plaintext
CVE-2022-48072: Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade function.
Key phrases: command injection
CVE-2022-48073: Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext.
Key phrases: plaintext
CVE-2022-48074: An issue in NoMachine before v8.2.3 allows attackers to execute arbitrary commands via a crafted .nxs file.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted .nxs file
CVE-2022-48077: Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.
Key phrases: execute arbitrary code, escalate privileges and execute arbitrary code via a, dll hijacking
CVE-2022-48078: pycdc commit 44a730f3a889503014fec94ae6e62d8401cb75e5 was discovered to contain a stack overflow via the component ASTree.cpp:BuildFromCode.
Key phrases: stack overflow
CVE-2022-48079: Monnai aaPanel host system v1.5 contains an access control issue which allows attackers to escalate privileges and execute arbitrary code via uploading a crafted PHP file to the virtual host directory of the system.
Key phrases: execute arbitrary code, escalate privileges and execute arbitrary code via uploading, access control issue
CVE-2022-4808: Improper Privilege Management in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: improper privilege management
CVE-2022-48082: Easyone CRM v5.50.02 was discovered to contain a SQL Injection vulnerability via the text parameter at /Services/Misc.asmx/SearchTag.
Key phrases: sql injection
CVE-2022-48085: Softr v2.0 was discovered to contain a HTML injection vulnerability via the Work Space Name parameter.
Key phrases: html injection
CVE-2022-4809: Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: improper access control
CVE-2022-48090: Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php.
Key phrases: sql injection
CVE-2022-48091: Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.
Key phrases: cross site scripting (xss)
CVE-2022-48093: Seacms v12.7 was discovered to contain a remote code execution (RCE) vulnerability via the ip parameter at admin_ ip.php.
Key phrases: remote code execution (rce)
CVE-2022-48094: lmxcms v1.41 was discovered to contain an arbitrary file read vulnerability via TemplateAction.class.php.
Key phrases: arbitrary file read
CVE-2022-4810: Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: improper access control
CVE-2022-48107: D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
Key phrases: escalate privileges to root via a crafted payload, command injection
CVE-2022-48108: D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
Key phrases: escalate privileges to root via a crafted payload, command injection
CVE-2022-4811: Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass through user-controlled key
CVE-2022-48110: CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget. NOTE: the vendor's position is that this is not a vulnerability. The CKEditor 5 documentation discusses that it is the responsibility of an integrator (who is adding CKEditor 5 functionality to a website) to choose the correct security settings for their use case. Also, safe default values are established (e.g., config.htmlEmbed.showPreviews is false).
Key phrases: cross-site scripting (xss)
CVE-2022-48111: A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the f parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-48113: A vulnerability in TOTOLINK N200RE_v5 firmware V9.3.5u.6139 allows unauthenticated attackers to access the telnet service via a crafted POST request. Attackers are also able to leverage this vulnerability to login as root via hardcoded credentials.
Key phrases: access the telnet service via a crafted POST, hardcoded, hardcoded credentials
CVE-2022-48114: RuoYi up to v4.7.5 was discovered to contain a SQL injection vulnerability via the component /tool/gen/createTable.
Key phrases: sql injection
CVE-2022-48115: The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS).
Key phrases: cross-site scripting (xss)
CVE-2022-48116: AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php.
Key phrases: remote code execution (rce)
CVE-2022-48118: Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
Key phrases: cross-site scripting (xss)
CVE-2022-4812: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-48120: SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021), allows attackers to execute arbitrary commands via the contact and doctor parameters to /search.php.
Key phrases: execute arbitrary commands, execute arbitrary commands via the contact and doctor, sql injection
CVE-2022-48121: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function.
Key phrases: command injection
CVE-2022-48122: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function.
Key phrases: command injection
CVE-2022-48123: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function.
Key phrases: command injection
CVE-2022-48124: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function.
Key phrases: command injection
CVE-2022-48125: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function.
Key phrases: command injection
CVE-2022-48126: TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function.
Key phrases: command injection
CVE-2022-4813: Insufficient Granularity of Access Control in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: insufficient granularity of access control
CVE-2022-48130: Tenda W20E v15.11.0.6 was discovered to contain multiple stack overflows in the function formSetStaticRoute via the parameters staticRouteNet, staticRouteMask, staticRouteGateway, staticRouteWAN.
Key phrases: stack overflows
CVE-2022-4814: Improper Access Control in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: improper access control
CVE-2022-48140: DedeCMS v5.7.97 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /file_manage_view.php?fmdo=edit&filename.
Key phrases: cross-site scripting (xss)
CVE-2022-48149: Online Student Admission System in PHP Free Source Code 1.0 was discovered to contain a SQL injection vulnerability via the username parameter.
Key phrases: sql injection
CVE-2022-4815: Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.3, including 8.3.x deserialize untrusted JSON data without constraining the parser to approved classes and methods.
Key phrases: untrusted json data
CVE-2022-48150: Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.
Key phrases: cross-site scripting (xss)
CVE-2022-48152: SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id parameter to /medicines/profile.php.
Key phrases: execute arbitrary commands, gain sensitive information, execute arbitrary commands and gain sensitive information via, sql injection
CVE-2022-4816: A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application.
Key phrases: crash the application, denial-of-service, denial of service
CVE-2022-48161: Easy Images v2.0 was discovered to contain an arbitrary file download vulnerability via the component /application/down.php. This vulnerability is exploited via a crafted GET request.
Key phrases: arbitrary file download
CVE-2022-48164: An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN533A8 M33A8.V5030.190716 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
Key phrases: obtain admin credentials, download configuration data and log files and obtain, access control issue
CVE-2022-48165: An access control issue in the component /cgi-bin/ExportLogs.sh of Wavlink WL-WN530H4 M30H4.V5030.210121 allows unauthenticated attackers to download configuration data and log files and obtain admin credentials.
Key phrases: obtain admin credentials, download configuration data and log files and obtain, access control issue