yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-0211: The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html
CVE-2022-0212: The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
Key phrases: reflected cross-site scripting
CVE-2022-0213: vim is vulnerable to Heap-based Buffer Overflow
Key phrases: heap-based buffer overflow
CVE-2022-0214: The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
Key phrases: denial of service
CVE-2022-0215: The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).
Key phrases: update arbitrary options, cross-site request forgery
CVE-2022-0216: A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.
Key phrases: crash the QEMU process on the host, use-after-free, denial of service, use after free
CVE-2022-0217: It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
Key phrases: injections using XML External Entity References (CWE-611, attacker input
CVE-2022-0218: The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.
Key phrases: retrieve and modify theme settings due to a, unauthorized access, missing capability check
CVE-2022-0219: Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
Key phrases: improper restriction, xml external entity reference
CVE-2022-0220: The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)
Key phrases: xss
CVE-2022-0221: A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior)
Key phrases: cwe-611, information disclosure
CVE-2022-0222: A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP. Affected products: Modicon M340 CPUs(BMXP34* versions prior to V3.40), Modicon M340 X80 Ethernet Communication modules:BMXNOE0100 (H), BMXNOE0110 (H), BMXNOR0200H RTU(BMXNOE* all versions)(BMXNOR* versions prior to v1.7 IR24)
Key phrases: cwe-269, denial of service
CVE-2022-0223: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause unauthenticated code execution. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)
Key phrases: create or overwrite critical files that are used, cwe-22, execute code, code execution
CVE-2022-0224: dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Key phrases: improper neutralization of special elements
CVE-2022-0225: A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
Key phrases: use the malicious payload as the group name, stored cross-site scripting (xss)
CVE-2022-0226: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Key phrases: cross-site request forgery (csrf)
CVE-2022-0228: The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
Key phrases: perform SQL injection, sql injection
CVE-2022-0229: The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
Key phrases: delete arbitrary options, unusable
CVE-2022-0230: The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
Key phrases: perform Stored Cross-Site Scripting attacks against, stored cross-site scripting
CVE-2022-0231: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Key phrases: cross-site request forgery (csrf)
CVE-2022-0232: The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text parameter found in the ~/includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Key phrases: inject arbitrary web scripts, stored cross-site scripting
CVE-2022-0233: The ProfileGrid  User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.
Key phrases: inject arbitrary web scripts, inject arbitrary web scripts into their profile, stored cross-site scripting
CVE-2022-0234: The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-0235: node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Key phrases: exposure of sensitive information
CVE-2022-0236: The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15.
Key phrases: unauthenticated sensitive data disclosure, sensitive information
CVE-2022-0237: Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80.
Key phrases: privilege escalation, elevated rights, persistent access, hijack
CVE-2022-0238: phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)
Key phrases: cross-site request forgery (csrf)
CVE-2022-0239: corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Key phrases: improper restriction of xml external entity reference
CVE-2022-0240: mruby is vulnerable to NULL Pointer Dereference
Key phrases: null pointer dereference
CVE-2022-0242: Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.
Key phrases: unrestricted upload, dangerous type
CVE-2022-0243: Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
Key phrases: cross-site scripting (xss), targets
CVE-2022-0244: An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file.
Key phrases: arbitrary file read
CVE-2022-0245: Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0.
Key phrases: cross-site request forgery (csrf)
CVE-2022-0246: The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability.
Key phrases: zip slip
CVE-2022-0247: An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5d3d or any of the listed versions.
Key phrases: copy-on-write snapshots
CVE-2022-0248: The Contact Form Submissions WordPress plugin before 1.7.3 does not sanitise and escape additional fields in contact form requests before outputting them in the related submission. As a result, unauthenticated attacker could perform Cross-Site Scripting attacks against admins viewing the malicious submission
Key phrases: cross-site scripting
CVE-2022-0249: A vulnerability was discovered in GitLab starting with version 12. GitLab was vulnerable to a blind SSRF attack since requests to shared address space were not blocked.
Key phrases: ssrf
CVE-2022-0250: The Redirection for Contact Form 7 WordPress plugin before 2.5.0 does not escape a link generated before outputting it in an attribute, leading to a Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-0251: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.10.
Key phrases: cross-site scripting (xss)
CVE-2022-0252: The GiveWP WordPress plugin before 2.17.3 does not escape the json parameter before outputting it back in an attribute in the Import admin dashboard, leading to a Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-0253: livehelperchat is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2022-0254: The WordPress Zero Spam WordPress plugin before 5.2.11 does not properly sanitise and escape the order and orderby parameters before using them in a SQL statement in the admin dashboard, leading to a SQL injection
Key phrases: sql injection
CVE-2022-0255: The Database Backup for WordPress plugin before 2.5.1 does not properly sanitise and escape the fragment parameter before using it in a SQL statement in the admin dashboard, leading to a SQL injection issue
Key phrases: sql injection
CVE-2022-0256: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2022-0257: pimcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Key phrases: improper neutralization of input during web page generation, cross-site scripting
CVE-2022-0258: pimcore is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Key phrases: improper neutralization of special elements
CVE-2022-0260: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.2.7.
Key phrases: cross-site scripting (xss)
CVE-2022-0261: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Key phrases: heap-based buffer overflow
CVE-2022-0262: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.7.
Key phrases: cross-site scripting (xss)
CVE-2022-0263: Unrestricted Upload of File with Dangerous Type in Packagist pimcore/pimcore prior to 10.2.7.
Key phrases: unrestricted upload, dangerous type
CVE-2022-0264: A vulnerability was found in the Linux kernel's eBPF verifier when handling internal data structures. Internal memory locations could be returned to userspace. A local attacker with the permissions to insert eBPF code to the kernel can use this to leak internal kernel memory details defeating some of the exploit mitigations in place for the kernel. This flaws affects kernel versions < v5.16-rc6
Key phrases: flaws
CVE-2022-0265: Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1.
Key phrases: xml external entity reference
CVE-2022-0266: Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-0267: The AdRotate WordPress plugin before 5.8.22 does not sanitise and escape the adrotate_action before using it in a SQL statement via the adrotate_request_action function available to admins, leading to a SQL injection
Key phrases: sql injection
CVE-2022-0268: Cross-site Scripting (XSS) - Stored in Packagist getgrav/grav prior to 1.7.28.
Key phrases: cross-site scripting (xss)
CVE-2022-0269: Cross-Site Request Forgery (CSRF) in Packagist yetiforce/yetiforce-crm prior to 6.3.0.
Key phrases: cross-site request forgery (csrf)
CVE-2022-0270: Prior to v0.6.1, bored-agent failed to sanitize incoming kubernetes impersonation headers allowing a user to override assigned user name and groups.
Key phrases: override assigned user name and groups
CVE-2022-0271: The LearnPress WordPress plugin before 4.1.6 does not sanitise and escape the lp-dismiss-notice before outputting it back via the lp_background_single_email AJAX action, leading to a Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-0272: Improper Restriction of XML External Entity Reference in GitHub repository detekt/detekt prior to 1.20.0.
Key phrases: xml external entity reference
CVE-2022-0273: Improper Access Control in Pypi calibreweb prior to 0.6.16.
Key phrases: improper access control
CVE-2022-0274: Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.
Key phrases: cross-site scripting (xss), targets
CVE-2022-0277: Incorrect Permission Assignment for Critical Resource in Packagist microweber/microweber prior to 1.2.11.
Key phrases: incorrect permission assignment
CVE-2022-0278: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Key phrases: cross-site scripting (xss)
CVE-2022-0279: The AnyComment WordPress plugin before 0.2.18 is affected by a race condition when liking/disliking a comment/reply, which could allow any authenticated user to quickly raise their rating or lower the rating of other users
Key phrases: quickly raise their rating or lower the rating, race condition
CVE-2022-0280: A race condition vulnerability exists in the QuickClean feature of McAfee Total Protection for Windows prior to 16.0.43 that allows a local user to gain privilege elevation and perform an arbitrary file delete. This could lead to sensitive files being deleted and potentially cause denial of service. This attack exploits the way symlinks are created and how the product works with them.
Key phrases: gain privilege, gain privilege elevation and perform an arbitrary file, race condition, denial of service, gain privileges
CVE-2022-0281: Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11.
Key phrases: exposure of sensitive information
CVE-2022-0282: Cross-site Scripting in Packagist microweber/microweber prior to 1.2.11.
Key phrases: cross-site scripting
CVE-2022-0283: An issue has been discovered affecting GitLab versions prior to 13.5. An open redirect vulnerability was fixed in GitLab integration with Jira that a could cause the web application to redirect the request to the attacker specified URL.
Key phrases: open redirect
CVE-2022-0284: A heap-based-buffer-over-read flaw was found in ImageMagick's GetPixelAlpha() function of 'pixel-accessor.h'. This vulnerability is triggered when an attacker passes a specially crafted Tagged Image File Format (TIFF) image to convert it into a PICON file format. This issue can potentially lead to a denial of service and information disclosure.
Key phrases: heap-based-buffer-over-read flaw, denial of service, information disclosure, buffer over read
CVE-2022-0285: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.9.
Key phrases: cross-site scripting (xss)
CVE-2022-0286: A flaw was found in the Linux kernel. A null pointer dereference in bond_ipsec_add_sa() may lead to local denial of service.
Key phrases: null pointer dereference, local denial of service
CVE-2022-0287: The myCred WordPress plugin before 2.4.4.1 does not have any authorisation in place in its mycred-tools-select-user AJAX action, allowing any authenticated user, such as subscriber to call and retrieve all email addresses from the blog
Key phrases: call and retrieve all email addresses from the
CVE-2022-0288: The Ad Inserter WordPress plugin before 2.7.10, Ad Inserter Pro WordPress plugin before 2.7.10 do not sanitise and escape the html_element_selection parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-0289: Use after free in Safe browsing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2022-0290: Use after free in Site isolation in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Key phrases: use after free, sandbox escape
CVE-2022-0291: Inappropriate implementation in Storage in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Key phrases: bypass site isolation via a crafted HTML page
CVE-2022-0292: Inappropriate implementation in Fenced Frames in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page.
Key phrases: bypass navigation restrictions
CVE-2022-0293: Use after free in Web packaging in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2022-0294: Inappropriate implementation in Push messaging in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Key phrases: bypass site isolation via a crafted HTML page
CVE-2022-0295: Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption, convince
CVE-2022-0296: Use after free in Printing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption, convince
CVE-2022-0297: Use after free in Vulkan in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2022-0298: Use after free in Scheduling in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2022-0300: Use after free in Text Input Method Editor in Google Chrome on Android prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption, convince
CVE-2022-0301: Heap buffer overflow in DevTools in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
Key phrases: heap buffer overflow, heap corruption, convince
CVE-2022-0302: Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption, convince
CVE-2022-0304: Use after free in Bookmarks in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption, convince
CVE-2022-0305: Inappropriate implementation in Service Worker API in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
Key phrases: bypass site isolation via a crafted HTML page
CVE-2022-0306: Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: heap buffer overflow, heap corruption
CVE-2022-0307: Use after free in Optimization Guide in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption, convince
CVE-2022-0308: Use after free in Data Transfer in Google Chrome on Chrome OS prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption, convince
CVE-2022-0309: Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Key phrases: bypass navigation restrictions
CVE-2022-0310: Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via specific user interactions.
Key phrases: heap buffer overflow, heap corruption
CVE-2022-0311: Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Key phrases: heap buffer overflow, heap corruption, convince
CVE-2022-0313: The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack
Key phrases: make a logged in admin delete them via, csrf check
CVE-2022-0314: The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-0315: Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0.
Key phrases: insecure temporary file
CVE-2022-0316: The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server.
Key phrases: upload arbitrary files, upload arbitrary files to the web server
CVE-2022-0317: An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above.
Key phrases: provide a maliciously-formed Quote over no, improper input validation, akpublic, spoofing
CVE-2022-0318: Heap-based Buffer Overflow in vim/vim prior to 8.2.
Key phrases: heap-based buffer overflow
CVE-2022-0319: Out-of-bounds Read in vim/vim prior to 8.2.
Key phrases: out-of-bounds read
CVE-2022-0320: The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.
Key phrases: read arbitrary files, perform Local File Inclusion attack and read arbitrary, local file inclusion, rce, rce techniques
CVE-2022-0321: The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
Key phrases: reflected cross-site scripting
CVE-2022-0322: A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS).
Key phrases: denial of service (DOS), denial of service (dos)
CVE-2022-0323: Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.
Key phrases: improper neutralization of special elements
CVE-2022-0324: There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that could cause buffer overflow in a memcpy call, leading to out-of-bounds memory write that would cause dhcp6relay to crash. Dhcp6relay is a critical process and could cause dhcp relay docker to shutdown.Discovered by Eugene Lim of GovTech Singapore.
Key phrases: buffer overflow, out-of-bounds memory write, crash, out of bounds memory
CVE-2022-0326: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Key phrases: null pointer dereference
CVE-2022-0327: The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-0328: The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
Key phrases: make a logged in admin delete them via, csrf check, bulk
CVE-2022-0330: A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.
Key phrases: crash the system or escalate their privileges on, random memory access flaw, crash system, escalate privilege
CVE-2022-0331: An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5 MR2 and older.
Key phrases: read the device serial number in Sophos Firewall, information disclosure
CVE-2022-0332: A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
Key phrases: sql injection
CVE-2022-0333: A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
CVE-2022-0334: A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
CVE-2022-0335: A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
Key phrases: csrf risk
CVE-2022-0336: The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity.
Key phrases: denial-of-service, loss of confidentiality and integrity, denial of service, impersonate
CVE-2022-0337: Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)
Key phrases: obtain potentially sensitive information
CVE-2022-0338: Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.
Key phrases: sensitive information
CVE-2022-0339: Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.
Key phrases: server-side request forgery (ssrf)
CVE-2022-0341: Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12.
Key phrases: cross-site scripting (xss)
CVE-2022-0342: An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
Key phrases: bypass the web authentication, authentication bypass, obtain administrative access, bypass the web authentication and obtain administrative access
CVE-2022-0343: A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2
CVE-2022-0344: An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project
Key phrases: private project paths
CVE-2022-0345: The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
Key phrases: call it and query for user e-, csrf check
CVE-2022-0346: The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.
Key phrases: xss, rce
CVE-2022-0347: The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-0348: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.
Key phrases: cross-site scripting (xss)
CVE-2022-0349: The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection
Key phrases: unauthenticated blind sql injection
CVE-2022-0350: Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.
Key phrases: cross-site scripting (xss)
CVE-2022-0351: Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
Key phrases: access of memory location
CVE-2022-0352: Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
Key phrases: cross-site scripting (xss)
CVE-2022-0353: A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 andLenovo Diagnostics versions prior to 4.45 that could allow a local user with administrative access to trigger a system crash.
Key phrases: trigger a system crash, denial of service
CVE-2022-0354: A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window.
Key phrases: execute code with elevated privileges only during the
CVE-2022-0355: Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.
Key phrases: improper removal of sensitive information
CVE-2022-0357: Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM.This issue affects:Bitdefender Total Securityversions prior to 26.0.10.45.Bitdefender Internet Securityversions prior to 26.0.10.45.Bitdefender Antivirus Plusversions prior to 26.0.10.45.
Key phrases: elevate privileges to SYSTEM.This issue affects:Bitdefender, unquoted search path
CVE-2022-0358: A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.
Key phrases: gain access, gain access to resources accessible to the root, escalate privilege
CVE-2022-0359: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Key phrases: heap-based buffer overflow
CVE-2022-0360: The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues
Key phrases: import malicious ones (either intentionnaly or not, stored cross-site scripting
CVE-2022-0361: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Key phrases: heap-based buffer overflow
CVE-2022-0362: SQL Injection in Packagist showdoc/showdoc prior to 2.10.3.
Key phrases: sql injection
CVE-2022-0363: The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
Key phrases: creating arbitrary posts, call it and import mycred setup, csrf checks
CVE-2022-0364: The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-0365: The affected product is vulnerable to an authenticated OS command injection, which may allow an attacker to inject and execute arbitrary shell commands as the Admin (root) user.
Key phrases: execute arbitrary shell commands, inject and execute arbitrary shell commands as the, authenticated os command injection
CVE-2022-0366: An authenticated and authorized agent user could potentially gain administrative access via an SQLi vulnerability to Capsule8 Console between versions 4.6.0 and 4.9.1.
Key phrases: gain administrative access, sqli
CVE-2022-0367: A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
Key phrases: heap-based buffer overflow flaw, heap based buffer overflow
CVE-2022-0368: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
Key phrases: out-of-bounds read
CVE-2022-0370: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Key phrases: cross-site scripting (xss)
CVE-2022-0371: An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions starting from 14.6 before 14.6.4, all versions starting from 14.7 before 14.7.1. GitLab search may allow authenticated users to search other users by their respective private emails even if a user set their email to private.
Key phrases: search other users by their respective private emails
CVE-2022-0372: Cross-site Scripting (XSS) - Stored in Packagist bytefury/crater prior to 6.0.2.
Key phrases: cross-site scripting (xss)
CVE-2022-0373: Improper access control in GitLab CE/EE versions 12.4 to 14.5.4, 14.5 to 14.6.4, and 12.6 to 14.7.1 allows project non-members to retrieve the service desk email address
Key phrases: retrieve the service desk email address, improper access control
CVE-2022-0374: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Key phrases: cross-site scripting (xss)
CVE-2022-0375: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Key phrases: cross-site scripting (xss)
CVE-2022-0376: The User Meta WordPress plugin before 2.4.3 does not sanitise and escape the Form Name, as well as Shared Field Labels before outputting them in the admin dashboard when editing a form, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting
CVE-2022-0377: Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration.  After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site.
Key phrases: destroy the design of the web site
CVE-2022-0378: Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
Key phrases: cross-site scripting (xss)
CVE-2022-0379: Cross-site Scripting (XSS) - Stored in Packagist microweber/microweber prior to 1.2.11.
Key phrases: cross-site scripting (xss)
CVE-2022-0380: The Fotobook WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping and the use of $_SERVER['PHP_SELF'] found in the ~/options-fotobook.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 3.2.3.
Key phrases: inject arbitrary web scripts, inject arbitrary web scripts onto the page, reflected cross-site scripting
CVE-2022-0381: The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the ~/swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and including 1.0.0.
Key phrases: inject arbitrary web scripts, inject arbitrary web scripts onto the page, reflected cross-site scripting
CVE-2022-0382: An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user cannot control what is read. This flaw affects the Linux kernel versions prior to 5.17-rc1.
Key phrases: read some kernel memory, information leak flaw, uninitialized memory
CVE-2022-0383: The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could allow a high privilege users to perform SQL Injections attacks
Key phrases: perform SQL Injections attacks, sql injections
CVE-2022-0384: The Video Conferencing with Zoom WordPress plugin before 3.8.17 does not have authorisation in its vczapi_get_wp_users AJAX action, allowing any authenticated users, such as subscriber to download the list of email addresses registered on the blog
Key phrases: download the list of email addresses registered on
CVE-2022-0385: The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Stored Cross-Site scripting
Key phrases: stored cross-site scripting
CVE-2022-0386: A post-auth SQL injection vulnerability in the Mail Manager potentially allows an authenticated attacker to execute code in Sophos UTM before version 9.710.
Key phrases: execute code in Sophos UTM before version 9.710, post-auth sql injection
CVE-2022-0387: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Key phrases: cross-site scripting (xss)
CVE-2022-0388: The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform Cross-Site Scripting attacks even when, link field, cross-site scripting, unfiltered_html capability
CVE-2022-0389: The WP Time Slots Booking Form WordPress plugin before 1.1.63 does not sanitise and escape Calendar names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0390: Improper access control in Gitlab CE/EE versions 12.7 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1 allowed for project non-members to retrieve issue details when it was linked to an item from the vulnerability dashboard.
Key phrases: improper access control
CVE-2022-0391: A flaw was found in Python, specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\\\\r' and '\\\\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1, 3.9.5, 3.8.11, 3.7.11 and 3.6.14.
Key phrases: input a crafted URL, injection
CVE-2022-0392: Heap-based Buffer Overflow in GitHub repository vim prior to 8.2.
Key phrases: heap-based buffer overflow
CVE-2022-0393: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
Key phrases: out-of-bounds read
CVE-2022-0394: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Key phrases: cross-site scripting (xss)
CVE-2022-0395: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Key phrases: cross-site scripting (xss)