yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-0585: Large loops in multiple protocol dissectors in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allow denial of service via packet injection or crafted capture file
Key phrases: denial of service via packet injection or crafted, large loops
CVE-2022-0586: Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet injection or crafted capture file
Key phrases: denial of service via packet injection or crafted, infinite loop
CVE-2022-0587: Improper Authorization in Packagist librenms/librenms prior to 22.2.0.
Key phrases: improper authorization
CVE-2022-0588: Missing Authorization in Packagist librenms/librenms prior to 22.2.0.
Key phrases: missing authorization
CVE-2022-0589: Cross-site Scripting (XSS) - Stored in Packagist librenms/librenms prior to 22.1.0.
Key phrases: cross-site scripting (xss)
CVE-2022-0590: The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0591: The FormCraft WordPress plugin before 3.8.28 does not validate the URL parameter in the formcraft3_get AJAX action, leading to SSRF issues exploitable by unauthenticated users
Key phrases: ssrf issues, exploitable
CVE-2022-0592: The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users.
Key phrases: sql injection, exploitable
CVE-2022-0593: The Login with phone number WordPress plugin before 1.3.7 includes a file delete.php with no form of authentication or authorization checks placed in the plugin directory, allowing unauthenticated user to remotely delete the plugin files leading to a potential Denial of Service situation.
Key phrases: remotely delete the plugin files leading to a, denial of service situation
CVE-2022-0594: The Professional Social Sharing Buttons, Icons & Related Posts WordPress plugin before 9.7.6 does not have proper authorisation check in one of the AJAX action, available to unauthenticated (in v < 9.7.5) and author+ (in v9.7.5) users, allowing them to call it and retrieve various information such as the list of active plugins, various version like PHP, cURL, WP etc.
Key phrases: call it and retrieve various information such as
CVE-2022-0595: The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
Key phrases: be uploaded by default via the dnd_codedropz_upload AJAX, stored cross-site scripting issue, file upload
CVE-2022-0596: Improper Validation of Specified Quantity in Input in Packagist microweber/microweber prior to 1.2.11.
Key phrases: improper validation
CVE-2022-0597: Open Redirect in Packagist microweber/microweber prior to 1.2.11.
Key phrases: open redirect
CVE-2022-0598: The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0599: The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0600: The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0601: The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0602: Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0.
Key phrases: cross-site scripting (xss)
CVE-2022-0603: Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2022-0604: Heap buffer overflow in Tab Groups in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Key phrases: heap buffer overflow, heap corruption, convince
CVE-2022-0605: Use after free in Webstore API in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and convinced a user to enage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Key phrases: heap corruption, convince
CVE-2022-0606: Use after free in ANGLE in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2022-0607: Use after free in GPU in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2022-0608: Integer overflow in Mojo in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: integer overflow, heap corruption
CVE-2022-0609: Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: use after free, heap corruption
CVE-2022-0610: Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Key phrases: heap corruption
CVE-2022-0611: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11.
Key phrases: missing authorization
CVE-2022-0612: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Key phrases: cross-site scripting (xss)
CVE-2022-0613: Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-0614: Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2.
Key phrases: out-of-range pointer offset
CVE-2022-0615: Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-service condition on the system.
Key phrases: trigger denial-of-service condition on, use-after-free, denial of service
CVE-2022-0616: The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack
Key phrases: make a logged in admin delete arbitrary customers, csrf check
CVE-2022-0617: A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2.
Key phrases: null pointer dereference, crash the system, crash system
CVE-2022-0618: A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSH_PROMISE frame where the frame contains padding information without any other data. This logical error caused confusion about the size of the frame, leading to a parsing error. This parsing error immediately crashes the entire process. Sending a HEADERS frame or PUSH_PROMISE frame with HTTP/2 padding information does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send an appropriately crafted frame. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send appropriately crafted frames, so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself: swift-nio-http2 is parsing the frame in memory-safe code, so the crash is safe. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz.
Key phrases: connect to them may launch such an attack, denial of service, availability, crash, confidentiality, confidentiality and integrity
CVE-2022-0619: The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0620: The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0621: The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0622: Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.
Key phrases: sensitive information
CVE-2022-0623: Out-of-bounds Read in Homebrew mruby prior to 3.2.
Key phrases: out-of-bounds read
CVE-2022-0624: Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-0625: The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0626: The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0627: The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0628: The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0629: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Key phrases: stack-based buffer overflow
CVE-2022-0630: Out-of-bounds Read in Homebrew mruby prior to 3.2.
Key phrases: out-of-bounds read
CVE-2022-0631: Heap-based Buffer Overflow in Homebrew mruby prior to 3.2.
Key phrases: heap-based buffer overflow
CVE-2022-0632: NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Key phrases: null pointer dereference
CVE-2022-0633: The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup.
Key phrases: download the most recent site & database backup
CVE-2022-0634: The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the action by crafting a special request.
Key phrases: add an image from an external URL to, trick a logged in user to perform the, authorization checks, csrf checks, special request
CVE-2022-0635: Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check.
Key phrases: vulnerable version
CVE-2022-0636: A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash.
Key phrases: denial of service, system crash
CVE-2022-0637: open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6
Key phrases: open redirect
CVE-2022-0638: Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
Key phrases: cross-site request forgery (csrf)
CVE-2022-0639: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-0640: The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0641: The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0642: The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript.
Key phrases: inject arbitrary javascript, cross-site scripting
CVE-2022-0643: The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0645: Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1.
Key phrases: redirect, open redirect
CVE-2022-0646: A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5.
Key phrases: use after free, crash the system, escalate their privileges, crash system, escalate privilege
CVE-2022-0647: The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0648: The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-0649: The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0650: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13993.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of TP, execute code
CVE-2022-0651: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5.
Key phrases: inject arbitrary SQL, obtain sensitive information, inject arbitrary SQL queries to obtain sensitive information, sql injection
CVE-2022-0652: Confd log files contain local users', including roots, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710.
Key phrases: attempt off-line brute-force attacks, insecure access permissions
CVE-2022-0653: The Profile Builder  User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1.
Key phrases: inject arbitrary web scripts, inject arbitrary web scripts onto a pages that, cross-site scripting, versions up to and including
CVE-2022-0654: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0.
CVE-2022-0656: The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
Key phrases: read arbitrary files
CVE-2022-0657: The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using sanitize_text_field(), however such function is not intended to prevent SQL injections.
Key phrases: sql injection issue
CVE-2022-0658: The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection
Key phrases: unauthenticated sql injection
CVE-2022-0659: The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0660: Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
Key phrases: sensitive information
CVE-2022-0661: The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.
Key phrases: inject arbitrary HTML or javascript, inject arbitrary HTML or javascript even with unfiltered_html, stored cross-site scripting (xss), remote code execution (rce), arbitrary html
CVE-2022-0662: The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, advert names, cross-site scripting, unfiltered_html capability
CVE-2022-0663: The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform cross-Site Scripting attacks even when, custom button text settings, cross-site scripting, unfiltered_html capability
CVE-2022-0664: Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1.
Key phrases: hard-coded cryptographic key
CVE-2022-0665: Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2.
Key phrases: path traversal
CVE-2022-0666: CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11.
Key phrases: crlf injection, stack trace exposure
CVE-2022-0667: When the vulnerability is triggered the BIND process will exit. BIND 9.18.0
CVE-2022-0668: JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user.
Key phrases: Authentication Bypass, authentication bypass, privilege escalation
CVE-2022-0669: A flaw was found in dpdk. This flaw allows a malicious vhost-user master to attach an unexpected number of fds as ancillary data to VHOST_USER_GET_INFLIGHT_FD / VHOST_USER_SET_INFLIGHT_FD messages that are not closed by the vhost-user slave. By sending such messages continuously, the vhost-user master exhausts available fd in the vhost-user slave process, leading to a denial of service.
Key phrases: attach an unexpected number of fds as ancillary, denial of service
CVE-2022-0670: A flaw was found in Openstack manilla owning a Ceph File system "share", which enables the owner to read/write any manilla share or entire file system. The vulnerability is due to a bug in the "volumes" plugin in Ceph Manager. This allows an attacker to compromise Confidentiality and Integrity of a file system. Fixed in RHCS 5.2 and Ceph 17.2.2.
Key phrases: compromise Confidentiality and Integrity of a file system
CVE-2022-0671: A flaw was found in vscode-xml in versions prior to 0.19.0. Schema download could lead to blind SSRF or DoS via a large file.
CVE-2022-0672: A flaw was found in LemMinX in versions prior to 0.19.0. Insecure redirect could allow unauthorized access to sensitive information locally if LemMinX is run under a privileged user.
Key phrases: sensitive information locally if LemMinX is run under, insecure redirect, unauthorized access, access sensitive information
CVE-2022-0673: A flaw was found in LemMinX in versions prior to 0.19.0. Cache poisoning of external schema files due to directory traversal.
Key phrases: cache poisoning, directory traversal
CVE-2022-0674: The Kunze Law WordPress plugin before 2.1 does not escape its 'E-Mail Error "From" Address' settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0675: In certain situations it is possible for an unmanaged rule to exist on the target system that has the same comment as the rule specified in the manifest. This could allow for unmanaged rules to exist on the target system and leave the system in an unsafe state.
Key phrases: exist on the target system and leave the, unsafe state
CVE-2022-0676: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
Key phrases: heap-based buffer overflow
CVE-2022-0677: Improper Handling of Length Parameter Inconsistency vulnerability in the Update Server component of Bitdefender Endpoint Security Tools (in relay role), GravityZone (in Update Server role) allows an attacker to cause a Denial-of-Service. This issue affects: Bitdefender Update Server versions prior to 3.4.0.276. Bitdefender GravityZone versions prior to 26.4-1. Bitdefender Endpoint Security Tools for Linux versions prior to 6.2.21.171. Bitdefender Endpoint Security Tools for Windows versions prior to 7.4.1.111.
Key phrases: cause a Denial-of-Service, improper handling of length parameter inconsistency, denial-of-service
CVE-2022-0678: Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
Key phrases: cross-site scripting (xss)
CVE-2022-0679: The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated users) which results in the disclosure of arbitrary files as the content of the file is then displayed in the response as JSON data. This could also lead to RCE with various tricks but depends on the underlying system and it's configuration.
Key phrases: rce, disclosure, arbitrary file
CVE-2022-0680: The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scripting issue
Key phrases: update the plz_configuration_tracker_enable option, stored cross-site scripting issue
CVE-2022-0681: The Simple Membership WordPress plugin before 4.1.0 does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack
Key phrases: make a logged in admin delete arbitrary transactions, csrf check
CVE-2022-0683: The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the ~/includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 5.0.8.
Key phrases: inject arbitrary web scripts, inject arbitrary web scripts onto a pages that, cross-site scripting
CVE-2022-0684: The WP Home Page Menu WordPress plugin before 3.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0685: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4418.
Key phrases: out-of-range pointer offset
CVE-2022-0686: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-0687: The Amelia WordPress plugin before 1.0.47 stores image blobs into actual files whose extension is controlled by the user, which may lead to PHP backdoors being uploaded onto the site. This vulnerability can be exploited by logged-in users with the custom "Amelia Manager" role.
Key phrases: php backdoors
CVE-2022-0688: Business Logic Errors in Packagist microweber/microweber prior to 1.2.11.
Key phrases: business logic errors
CVE-2022-0689: Use multiple time the one-time coupon in Packagist microweber/microweber prior to 1.2.11.
CVE-2022-0690: Cross-site Scripting (XSS) - Reflected in Packagist microweber/microweber prior to 1.2.11.
Key phrases: cross-site scripting (xss)
CVE-2022-0691: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-0692: Open Redirect on Rudloff/alltube in Packagist rudloff/alltube prior to 3.0.1.
Key phrases: open redirect
CVE-2022-0693: The Master Elements WordPress plugin through 8.0 does not validate and escape the meta_ids parameter of its remove_post_meta_condition AJAX action (available to both unauthenticated and authenticated users) before using it in a SQL statement, leading to an unauthenticated SQL Injection
Key phrases: unauthenticated sql injection
CVE-2022-0694: The Advanced Booking Calendar WordPress plugin before 1.7.0 does not validate and escape the calendar parameter before using it in a SQL statement via the abc_booking_getSingleCalendar AJAX action (available to both unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Key phrases: sql injection
CVE-2022-0695: Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
Key phrases: denial of service
CVE-2022-0696: NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.4428.
Key phrases: null pointer dereference
CVE-2022-0697: Open Redirect in GitHub repository archivy/archivy prior to 1.7.0.
Key phrases: open redirect
CVE-2022-0698: Microweber version 1.3.1 allows an unauthenticated user to perform an account takeover via an XSS on the 'select-file' parameter.
Key phrases: perform an account takeover via an XSS on, xss
CVE-2022-0699: A double-free condition exists in contrib/shpsort.c of shapelib 1.5.0 and older releases. This issue may allow an attacker to cause a denial of service or have other unspecified impact via control over malloc.
Key phrases: cause a denial of service or have other, double-free condition, unspecified impact, double free
CVE-2022-0700: The Simple Tracking WordPress plugin before 1.7 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0701: The SEO 301 Meta WordPress plugin through 1.9.1 does not escape its Request and Destination settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0702: The Petfinder Listings WordPress plugin through 1.0.18 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0703: The GD Mylist WordPress plugin through 1.1.1 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0704: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
Key phrases: cross-site scripting (xss)
CVE-2022-0705: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0.
Key phrases: cross-site scripting (xss)
CVE-2022-0706: The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks when the, cross-site scripting, unfiltered_html capability
CVE-2022-0707: The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack
Key phrases: make a logged admin insert arbitrary notes via, csrf check
CVE-2022-0708: Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure.
Key phrases: access this information resulting in sensitive & private, sensitive & private information disclosure
CVE-2022-0709: The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.
Key phrases: sensitive data disclosure
CVE-2022-0710: The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-0711: A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability.
Key phrases: send crafted HTTP response packets which lead to, infinite loop, availability, denial of service
CVE-2022-0712: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4.
Key phrases: null pointer dereference
CVE-2022-0713: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4.
Key phrases: heap-based buffer overflow
CVE-2022-0714: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436.
Key phrases: heap-based buffer overflow
CVE-2022-0715: A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior / SMT Series ID=1040: UPS 01.2 and prior / SMT Series ID=1031: UPS 03.1 and prior), SMC Series (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 and prior), SCL Series (SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior), SMX Series (SMX Series ID=20: UPS 10.2 and prior / SMX Series ID=23: UPS 07.0 and prior), SRT Series (SRT Series ID=1010/1019/1025: UPS 08.3 and prior / SRT Series ID=1024: UPS 01.0 and prior / SRT Series ID=1020: UPS 10.4 and prior / SRT Series ID=1021: UPS 12.2 and prior / SRT Series ID=1001/1013: UPS 05.1 and prior / SRT Series ID=1002/1014: UPSa05.2 and prior), APC SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior)
Key phrases: cwe-287: improper authentication
CVE-2022-0717: Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2.
Key phrases: out-of-bounds read
CVE-2022-0718: A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext.
CVE-2022-0719: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3.
Key phrases: cross-site scripting (xss)
CVE-2022-0720: The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it.
Key phrases: update other's booking, sensitive information
CVE-2022-0721: Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3.
Key phrases: sensitive information
CVE-2022-0722: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.
CVE-2022-0723: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11.
Key phrases: cross-site scripting (xss)
CVE-2022-0724: Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3.
Key phrases: insecure storage of sensitive information
CVE-2022-0725: A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs.
Key phrases: interact and read sensitive passwords and logs, information exposure
CVE-2022-0726: Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0.
Key phrases: missing authorization
CVE-2022-0727: Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0.
Key phrases: improper access control
CVE-2022-0728: The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0729: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440.
Key phrases: out-of-range pointer offset
CVE-2022-0730: Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types.
Key phrases: ldap conditions, credential types, authentication bypass
CVE-2022-0731: Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0.
Key phrases: improper access control (idor)
CVE-2022-0732: The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability.
Key phrases: idor
CVE-2022-0734: A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that could allow an attacker to obtain some information stored in the user's browser, such as cookies or session tokens, via a malicious script.
Key phrases: obtain some information, obtain some information stored in the user's, cross-site scripting
CVE-2022-0735: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands.
Key phrases: information disclosure
CVE-2022-0736: Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1.
Key phrases: insecure temporary file
CVE-2022-0737: The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform Cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-0738: An issue has been discovered in GitLab affecting all versions starting from 14.6 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. GitLab was leaking user passwords when adding mirrors with SSH credentials under specific conditions.
Key phrases: leaking user passwords
CVE-2022-0739: The BookingPress WordPress plugin before 1.0.11 fails to properly sanitize user supplied POST data before it is used in a dynamically constructed SQL query via the bookingpress_front_get_category_services AJAX action (available to unauthenticated users), leading to an unauthenticated SQL Injection
Key phrases: unauthenticated sql injection
CVE-2022-0740: Incorrect authorization in the Asana integration's branch restriction feature in all versions of GitLab CE/EE starting from version 7.8.0 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 makes it possible to close Asana tasks from unrestricted branches.
Key phrases: incorrect authorization
CVE-2022-0741: Improper input validation in all versions of GitLab CE/EE using sendmail to send emails allowed an attacker to steal environment variables via specially crafted email addresses.
Key phrases: improper input validation
CVE-2022-0742: Memory leak in icmp6 implementation in Linux Kernel 5.13+ allows a remote attacker to DoS a host by making it go out-of-memory via icmp6 packets of type 130 or 131. We recommend upgrading past commit 2d3916f3189172d5c69d33065c3c21119fe539fc.
Key phrases: DoS a host by making it go out, memory leak, dos
CVE-2022-0743: Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31.
Key phrases: cross-site scripting (xss)
CVE-2022-0745: The Like Button Rating WordPress plugin before 2.6.45 allows any logged-in user, such as subscriber, to send arbitrary e-mails to any recipient, with any subject and body
Key phrases: send arbitrary e-mails, send arbitrary e-mails to any recipient
CVE-2022-0746: Business Logic Errors in GitHub repository dolibarr/dolibarr prior to 16.0.
Key phrases: business logic errors
CVE-2022-0747: The Infographic Maker WordPress plugin before 4.3.8 does not validate and escape the post_id parameter before using it in a SQL statement via the qcld_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Key phrases: sql injection
CVE-2022-0748: The package post-loader from 0.0.0 are vulnerable to Arbitrary Code Execution which uses a markdown parser in an unsafe way so that any javascript code inside the markdown input files gets evaluated and executed.
Key phrases: arbitrary code execution
CVE-2022-0749: This affects all versions of package SinGooCMS.Utility. The socket client in the package can pass in the payload via the user-controllable input after it has been established, because this socket client transmission does not have the appropriate restrictions or type bindings for the BinaryFormatter.
Key phrases: user-controllable input
CVE-2022-0750: The Photoswipe Masonry Gallery WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the thumbnail_width, thumbnail_height, max_image_width, and max_image_height parameters  found in the ~/photoswipe-masonry.php file which allows authenticated attackers to inject arbitrary web scripts into galleries created by the plugin and on the PhotoSwipe Options page. This affects versions up to and including 1.2.14.
Key phrases: inject arbitrary web scripts, inject arbitrary web scripts into galleries created by, cross-site scripting
CVE-2022-0751: Inaccurate display of Snippet files containing special characters in all versions of GitLab CE/EE allows an attacker to create Snippets with misleading content which could trick unsuspecting users into executing arbitrary commands
Key phrases: executing arbitrary commands, create Snippets with misleading content which could trick, execute arbitrary
CVE-2022-0752: Cross-site Scripting (XSS) - Generic in GitHub repository hestiacp/hestiacp prior to 1.5.9.
Key phrases: cross-site scripting (xss)
CVE-2022-0753: Cross-site Scripting (XSS) - Reflected in GitHub repository hestiacp/hestiacp prior to 1.5.9.
Key phrases: cross-site scripting (xss)
CVE-2022-0754: SQL Injection in GitHub repository salesagility/suitecrm prior to 7.12.5.
Key phrases: sql injection
CVE-2022-0755: Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.
Key phrases: missing authorization
CVE-2022-0756: Missing Authorization in GitHub repository salesagility/suitecrm prior to 7.12.5.
Key phrases: missing authorization
CVE-2022-0757: Rapid7 Nexpose versions 6.6.93 and earlier are susceptible to an SQL Injection vulnerability, whereby valid search operators are not defined. This lack of validation can allow a logged-in, authenticated attacker to manipulate the "ANY" and "OR" operators in the SearchCriteria and inject SQL code. This issue was fixed in Rapid7 Nexpose version 6.6.129.
Key phrases: manipulate the "ANY" and "OR, sql injection
CVE-2022-0758: Rapid7 Nexpose versions 6.6.129 and earlier suffer from a reflected cross site scripting vulnerability, within the shared scan configuration component of the tool. With this vulnerability an attacker could pass literal values as the test credentials, providing the opportunity for a potential XSS attack. This issue is fixed in Rapid7 Nexpose version 6.6.130.
Key phrases: reflected cross site scripting, xss
CVE-2022-0759: A flaw was found in all versions of kubeclient up to (but not including) v4.9.3, the Ruby client for Kubernetes REST API, in the way it parsed kubeconfig files. When the kubeconfig file does not configure custom CA to verify certs, kubeclient ends up accepting any certificate (it wrongly returns VERIFY_NONE). Ruby applications that leverage kubeclient to parse kubeconfig files are susceptible to Man-in-the-middle attacks (MITM).
CVE-2022-0760: The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the post_id parameter before using it in a SQL statement via the qcopd_upvote_action AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL Injection
Key phrases: sql injection
CVE-2022-0762: Incorrect Authorization in GitHub repository microweber/microweber prior to 1.3.
Key phrases: incorrect authorization
CVE-2022-0763: Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.
Key phrases: cross-site scripting (xss)
CVE-2022-0764: Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.
Key phrases: arbitrary command injection