yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-30684: Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
Key phrases: cross-site scripting (xss), low-privilege access, convince
CVE-2022-30685: Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
Key phrases: cross-site scripting (xss), low-privilege access, convince
CVE-2022-30686: Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires low-privilege access to AEM.
Key phrases: cross-site scripting (xss), low-privilege access, convince
CVE-2022-30687: Trend Micro Maximum Security 2022 is vulnerable to a link following vulnerability that could allow a low privileged local user to manipulate the product's secure erase feature to delete arbitrary files.
Key phrases: delete arbitrary files, manipulate the product's secure erase feature to, link following
CVE-2022-30688: needrestart 0.8 through 3.5 before 3.6 is prone to local privilege escalation. Regexes to detect the Perl, Python, and Ruby interpreters are not anchored, allowing a local user to escalate privileges when needrestart tries to detect if interpreters are using old source files.
Key phrases: escalate privileges when needrestart tries to detect if, local privilege escalation
CVE-2022-30689: HashiCorp Vault and Vault Enterprise from 1.10.0 to 1.10.2 did not correctly configure and enforce MFA on login after server restarts. This affects the Login MFA feature introduced in Vault and Vault Enterprise 1.10.0 and does not affect the separate Enterprise MFA feature set. Fixed in 1.10.3.
CVE-2022-3069: The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-30690: A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to arbitrary Javascript execution. An attacker can get an authenticated user to send a crafted HTTP request to trigger this vulnerability.
Key phrases: cross-site scripting (xss), arbitrary javascript
CVE-2022-30691: Uncontrolled resource consumption in the Intel(R) Support Android application before version 22.02.28 may allow an authenticated user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, uncontrolled resource consumption
CVE-2022-30692: Improper conditions check in the Intel(R) SUR software before version 2.4.8902 may allow an unauthenticated user to potentially enable denial of service via network access.
Key phrases: potentially enable denial of service via network access, improper conditions check
CVE-2022-30693: Information disclosure vulnerability in the system configuration of Cybozu Office 10.0.0 to 10.8.5 allows a remote attacker to obtain the data of the product via unspecified vectors.
Key phrases: obtain the data, obtain the data of the product via unspecified, information disclosure, unspecified vectors
CVE-2022-30694: The login endpoint /FormLogin in affected web services does not apply proper origin checking.This could allow authenticated remote attackers to track the activities of other users via a login cross-site request forgery attack.
Key phrases: track the activities of other users via a, login cross-site request forgery, cross site request forgery
CVE-2022-30695: Local privilege escalation due to excessive permissions assigned to child processes. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
Key phrases: local privilege escalation
CVE-2022-30696: Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
Key phrases: local privilege escalation, dll hijacking
CVE-2022-30697: Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 3640
Key phrases: local privilege escalation, insecure folder permissions
CVE-2022-30698: NLnet Labs Unbound, up to and including version 1.16.1 is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a subdomain of a rogue domain name. The rogue nameserver returns delegation information for the subdomain that updates Unbound's delegation cache. This action can be repeated before expiry of the delegation information by querying Unbound for a second level subdomain which the rogue nameserver provides new delegation information. Since Unbound is a child-centric resolver, the ever-updating child delegation information can keep a rogue domain name resolvable long after revocation. From version 1.16.2 on, Unbound checks the validity of parent delegation records before using cached delegation information.
Key phrases: ghost domain names
CVE-2022-30699: NLnet Labs Unbound, up to and including version 1.16.1, is vulnerable to a novel type of the "ghost domain names" attack. The vulnerability works by targeting an Unbound instance. Unbound is queried for a rogue domain name when the cached delegation information is about to expire. The rogue nameserver delays the response so that the cached delegation information is expired. Upon receiving the delayed answer containing the delegation information, Unbound overwrites the now expired entries. This action can be repeated when the delegation information is about to expire making the rogue delegation information ever-updating. From version 1.16.2 on, Unbound stores the start time for a query and uses that to decide if the cached delegation information can be overwritten.
Key phrases: ghost domain names
CVE-2022-3070: The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-30700: An incorrect permission assignment vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to load a DLL with escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, load a DLL with escalated privileges on affected, incorrect permission assignment, escalate privilege
CVE-2022-30701: An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a special configuration file to load an untrusted library with escalated privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
Key phrases: obtain the ability to execute low-privileged, craft a special configuration file to load an, uncontrolled search path element, escalate privilege
CVE-2022-30702: Trend Micro Security 2022 and 2021 (Consumer) is vulnerable to an Out-Of-Bounds Read Information Disclosure vulnerability that could allow an attacker to disclose sensitive information on an affected machine.
Key phrases: disclose sensitive information on an affected machine, out-of-bounds read information disclosure
CVE-2022-30703: Trend Micro Security 2021 and 2022 (Consumer) is vulnerable to an exposed dangerous method vulnerability that could allow an attacker to obtain access to leaked kernel addresses and disclose sensitive information. This vulnerability could also potentially be chained for privilege escalation.
Key phrases: obtain access, obtain access to leaked kernel addresses and disclose, exposed dangerous method, sensitive information, privilege escalation
CVE-2022-30704: Improper initialization in the Intel(R) TXT SINIT ACM for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper initialization, escalation privilege
CVE-2022-30705: Cross-Site Request Forgery (CSRF) vulnerability in Pankaj Jha WordPress Ping Optimizer plugin <=2.35.1.2.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-30706: Open redirect vulnerability in Booked versions prior to 3.3 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having a user to access a specially crafted URL.
Key phrases: redirect a user to an arbitrary web site, open redirect, phishing
CVE-2022-30707: Violation of secure design principles exists in the communication of CAMS for HIS. Affected products and versions are CENTUM series where LHS4800 is installed (CENTUM CS 3000 and CENTUM CS 3000 Small R3.08.10 to R3.09.00), CENTUM series where CAMS function is used (CENTUM VP, CENTUM VP Small, and CENTUM VP Basic R4.01.00 to R4.03.00), CENTUM series regardless of the use of CAMS function (CENTUM VP, CENTUM VP Small, and CENTUM VP Basic R5.01.00 to R5.04.20 and R6.01.00 to R6.09.00), Exaopc R3.72.00 to R3.80.00 (only if NTPF100-S6 'For CENTUM VP Support CAMS for HIS' is installed), B/M9000 CS R5.04.01 to R5.05.01, and B/M9000 VP R6.01.01 to R8.03.01). If an adjacent attacker successfully compromises a computer using CAMS for HIS software, they can use credentials from the compromised machine to access data from another machine using CAMS for HIS software. This can lead to a disabling of CAMS for HIS software functions on any affected machines, or information disclosure/alteration.
Key phrases: violation of secure design principles, information disclosure alteration
CVE-2022-30708: Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.
Key phrases: remote code execution when a user has been
CVE-2022-30709: Improper input validation check logic vulnerability in SECRIL prior to SMR Jun-2022 Release 1 allows attackers to trigger crash.
Key phrases: trigger crash, improper input validation check logic
CVE-2022-3071: Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction.
Key phrases: use after free, heap corruption, convince
CVE-2022-30710: Improper validation vulnerability in RemoteViews prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.
Key phrases: launch certain activities, improper validation
CVE-2022-30711: Improper validation vulnerability in FeedsInfo prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.
Key phrases: launch certain activities, improper validation
CVE-2022-30712: Improper validation vulnerability in KfaOptions prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.
Key phrases: launch certain activities, improper validation
CVE-2022-30713: Improper validation vulnerability in LSOItemData prior to SMR Jun-2022 Release 1 allows attackers to launch certain activities.
Key phrases: launch certain activities, improper validation
CVE-2022-30714: Information exposure vulnerability in SemIWCMonitor prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.
Key phrases: get MAC address information, information exposure
CVE-2022-30715: Improper access control vulnerability in DofViewer prior to SMR Jun-2022 Release 1 allows attackers to control floating system alert window.
Key phrases: control floating system alert window, improper access control
CVE-2022-30716: Unprotected broadcast in sendIntentForToastDumpLog in DisplayToast prior to SMR Jun-2022 Release 1 allows untrusted applications to access toast message information from device.
Key phrases: access toast message information from device, unprotected broadcast
CVE-2022-30717: Improper caller check in AR Emoji prior to SMR Jun-2022 Release 1 allows untrusted applications to use some camera functions via deeplink.
Key phrases: use some camera functions via deeplink, improper caller check
CVE-2022-30719: Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash.
Key phrases: trigger crash, improper input validation check logic
CVE-2022-3072: Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3.
Key phrases: cross-site scripting (xss)
CVE-2022-30720: Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash.
Key phrases: trigger crash, improper input validation check logic
CVE-2022-30721: Improper input validation check logic vulnerability in libsmkvextractor prior to SMR Jun-2022 Release 1 allows attackers to trigger crash.
Key phrases: trigger crash, improper input validation check logic
CVE-2022-30722: Implicit Intent hijacking vulnerability in Samsung Account prior to SMR Jun-2022 Release 1 allows attackers to bypass user confirmation of Samsung Account.
Key phrases: bypass user confirmation of Samsung Account, implicit intent hijacking
CVE-2022-30723: Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in activateVoiceRecognitionWithDevice function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device.
CVE-2022-30724: Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionCompleted function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device.
CVE-2022-30725: Broadcasting Intent including the BluetoothDevice object without proper restriction of receivers in sendIntentSessionError function of Bluetooth prior to SMR Jun-2022 Release 1 leaks MAC address of the connected Bluetooth device.
CVE-2022-30726: Unprotected component vulnerability in DeviceSearchTrampoline in SecSettingsIntelligence prior to SMR Jun-2022 Release 1 allows local attackers to launch activities of SecSettingsIntelligence.
Key phrases: launch activities of SecSettingsIntelligence, unprotected component
CVE-2022-30727: Improper handling of insufficient permissions vulnerability in addAppPackageNameToAllowList in PersonaManagerService prior to SMR Jun-2022 Release 1 allows local attackers to set some setting value in work space.
Key phrases: set some setting value in work space, insufficient permissions
CVE-2022-30728: Information exposure vulnerability in ScanPool prior to SMR Jun-2022 Release 1 allows local attackers to get MAC address information.
Key phrases: get MAC address information, information exposure
CVE-2022-30729: Implicit Intent hijacking vulnerability in Settings prior to SMR Jun-2022 Release 1 allows attackers to get Wi-Fi SSID and password via a malicious QR code scanner.
Key phrases: get Wi-Fi SSID and password via, implicit intent hijacking
CVE-2022-3073: Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'.
Key phrases: hijack existing sessions to e.g. other web services, javascript injection
CVE-2022-30730: Improper authorization in Samsung Pass prior to 1.0.00.33 allows physical attackers to acess account list without authentication.
Key phrases: acess account list without authentication, improper authorization
CVE-2022-30731: Improper access control vulnerability in My Files prior to version 13.1.00.193 allows attackers to access arbitrary private files in My Files application.
Key phrases: access arbitrary private files in My Files application, improper access control
CVE-2022-30732: Exposure of Sensitive Information vulnerability in Samsung Account prior to version 13.2.00.6 allows attacker to access sensitive information via onActivityResult.
Key phrases: access sensitive information via onActivityResult, exposure of sensitive information
CVE-2022-30733: Sensitive information exposure in Sign-in log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permission.
Key phrases: get an user email or phone number without, sensitive information exposure
CVE-2022-30734: Sensitive information exposure in Sign-out log in Samsung Account prior to version 13.2.00.6 allows attackers to get an user email or phone number without permission.
Key phrases: get an user email or phone number without, sensitive information exposure
CVE-2022-30735: Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the access_token without permission.
Key phrases: get the access_token without permission, improper privilege management
CVE-2022-30736: Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission.
Key phrases: get the data of contact and gallery without, improper privilege management
CVE-2022-30737: Implicit Intent hijacking vulnerability in Samsung Account prior to version 13.2.00.6 allows attackers to get email ID.
Key phrases: get email ID, implicit intent hijacking
CVE-2022-30738: Improper check in Loader in Samsung Internet prior to 17.0.1.69 allows attackers to spoof address bar via executing script.
Key phrases: spoof address bar via executing script, improper check, spoofing
CVE-2022-30739: Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get an user email or phone number with a normal level permission.
Key phrases: get an user email or phone number with, improper privilege management
CVE-2022-3074: The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks.
Key phrases: perform Cross-Site Scripting attacks, cross-site scripting
CVE-2022-30740: Improper auto-fill algorithm in Samsung Internet prior to version 17.0.1.69 allows physical attackers to guess stored credit card numbers.
Key phrases: guess stored credit card numbers, improper auto-fill algorithm
CVE-2022-30741: Sensitive information exposure vulnerability in SimChangeAlertManger of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permission to get sim card information through device log.
Key phrases: get sim card information through device log, sensitive information exposure
CVE-2022-30742: Sensitive information exposure vulnerability in FmmExtraOperation of Find My Mobile prior to 7.2.24.12 allows local attackers with log access permissio to get sim card information through device log.
Key phrases: get sim card information through device log, sensitive information exposure, fmmextraoperation
CVE-2022-30743: Improper privilege management vulnerability in Samsung Account prior to 13.2.00.6 allows attackers to get the data of contact and gallery without permission.
Key phrases: get the data of contact and gallery without, improper privilege management
CVE-2022-30744: DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code.
Key phrases: execute arbitrary code, dll hijacking
CVE-2022-30745: Improper access control vulnerability in Quick Share prior to version 13.1.2.4 allows attacker to access internal files in Quick Share.
Key phrases: access internal files in Quick Share, improper access control
CVE-2022-30746: Missing caller check in Smart Things prior to version 1.7.85.12 allows attacker to access senstive information remotely using javascript interface API.
Key phrases: access senstive information remotely using javascript interface API, missing caller check
CVE-2022-30747: PendingIntent hijacking vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to access files without permission via implicit Intent.
Key phrases: access files without permission via implicit Intent, pendingintent hijacking
CVE-2022-30748: Unprotected dynamic receiver in Samsung Members prior to version 4.2.005 allows attacker to launch arbitrary activity.
Key phrases: launch arbitrary activity, unprotected dynamic receiver
CVE-2022-30749: Improper access control vulnerability in Smart Things prior to 1.7.85.25 allows local attackers to add arbitrary smart devices by bypassing login activity.
Key phrases: add arbitrary smart devices by bypassing login activity, improper access control
CVE-2022-3075: Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Key phrases: insufficient data validation, sandbox escape
CVE-2022-30750: Improper access control vulnerability in updateLastConnectedClientInfo function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap client mac address that connected.
Key phrases: access wifi ap client mac address that connected, improper access control
CVE-2022-30751: Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap client mac address that connected by using WIFI_AP_STA_DHCPACK_EVENT action.
Key phrases: access wifi ap client mac address that connected, improper access control
CVE-2022-30752: Improper access control vulnerability in sendDHCPACKBroadcast function of SemWifiApClient prior to SMR Jul-2022 Release 1 allows attacker to access wifi ap client mac address that connected by using WIFI_AP_STA_STATE_CHANGED action.
Key phrases: access wifi ap client mac address that connected, improper access control
CVE-2022-30753: Improper use of a unique device ID in unprotected SecSoterService prior to SMR Jul-2022 Release 1 allows local attackers to get the device ID without permission.
Key phrases: get the device ID without permission
CVE-2022-30754: Implicit Intent hijacking vulnerability in AppLinker prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with privilege of AppLinker.
Key phrases: launch certain activities with privilege of AppLinker, implicit intent hijacking
CVE-2022-30755: Improper authentication vulnerability in AppLock prior to SMR Jul-2022 Release 1 allows attacker to bypass password confirm activity by hijacking the implicit intent.
Key phrases: bypass password confirm activity by hijacking the implicit intent, improper authentication
CVE-2022-30756: Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to launch certain activities with privilege of Finder.
Key phrases: launch certain activities with privilege of Finder, implicit intent hijacking
CVE-2022-30757: Improper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain CID without ACCESS_FINE_LOCATION permission.
Key phrases: obtain CID without ACCESS_FINE_LOCATION, obtain CID without ACCESS_FINE_LOCATION permission, improper authorization
CVE-2022-30758: Implicit Intent hijacking vulnerability in Finder prior to SMR Jul-2022 Release 1 allow allows attackers to access some protected information with privilege of Finder.
Key phrases: access some protected information with privilege of Finder, implicit intent hijacking
CVE-2022-30759: In Nokia One-NDS (aka Network Directory Server) through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute arbitrary commands.
Key phrases: execute arbitrary commands, sudo permissions, root privilege
CVE-2022-3076: The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example.
Key phrases: upload arbitrary files, upload arbitrary files by setting the any extension
CVE-2022-30760: An Insecure Direct Object Reference (IDOR) issue in fn2Web in ihb eG FlexNow before 2.04.09.016 allows remote authenticated attackers to obtain sensitive student information (final grades, study courses, degrees) by changing the student ID parameter in the HTTP POST request to the FrontControllerSS endpoint.
Key phrases: obtain sensitive student information, obtain sensitive student information (final grades, insecure direct object reference (idor) issue
CVE-2022-30763: Janet before 1.22.0 mishandles arrays.
Key phrases: mishandles arrays
CVE-2022-30765: Calibre-Web before 0.6.18 allows user table SQL Injection.
Key phrases: user table SQL Injection, sql injection
CVE-2022-30767: nfs_lookup_reply in net/nfs.c in Das U-Boot through 2022.04 (and through 2022.07-rc2) has an unbounded memcpy with a failed length check, leading to a buffer overflow. NOTE: this issue exists because of an incorrect fix for CVE-2019-14196.
Key phrases: buffer overflow
CVE-2022-30768: A Stored Cross Site Scripting (XSS) issue in ZoneMinder 1.36.12 allows an attacker to execute HTML or JavaScript code via the Username field when an Admin (or non-Admin users that can see other users logged into the platform) clicks on Logout. NOTE: this exists in later versions than CVE-2019-7348 and requires a different attack method.
Key phrases: execute HTML or JavaScript code via the Username, stored cross site scripting (xss), attack method
CVE-2022-30769: Session fixation exists in ZoneMinder through 1.36.12 as an attacker can poison a session cookie to the next logged-in user.
Key phrases: session fixation
CVE-2022-3077: A buffer overflow vulnerability was found in the Linux kernel Intels iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_BLOCK_PROC_CALL case (via the ioctl I2C_SMBUS) with malicious input data. This flaw could allow a local user to crash the system.
Key phrases: crash the system, buffer overflow, crash system
CVE-2022-30770: Terminalfour versions 8.3.7, 8.3.x versions prior to version 8.3.8 and r 8.2.x versions prior to version 8.2.18.5 or 8.2.18.2.1 are vulnerable to (XSS) vulnerability that could be exploited by an attacker to mislead an administrator and steal their credentials.
Key phrases: (xss)
CVE-2022-30771: Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions Initialization function in PnpSmm could lead to SMRAM corruption when using subsequent PNP SMI functions. This issue was discovered by Insyde engineering during a security review. Fixed in: Kernel 5.1: Version 05.17.25 Kernel 5.2: Version 05.27.25 Kernel 5.3: Version 05.36.25 Kernel 5.4: Version 05.44.25 Kernel 5.5: Version 05.52.25 https://www.insyde.com/security-pledge/SA-2022064
Key phrases: smram corruption
CVE-2022-30772: Manipulation of the input address in PnpSmm function 0x52 could be used by malware to overwrite SMRAM or OS kernel memory. Function 0x52 of the PnpSmm driver is passed the address and size of data to write into the SMBIOS table, but manipulation of the address could be used by malware to overwrite SMRAM or OS kernel memory. This issue was discovered by Insyde engineering during a security review. This issue is fixed in: Kernel 5.0: 05.09.41 Kernel 5.1: 05.17.43 Kernel 5.2: 05.27.30 Kernel 5.3: 05.36.30 Kernel 5.4: 05.44.30 Kernel 5.5: 05.52.30 https://www.insyde.com/security-pledge/SA-2022065
Key phrases: manipulation of the input address
CVE-2022-30773: DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). DMA attacks on the parameter buffer used by the IhisiSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack). This issue was discovered by Insyde engineering. This issue is fixed in Kernel 5.4: 05.44.23 and Kernel 5.5: 05.52.23. CWE-367
Key phrases: dma, toctou
CVE-2022-30774: DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack) DMA attacks on the parameter buffer used by the PnpSmm driver could change the contents after parameter values have been checked but before they are used (a TOCTOU attack) . This issue was discovered by Insyde engineering during a security review. This iss was fixed in Kernel 5.2: 05.27.29, Kernel 5.3: 05.36.25, Kernel 5.4: 05.44.25, Kernel 5.5: 05.52.25. CWE-367 https://www.insyde.com/security-pledge/SA-2022043
Key phrases: dma, toctou
CVE-2022-30775: xpdf 4.04 allocates excessive memory when presented with crafted input. This can be triggered by (for example) sending a crafted PDF document to the pdftoppm binary. It is most easily reproduced with the DCMAKE_CXX_COMPILER=afl-clang-fast++ option.
CVE-2022-30776: atmail 6.5.0 allows XSS via the index.php/admin/index/ error parameter.
Key phrases: XSS via the index.php/admin/index/ error parameter, xss
CVE-2022-30777: Parallels H-Sphere 3.6.1713 allows XSS via the index_en.php from parameter.
Key phrases: XSS via the index_en.php from parameter, xss
CVE-2022-3078: An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c.
CVE-2022-30780: Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.
Key phrases: denial of service (CPU consumption from stuck connections), cause a denial of service (CPU consumption, cpu consumption, typo
CVE-2022-30781: Gitea before 1.16.7 does not escape git fetch remote.
CVE-2022-30782: Openmoney API through 2020-06-29 uses the JavaScript Math.random function, which does not provide cryptographically secure random numbers.
Key phrases: cryptographically secure random numbers
CVE-2022-30783: An invalid return code in fuse_kern_mount enables intercepting of libfuse-lite protocol traffic between NTFS-3G and the kernel in NTFS-3G through 2021.8.22 when using libfuse-lite.
Key phrases: invalid return code
CVE-2022-30784: A crafted NTFS image can cause heap exhaustion in ntfs_get_attribute_value in NTFS-3G through 2021.8.22.
Key phrases: heap exhaustion
CVE-2022-30785: A file handle created in fuse_lib_opendir, and later used in fuse_lib_readdir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
Key phrases: enables arbitrary memory, arbitrary memory read and write operations
CVE-2022-30786: A crafted NTFS image can cause a heap-based buffer overflow in ntfs_names_full_collate in NTFS-3G through 2021.8.22.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2022-30787: An integer underflow in fuse_lib_readdir enables arbitrary memory read operations in NTFS-3G through 2021.8.22 when using libfuse-lite.
Key phrases: enables arbitrary memory read operations, integer underflow
CVE-2022-30788: A crafted NTFS image can cause a heap-based buffer overflow in ntfs_mft_rec_alloc in NTFS-3G through 2021.8.22.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2022-30789: A crafted NTFS image can cause a heap-based buffer overflow in ntfs_check_log_client_array in NTFS-3G through 2021.8.22.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2022-3079: Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service.
Key phrases: critical webpage functions which may cause a denial, unauthenticated, remote access, denial of service
CVE-2022-30790: Das U-Boot 2022.01 has a Buffer Overflow, a different issue than CVE-2022-30552.
Key phrases: buffer overflow
CVE-2022-30791: In CmpBlkDrvTcp of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new TCP connections. Existing connections are not affected.
Key phrases: block new TCP connections, uncontrolled ressource consumption
CVE-2022-30792: In CmpChannelServer of CODESYS V3 in multiple versions an uncontrolled ressource consumption allows an unauthorized attacker to block new communication channel connections. Existing connections are not affected.
Key phrases: block new communication channel connections, uncontrolled ressource consumption
CVE-2022-30794: Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductetails.php.
Key phrases: sql injection
CVE-2022-30795: Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/editproductimage.php.
Key phrases: sql injection
CVE-2022-30797: Online Ordering System 1.0 by oretnom23 is vulnerable to SQL Injection via admin/vieworders.php.
Key phrases: sql injection
CVE-2022-30798: Online Ordering System v1.0 by oretnom23 is vulnerable to SQL Injection via admin/viewreport.php.
Key phrases: sql injection
CVE-2022-30799: Online Ordering System v1.0 by oretnom23 has SQL injection via store/orderpage.php.
Key phrases: sql injection
CVE-2022-3080: By sending specific queries to the resolver, an attacker can cause named to crash.
Key phrases: crash
CVE-2022-30804: elitecms v1.01 is vulnerable to Delete any file via /admin/delete_image.php?file=.
CVE-2022-30808: elitecms 1.0.1 is vulnerable to Arbitrary code execution via admin/manage_uploads.php.
Key phrases: arbitrary code execution
CVE-2022-30809: elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_page.php?page=.
Key phrases: sql injection
CVE-2022-30810: elitecms v1.01 is vulnerable to SQL Injection via admin/edit_post.php.
Key phrases: sql injection
CVE-2022-30813: elitecms 1.01 is vulnerable to SQL Injection via /admin/add_post.php.
Key phrases: sql injection
CVE-2022-30814: elitecms v1.01 is vulnerable to SQL Injection via /admin/add_sidebar.php.
Key phrases: sql injection
CVE-2022-30815: elitecms 1.01 is vulnerable to SQL Injection via admin/edit_sidebar.php?page=2&sidebar=
Key phrases: sql injection
CVE-2022-30816: elitecms 1.01 is vulnerable to SQL Injection via /admin/edit_sidebar.php.
Key phrases: sql injection
CVE-2022-30817: Simple Bus Ticket Booking System 1.0 is vulnerable to SQL Injection via /SimpleBusTicket/index.php.
Key phrases: sql injection
CVE-2022-30818: Wedding Management System v1.0 is vulnerable to SQL injection via /Wedding-Management/admin/blog_events_edit.php?id=31.
Key phrases: sql injection
CVE-2022-30819: In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "photos_edit.php" file.
Key phrases: arbitrary file upload
CVE-2022-3082: The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example
Key phrases: call them, csrf
CVE-2022-30820: In Wedding Management v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_edit.php" file.
Key phrases: arbitrary file upload
CVE-2022-30821: In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file upload vulnerability in the picture upload point of "package_edit.php" file.
Key phrases: arbitrary file upload
CVE-2022-30822: In Wedding Management System v1.0, there is an arbitrary file upload vulnerability in the picture upload point of "users_profile.php" file.
Key phrases: arbitrary file upload
CVE-2022-30823: Wedding Management System v1.0 is vulnerable to SQL Injection via \\\\admin\\\\blog_events_edit.php.
Key phrases: sql injection
CVE-2022-30825: Wedding Management System v1.0 is vulnerable to SQL Injection via \\\\admin\\\\client_edit.php.
Key phrases: sql injection
CVE-2022-30826: Wedding Management System v1.0 is vulnerable to SQL Injection via admin\\\\client_assign.php.
Key phrases: sql injection
CVE-2022-30827: Wedding Management System v1.0 is vulnerable to SQL Injection via \\\\admin\\\\package_edit.php.
Key phrases: sql injection
CVE-2022-30828: Wedding Management System v1.0 is vulnerable to SQL Injection via \\\\admin\\\\photos_edit.php.
Key phrases: sql injection
CVE-2022-30829: Wedding Management System v1.0 is vulnerable to SQL Injection via \\\\admin\\\\users_edit.php.
Key phrases: sql injection
CVE-2022-3083: All versions of Landis+Gyr E850 (ZMQ200) are vulnerable toCWE-784: Reliance on Cookies Without Validation and Integrity.The device's web application navigation depends on the value of the session cookie. The web application could become inaccessible for the user if an attacker changes the cookie values.
Key phrases: inaccessible
CVE-2022-30830: Wedding Management System v1.0 is vulnerable to SQL Injection via \\\\admin\\\\feature_edit.php.
Key phrases: sql injection
CVE-2022-30831: Wedding Management System v1.0 is vulnerable to SQL Injection via Wedding-Management/wedding_details.php.
Key phrases: sql injection
CVE-2022-30832: Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_assign.php?booking=31&user_id=.
Key phrases: sql injection
CVE-2022-30833: Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_edit.php?booking=31&user_id=.
Key phrases: sql injection
CVE-2022-30834: Wedding Management System v1.0 is vulnerable to SQL Injection via /Wedding-Management/admin/client_manage_account_details.php?booking_id=31&user_id=
Key phrases: sql injection
CVE-2022-30835: Wedding Management System v1.0 is vulnerable to SQL Injection. via /Wedding-Management/admin/budget.php?booking_id=.
Key phrases: sql injection
CVE-2022-30836: Wedding Management System v1.0 is vulnerable to SQL Injection. via Wedding-Management/admin/select.php.
Key phrases: sql injection
CVE-2022-30837: Toll-tax-management-system v1.0 is vulnerable to Cross Site Scripting (XSS) via /ttms/classes/Master.php?f=save_recipient, vehicle_name.
Key phrases: cross site scripting (xss)
CVE-2022-30838: Covid-19 Travel Pass Management System v1.0 is vulnerable to SQL Injection via /ctpms/classes/Master.php?f=update_application_status
Key phrases: sql injection
CVE-2022-30839: Room-rent-portal-site v1.0 is vulnerable to Cross Site Scripting (XSS) via /rrps/classes/Master.php?f=save_category, vehicle_name.
Key phrases: cross site scripting (xss)
CVE-2022-3084: GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could allow an attacker to execute arbitrary code. 
Key phrases: execute arbitrary code, faulting address
CVE-2022-30842: Covid-19 Travel Pass Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /ctpms/classes/Users.php?f=save, firstname.
Key phrases: cross site scripting (xss)
CVE-2022-30843: Room-rent-portal-site v1.0 is vulnerable to SQL Injection via /rrps/classes/Master.php?f=delete_category, id.
Key phrases: sql injection
CVE-2022-3085: Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code.
Key phrases: execute arbitrary code, stack-based buffer overflow, stack based buffer overflow
CVE-2022-30852: Known v1.3.1 was discovered to contain an Insecure Direct Object Reference (IDOR).
Key phrases: insecure direct object reference (idor)
CVE-2022-30858: An issue was discovered in ngiflib 0.4. There is SEGV in SDL_LoadAnimatedGif when use SDLaffgif. poc : ./SDLaffgif CA_file2_0
Key phrases: segv
CVE-2022-3086: Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable to shell escape, which enables local attackers with non-superuser credentials to gain full, unrestrictive shell access which may allow an attacker to execute arbitrary code.
Key phrases: execute arbitrary code, gain full, unrestrictive shell, shell escape
CVE-2022-30860: FUDforum 3.1.2 is vulnerable to Remote Code Execution through Upload File feature of File Administration System in Admin Control Panel.
Key phrases: remote code execution
CVE-2022-30861: FUDforum 3.1.2 is vulnerable to Stored XSS via Forum Name field in Forum Manager Feature.
Key phrases: stored xss
CVE-2022-30863: FUDForum 3.1.2 is vulnerable to Cross Site Scripting (XSS) via page_title param in Page Manager in the Admin Control Panel.
Key phrases: cross site scripting (xss)
CVE-2022-3087: Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code.
Key phrases: execute arbitrary code, out-of-bounds write, out of bounds write
CVE-2022-30874: There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.
Key phrases: cross site scripting stored (xss)
CVE-2022-30875: Dolibarr 12.0.5 is vulnerable to Cross Site Scripting (XSS) via Sql Error Page.
Key phrases: cross site scripting (xss), sql error page
CVE-2022-30877: The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.
Key phrases: code-execution backdoor, code execution
CVE-2022-3088: UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12,&nbsp;UC-3100 System Image: Versions v1.0 to v1.6,&nbsp;UC-5100 System Image: Versions v1.0 to v1.4, UC-8100 System Image: Versions v3.0 to v3.5, UC-8100-ME-T System Image: Versions v3.0 and v3.1, UC-8200 System Image: v1.0 to v1.5, AIG-300 System Image: v1.0 to v1.4, UC-8410A with Debian 9 System Image: Versions v4.0.2 and v4.1.2, UC-8580 with Debian 9 System Image: Versions v2.0 and v2.1, UC-8540 with Debian 9 System Image: Versions v2.0 and v2.1, and DA-662C-16-LX (GLB) System Image: Versions v1.0.2 to v1.1.2 of Moxa's ARM-based computers have an execution with unnecessary privileges vulnerability, which could allow an attacker with user-level privileges to gain root privileges.
Key phrases: gain root privileges, execution with unnecessary privileges
CVE-2022-30882: pyanxdns package in PyPI version 0.2 is vulnerable to code execution backdoor. The impact is: execute arbitrary code (remote). When installing the pyanxdns package of version 0.2, the request package will be installed.
Key phrases: execute arbitrary code, code execution backdoor, execute arbitrary code (remote)
CVE-2022-30885: The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2.
Key phrases: code-execution backdoor, code execution
CVE-2022-30886: School Dormitory Management System v1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /dms/admin/reports/daily_collection_report.php.
Key phrases: sql injection
CVE-2022-30887: Pharmacy Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component /php_action/editProductImage.php. This vulnerability allows attackers to execute arbitrary code via a crafted image file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted image file, remote code execution (rce)
CVE-2022-3089: Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control the web user interface and file transfer protocol (FTP) server.  
Key phrases: obtain cleartext usernames and passwords, obtain cleartext usernames and passwords of the SmartServer, cleartext credentials
CVE-2022-30898: A Cross-site request forgery (CSRF) vulnerability in Cscms music portal system v4.2 allows remote attackers to change the administrator's username and password.
Key phrases: change the administrator's username and password, cross-site request forgery (csrf)
CVE-2022-30899: A Cross Site Scripting vulnerabilty exists in PartKeepr 1.4.0 via the 'name' field in /api/part_categories.
Key phrases: cross site scripting
CVE-2022-3090: Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes.
Key phrases: obtain user credential hashes., path traversal
CVE-2022-30903: Nokia "G-2425G-A" Bharti Airtel Routers Hardware version "3FE48299DEAA" Software Version "3FE49362IJHK42" is vulnerable to Cross-Site Scripting (XSS) via the admin->Maintenance>Device Management.
Key phrases: cross-site scripting (xss)
CVE-2022-30904: In Bestechnic Bluetooth Mesh SDK (BES2300) V1.0, a buffer overflow vulnerability can be triggered during provisioning, because there is no check for the SegN field of the Transaction Start PDU.
Key phrases: buffer overflow
CVE-2022-30909: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the CMD parameter at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-3091: RONDS EPM version 1.19.5 has a vulnerability in which a function could allow unauthenticated users to leak credentials. In some circumstances, an attacker can exploit this vulnerability to execute operating system (OS) commands. 
Key phrases: leak credentials
CVE-2022-30910: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the GO parameter at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-30912: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateWanParams parameter at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-30913: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the ipqos_set_bandwidth parameter at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-30914: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateMacClone parameter at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-30915: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the UpdateSnat parameter at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-30916: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnetDebug parameter at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-30917: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the AddWlanMacList parameter at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-30918: H3C Magic R100 R100V100R005 was discovered to contain a stack overflow vulnerability via the Asp_SetTelnet parameter at /goform/aspForm.
Key phrases: stack overflow