yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-44109: pdftojson commit 94204bb was discovered to contain a stack overflow via the component Stream::makeFilter(char*, Stream*, Object*, int).
Key phrases: stack overflow
CVE-2022-44117: Boa 0.94.14rc21 is vulnerable to SQL Injection via username.
Key phrases: sql injection
CVE-2022-44118: dedecmdv6 v6.1.9 is vulnerable to Remote Code Execution (RCE) via file_manage_control.php.
Key phrases: remote code execution (rce)
CVE-2022-44120: dedecmdv6 6.1.9 is vulnerable to SQL Injection. via sys_sql_query.php.
Key phrases: sql injection
CVE-2022-4413: Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13.
Key phrases: cross-site scripting (xss)
CVE-2022-44136: Zenario CMS 9.3.57186 is vulnerable to Remote Code Excution (RCE).
Key phrases: remote code excution (rce)
CVE-2022-44137: SourceCodester Sanitization Management System 1.0 is vulnerable to SQL Injection.
Key phrases: sql injection
CVE-2022-44139: Apartment Visitor Management System v1.0 is vulnerable to SQL Injection via /avms/index.php.
Key phrases: sql injection
CVE-2022-4414: Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13.
Key phrases: cross-site scripting (xss)
CVE-2022-44140: Jizhicms v2.3.3 was discovered to contain a SQL injection vulnerability via the /Member/memberedit.html component.
Key phrases: sql injection
CVE-2022-44149: The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. Authentication is required
Key phrases: the ping feature of the goform/sysTools, remote os command execution
CVE-2022-4415: A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting.
Key phrases: local information leak
CVE-2022-44151: Simple Inventory Management System v1.0 is vulnerable to SQL Injection via /ims/login.php.
Key phrases: sql injection
CVE-2022-44153: Rapid Software LLC Rapid SCADA 5.8.4 is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2022-44156: Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetIpMacBind.
Key phrases: buffer overflow
CVE-2022-44158: Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function via set_device_name.
Key phrases: buffer overflow
CVE-2022-4416: A vulnerability was found in RainyGao DocSys. It has been declared as critical. This vulnerability affects the function getReposAllUsers of the file /DocSystem/Repos/getReposAllUsers.do. The manipulation of the argument searchWord/reposId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-215278 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-44163: Tenda AC21 V16.03.08.15 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
Key phrases: buffer overflow
CVE-2022-44167: Tenda AC15 V15.03.05.18 is avulnerable to Buffer Overflow via function formSetPPTPServer.
Key phrases: buffer overflow
CVE-2022-44168: Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function fromSetRouteStatic..
Key phrases: buffer overflow
CVE-2022-44169: Tenda AC15 V15.03.05.18 is vulnerable to Buffer Overflow via function formSetVirtualSer.
Key phrases: buffer overflow
CVE-2022-4417: The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users
Key phrases: bypass the restriction, bypass the restriction in place and list users, rest api users endpoint
CVE-2022-44171: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function form_fast_setting_wifi_set.
Key phrases: buffer overflow
CVE-2022-44172: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function R7WebsSecurityHandler.
Key phrases: buffer overflow
CVE-2022-44174: Tenda AC18 V15.03.05.05 is vulnerable to Buffer Overflow via function formSetDeviceName.
Key phrases: buffer overflow
CVE-2022-44175: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetMacFilterCfg.
Key phrases: buffer overflow
CVE-2022-44176: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function fromSetRouteStatic.
Key phrases: buffer overflow
CVE-2022-44177: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formWifiWpsStart.
Key phrases: buffer overflow
CVE-2022-44178: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow. via function formWifiWpsOOB.
Key phrases: buffer overflow
CVE-2022-4418: Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40208.
Key phrases: local privilege escalation
CVE-2022-44180: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function addWifiMacFilter.
Key phrases: buffer overflow
CVE-2022-44183: Tenda AC18 V15.03.05.19 is vulnerable to Buffer Overflow via function formSetWifiGuestBasic.
Key phrases: buffer overflow
CVE-2022-44184: Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_sec.
Key phrases: buffer overflow
CVE-2022-44186: Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter wan_dns1_pri.
Key phrases: buffer overflow
CVE-2022-44187: Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via wan_dns1_pri.
Key phrases: buffer overflow
CVE-2022-44188: Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameter enable_band_steering.
Key phrases: buffer overflow
CVE-2022-44190: Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter enable_band_steering.
Key phrases: buffer overflow
CVE-2022-44191: Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameters KEY1 and KEY2.
Key phrases: buffer overflow
CVE-2022-44193: Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow in /usr/sbin/httpd via parameters: starthour, startminute , endhour, and endminute.
Key phrases: buffer overflow
CVE-2022-44194: Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameters apmode_dns1_pri and apmode_dns1_sec.
Key phrases: buffer overflow
CVE-2022-44196: Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_push1.
Key phrases: buffer overflow
CVE-2022-44197: Netgear R7000P V1.3.0.8 is vulnerable to Buffer Overflow via parameter openvpn_server_ip.
Key phrases: buffer overflow
CVE-2022-44198: Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_push1.
Key phrases: buffer overflow
CVE-2022-44199: Netgear R7000P V1.3.1.64 is vulnerable to Buffer Overflow via parameter openvpn_server_ip.
Key phrases: buffer overflow
CVE-2022-44200: Netgear R7000P V1.3.0.8, V1.3.1.64 is vulnerable to Buffer Overflow via parameters: stamode_dns1_pri and stamode_dns1_sec.
Key phrases: buffer overflow
CVE-2022-44201: D-Link DIR823G 1.02B05 is vulnerable to Commad Injection.
Key phrases: commad injection
CVE-2022-44202: D-Link DIR878 1.02B04 and 1.02B05 are vulnerable to Buffer Overflow.
Key phrases: buffer overflow
CVE-2022-44204: D-Link DIR3060 DIR3060A1_FW111B04.bin is vulnerable to Buffer Overflow.
Key phrases: buffer overflow
CVE-2022-4421: A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view.php of the component Service Desk Image URL Handler. The manipulation of the argument sslink leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 8a39b2b2bf28353b3503ff1421862393db15aa7e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215304.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-44211: In GL.iNet Goodcloud 1.1 Incorrect access control allows a remote attacker to access/change devices' settings.
Key phrases: access/change devices' settings, incorrect access control
CVE-2022-44212: In GL.iNet Goodcloud 1.0, insecure design allows remote attacker to access devices' admin panel.
Key phrases: access devices' admin panel, insecure design
CVE-2022-44213: ZKTeco Xiamen Information Technology ZKBio ECO ADMS <=3.1-164 is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2022-44215: There is an open redirect vulnerability in Titan FTP server 19.0 and below. Users are redirected to any target URL.
Key phrases: open redirect
CVE-2022-44216: Gnuboard 5.5.4 and 5.5.5 is vulnerable to Insecure Permissions. An attacker can change password of all users without knowing victim's original password.
Key phrases: insecure permissions
CVE-2022-4422: Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in the version 3.0
CVE-2022-44232: libming 0.4.8 0.4.8 is vulnerable to Buffer Overflow. In getInt() in decompile.c unknown type may lead to denial of service. This is a different vulnerability than CVE-2018-9132 and CVE-2018-20427.
Key phrases: buffer overflow, denial of service
CVE-2022-44235: Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2022-44236: Beijing Zed-3 Technologies Co.,Ltd VoIP simpliclty ASG 8.5.0.17807 (20181130-16:12) has a Weak password vulnerability.
Key phrases: weak password
CVE-2022-44244: An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.
Key phrases: bypass in Lin-CMS v0.2.1 allows attackers, authentication bypass, escalate privileges to Super Administrator
CVE-2022-44249: TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function.
Key phrases: command injection
CVE-2022-44250: TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function.
Key phrases: command injection
CVE-2022-44251: TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function.
Key phrases: command injection
CVE-2022-44252: TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function.
Key phrases: command injection
CVE-2022-44253: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter ip in the setDiagnosisCfg function.
Key phrases: post-authentication buffer overflow
CVE-2022-44254: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter text in the setSmsCfg function.
Key phrases: post-authentication buffer overflow
CVE-2022-44255: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a pre-authentication buffer overflow in the main function via long post data.
Key phrases: pre-authentication buffer overflow
CVE-2022-44256: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter lang in the setLanguageCfg function.
Key phrases: post-authentication buffer overflow
CVE-2022-44257: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter pppoeUser in the setOpModeCfg function.
Key phrases: post-authentication buffer overflow
CVE-2022-44258: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter command in the setTracerouteCfg function.
Key phrases: post-authentication buffer overflow
CVE-2022-44259: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter week, sTime, and eTime in the setParentalRules function.
Key phrases: post-authentication buffer overflow
CVE-2022-4426: The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack.
Key phrases: change arbitrary blog options, make a logged in admin change arbitrary blog, csrf check
CVE-2022-44260: TOTOLINK LR350 V9.3.5u.6369_B20220309 contains a post-authentication buffer overflow via parameter sPort/ePort in the setIpPortFilterRules function.
Key phrases: post-authentication buffer overflow
CVE-2022-44261: Avery Dennison Monarch Printer M9855 is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2022-44262: ff4j 1.8.1 is vulnerable to Remote Code Execution (RCE).
Key phrases: remote code execution (rce)
CVE-2022-44263: Dentsply Sirona Sidexis <= 4.3 is vulnerable to Incorrect Access Control.
Key phrases: incorrect access control
CVE-2022-44264: Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path.
Key phrases: unquoted service path
CVE-2022-44267: ImageMagick 7.1.0-49 is vulnerable to Denial of Service. When it parses a PNG image (e.g., for resize), the convert process could be left waiting for stdin input.
Key phrases: denial of service
CVE-2022-44268: ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. When it parses a PNG image (e.g., for resize), the resulting image could have embedded the content of an arbitrary. file (if the magick binary has permissions to read it).
Key phrases: information disclosure, arbitrary file
CVE-2022-4427: Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch WebserviceThis issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34.
Key phrases: SQL Injection via TicketSearch WebserviceThis issue affects OTRS, improper input validation, sql injection
CVE-2022-44276: In Responsive Filemanager < 9.12.0, an attacker can bypass upload restrictions resulting in RCE.
Key phrases: bypass upload restrictions, rce
CVE-2022-44277: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/classes/Master.php?f=delete_product.
Key phrases: sql injection
CVE-2022-44278: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=user/manage_user&id=.
Key phrases: sql injection
CVE-2022-44279: Garage Management System v1.0 is vulnerable to Cross Site Scripting (XSS) via /garage/php_action/createBrand.php.
Key phrases: cross site scripting (xss)
CVE-2022-4428: support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients).
Key phrases: privilege escalation
CVE-2022-44280: Automotive Shop Management System v1.0 is vulnerable to Delete any file via /asms/classes/Master.php?f=delete_img.
Key phrases: delete any file
CVE-2022-44283: AVS Audio Converter 10.3 is vulnerable to Buffer Overflow.
Key phrases: buffer overflow
CVE-2022-44284: Dinstar FXO Analog VoIP Gateway DAG2000-16O is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2022-44289: Thinkphp 5.1.41 and 5.0.24 has a code logic error which causes file upload getshell.
Key phrases: code logic error, file upload getshell
CVE-2022-4429: Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service.The issue was fixed with Avira Security version 1.1.78
Key phrases: cause a Denial of Service, unquoted service path, denial of service
CVE-2022-44290: webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php.
Key phrases: sql injection
CVE-2022-44291: webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
Key phrases: sql injection
CVE-2022-44294: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/manage_service&id=.
Key phrases: sql injection
CVE-2022-44295: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/assign_team.php?id=.
Key phrases: sql injection
CVE-2022-44296: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/quotes/manage_remark.php?id=.
Key phrases: sql injection
CVE-2022-44297: SiteServer CMS 7.1.3 has a SQL injection vulnerability the background.
Key phrases: sql injection
CVE-2022-44298: SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
Key phrases: sql injection
CVE-2022-44299: SiteServerCMS 7.1.3 sscms has a file read vulnerability.
Key phrases: file read
CVE-2022-44303: Resque Scheduler version 1.27.4 is vulnerable to Cross-site scripting (XSS). A remote attacker could inject javascript code to the "{schedule_job}" or "args" parameter in /resque/delayed/jobs/{schedule_job}?args={args_id} to execute javascript at client side.
Key phrases: cross-site scripting (xss)
CVE-2022-4431: The WOOCS WordPress plugin before 1.3.9.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-44310: In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shared secret.
Key phrases: obtain the derived shared secret., invalid point
CVE-2022-44311: html2xhtml v1.3 was discovered to contain an Out-Of-Bounds read in the function static void elm_close(tree_node_t *nodo) at procesador.c. This vulnerability allows attackers to access sensitive files or cause a Denial of Service (DoS) via a crafted html file.
Key phrases: Denial of Service (DoS), access sensitive files or cause a Denial of, out-of-bounds read, denial of service (dos)
CVE-2022-44312: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceInteger function in expression.c when called from ExpressionInfixOperator.
Key phrases: heap buffer overflow
CVE-2022-44313: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceUnsignedInteger function in expression.c when called from ExpressionParseFunctionCall.
Key phrases: heap buffer overflow
CVE-2022-44314: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrncpy function in cstdlib/string.c when called from ExpressionParseFunctionCall.
Key phrases: heap buffer overflow
CVE-2022-44315: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionAssign function in expression.c when called from ExpressionParseFunctionCall.
Key phrases: heap buffer overflow
CVE-2022-44316: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexGetStringConstant function in lex.c when called from LexScanGetToken.
Key phrases: heap buffer overflow
CVE-2022-44317: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioOutPutc function in cstdlib/stdio.c when called from ExpressionParseFunctionCall.
Key phrases: heap buffer overflow
CVE-2022-44318: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StringStrcat function in cstdlib/string.c when called from ExpressionParseFunctionCall.
Key phrases: heap buffer overflow
CVE-2022-44319: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the StdioBasePrintf function in cstdlib/string.c when called from ExpressionParseFunctionCall.
Key phrases: heap buffer overflow
CVE-2022-4432: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
Key phrases: cause information disclosure, buffer over-read, buffer over read
CVE-2022-44320: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the ExpressionCoerceFP function in expression.c when called from ExpressionParseFunctionCall.
Key phrases: heap buffer overflow
CVE-2022-44321: PicoC Version 3.2.2 was discovered to contain a heap buffer overflow in the LexSkipComment function in lex.c when called from LexScanGetToken.
Key phrases: heap buffer overflow
CVE-2022-4433: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
Key phrases: cause information disclosure, buffer over-read, buffer over read
CVE-2022-4434: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS driver that could allow a local attacker with elevated privileges to cause information disclosure.
Key phrases: cause information disclosure, buffer over-read, buffer over read
CVE-2022-44343: CRMEB 4.4.4 is vulnerable to Any File download.
Key phrases: any file download
CVE-2022-44345: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=quotes/view_quote&id=.
Key phrases: sql injection
CVE-2022-44347: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=inquiries/view_inquiry&id=.
Key phrases: sql injection
CVE-2022-44348: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/orders/update_status.php?id=.
Key phrases: sql injection
CVE-2022-44349: NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50 is vulnerable to Cross Site Scripting (XSS).
Key phrases: cross site scripting (xss)
CVE-2022-4435: A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoRemoteConfigUpdateDxe driver that could allow a local attacker with elevated privileges to cause information disclosure.
Key phrases: cause information disclosure, buffer over-read, buffer over read
CVE-2022-44351: Skycaiji v2.5.1 was discovered to contain a deserialization vulnerability via /SkycaijiApp/admin/controller/Mystore.php.
Key phrases: deserialization
CVE-2022-44354: SolarView Compact 4.0 and 5.0 is vulnerable to Unrestricted File Upload via a crafted php file.
Key phrases: unrestricted file upload
CVE-2022-44355: SolarView Compact 7.0 is vulnerable to Cross-site Scripting (XSS) via /network_test.php.
Key phrases: cross-site scripting (xss)
CVE-2022-44356: WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access control issue which allows unauthenticated attackers to download configuration data and log files.
Key phrases: download configuration data and log files, access control issue
CVE-2022-4436: Use after free in Blink Media in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: use after free, heap corruption
CVE-2022-44361: An issue was discovered in ZZCMS 2022. There is a cross-site scripting (XSS) vulnerability in admin/ad_list.php.
Key phrases: cross-site scripting (xss)
CVE-2022-44362: Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/AddSysLogRule.
Key phrases: buffer overflow
CVE-2022-44363: Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setSnmpInfo.
Key phrases: buffer overflow
CVE-2022-44365: Tenda i21 V1.0.0.14(4656) has a stack overflow vulnerability via /goform/setSysPwd.
Key phrases: stack overflow
CVE-2022-44366: Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setDiagnoseInfo.
Key phrases: buffer overflow
CVE-2022-44367: Tenda i21 V1.0.0.14(4656) is vulnerable to Buffer Overflow via /goform/setUplinkInfo.
Key phrases: buffer overflow
CVE-2022-44368: NASM v2.16 was discovered to contain a null pointer deference in the NASM component
Key phrases: null pointer deference
CVE-2022-44369: NASM 2.16 (development) is vulnerable to 476: Null Pointer Dereference via output/outaout.c.
Key phrases: null pointer dereference
CVE-2022-4437: Use after free in Mojo IPC in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: use after free, heap corruption
CVE-2022-44370: NASM v2.16 was discovered to contain a heap buffer overflow in the component quote_for_pmake() asm/nasm.c:856
Key phrases: heap buffer overflow
CVE-2022-44371: hope-boot 1.0.0 has a deserialization vulnerability that can cause Remote Code Execution (RCE).
Key phrases: deserialization, remote code execution (rce)
CVE-2022-44373: A stack overflow vulnerability exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (Version v1.0R, firmware version 1.01.B01) which may result in remote code execution.
Key phrases: stack overflow, remote code execution
CVE-2022-44378: Automotive Shop Management System v1.0 is vulnerable to SQL via /asms/classes/Master.php?f=delete_mechanic.
Key phrases: sql
CVE-2022-44379: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_service.
Key phrases: sql injection
CVE-2022-4438: Use after free in Blink Frames in Google Chrome prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: use after free, heap corruption, convince
CVE-2022-44380: Snipe-IT before 6.0.14 is vulnerable to Cross Site Scripting (XSS) for View Assigned Assets.
Key phrases: cross site scripting (xss)
CVE-2022-44381: Snipe-IT through 6.0.14 allows attackers to check whether a user account exists because of response variations in a /password/reset request.
Key phrases: check whether a user account exists because of, response variations
CVE-2022-44384: An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-44387: EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Basic Information component under the Edit Member module.
Key phrases: cross-site request forgery (csrf)
CVE-2022-44389: EyouCMS V1.5.9-UTF8-SP1 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Edit Admin Profile module. This vulnerability allows attackers to arbitrarily change Administrator account information.
Key phrases: arbitrarily change Administrator account information, cross-site request forgery (csrf)
CVE-2022-4439: Use after free in Aura in Google Chrome on Windows prior to 108.0.5359.124 allowed a remote attacker who convinced the user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. (Chromium security severity: High)
Key phrases: use after free, heap corruption, convince
CVE-2022-44390: A cross-site scripting (XSS) vulnerability in EyouCMS V1.5.9-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Public Security Record Number text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-44393: Sanitization Management System v1.0 is vulnerable to SQL Injection via /php-sms/admin/?page=services/view_service&id=.
Key phrases: sql injection
CVE-2022-44399: Poultry Farm Management System v1.0 contains a SQL injection vulnerability via the del parameter at /Redcock-Farm/farm/category.php.
Key phrases: sql injection
CVE-2022-4440: Use after free in Profiles in Google Chrome prior to 108.0.5359.124 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Key phrases: use after free, heap corruption
CVE-2022-44400: Purchase Order Management System v1.0 contains a file upload vulnerability via /purchase_order/admin/?page=system_info.
Key phrases: file upload
CVE-2022-44401: Online Tours & Travels Management System v1.0 contains an arbitrary file upload vulnerability via /tour/admin/file.php.
Key phrases: arbitrary file upload
CVE-2022-44402: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/classes/Master.php?f=delete_transaction.
Key phrases: sql injection
CVE-2022-44403: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/?page=user/manage_user&id=.
Key phrases: sql injection
CVE-2022-4441: Incorrect Privilege Assignment vulnerability in Hitachi Storage Plug-in for VMware vCenter allows remote authenticated users to cause privilege escalation.This issue affects Hitachi Storage Plug-in for VMware vCenter: from 04.9.0 before 04.9.1.
Key phrases: cause privilege escalation, incorrect privilege assignment
CVE-2022-44411: Web Based Quiz System v1.0 transmits user passwords in plaintext during the authentication process, allowing attackers to obtain users' passwords via a bruteforce attack.
Key phrases: obtain users' passwords, obtain users' passwords via a bruteforce attack, plaintext
CVE-2022-44413: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/manage_mechanic.php?id=.
Key phrases: sql injection
CVE-2022-44414: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/services/manage_service.php?id=.
Key phrases: sql injection
CVE-2022-44415: Automotive Shop Management System v1.0 is vulnerable to SQL Injection via /asms/admin/mechanics/view_mechanic.php?id=.
Key phrases: sql injection
CVE-2022-44419: In modem, there is a possible missing verification of NAS Security Mode Command Replay Attacks in LTE. This could local denial of service with no additional execution privileges.
Key phrases: nas security mode command replay, local denial of service
CVE-2022-4442: The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2022-44420: In modem, there is a possible missing verification of HashMME value in Security Mode Command. This could local denial of service with no additional execution privileges.
Key phrases: local denial of service
CVE-2022-44421: In wlan driver, there is a possible missing permission check. This could lead to local In wlan driver,  information disclosure.
Key phrases: missing permission check, information disclosure
CVE-2022-44422: In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-44423: In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-44424: In music service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-44425: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44426: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44427: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44428: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44429: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-4443: The BruteBank WordPress plugin before 1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack.
Key phrases: make a logged-in admin change them, csrf check
CVE-2022-44430: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44431: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44432: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44433: In phoneEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
Key phrases: permission check, local escalation of privilege, additional execution privileges, escalation privilege
CVE-2022-44434: In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-44435: In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-44436: In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-44437: In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-44438: In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-44439: In messaging service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-4444: A vulnerability was found in ipti br.tag. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 2.13.0 is able to address this issue. The name of the patch is 7e311be22d3a0a1b53e61cb987ba13d681d85f06. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-215431.
Key phrases: cross site scripting
CVE-2022-44440: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44441: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44442: In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44443: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44444: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44445: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44446: In wlan driver, there is a possible missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: missing bounds check, local denial of service
CVE-2022-44447: In wlan driver, there is a possible null pointer dereference issue due to a missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: null pointer dereference issue, local denial of service
CVE-2022-44448: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-44449: Stored cross-site scripting vulnerability in Zenphoto versions prior to 1.6 allows remote a remote authenticated attacker with an administrative privilege to inject an arbitrary script.
Key phrases: inject an arbitrary script, cross-site scripting
CVE-2022-4445: The FL3R FeelBox WordPress plugin through 8.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Key phrases: sql injection
CVE-2022-44451: A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3. A specially crafted malformed file can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: uninitialized pointer, arbitrary code execution, malicious file
CVE-2022-44455: The appspawn and nwebspawn services within OpenHarmony-v3.1.2 and prior versions were found to be vulnerable to buffer overflow vulnerability due to insufficient input validation. An unprivileged malicious application would be able to gain code execution within any application installed on the device or cause application crash.
Key phrases: gain code execution, buffer overflow, application crash, insufficient input validation
CVE-2022-44456: CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request.
Key phrases: execute an arbitrary OS command on the server, arbitrary os command, execute arbitrary
CVE-2022-44457: A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions < V1.17.0), Mendix SAML (Mendix 7 compatible) (All versions >= V1.17.0 < V1.17.2), Mendix SAML (Mendix 8 compatible) (All versions < V2.3.0), Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.2), Mendix SAML (Mendix 9 compatible, New Track) (All versions < V3.3.1), Mendix SAML (Mendix 9 compatible, New Track) (All versions >= V3.3.1 < V3.3.5), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions < V3.3.0), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.4). Affected versions of the module insufficiently protect from packet capture replay, only when the not recommended, non default configuration option `'Allow Idp Initiated Authentication'` is enabled. This CVE entry describes the incomplete fix for CVE-2022-37011 in a specific non default configuration.
Key phrases: Idp Initiated Authentication'` is enabled
CVE-2022-4446: PHP Remote File Inclusion in GitHub repository tsolucio/corebos prior to 8.0.
Key phrases: php remote file inclusion
CVE-2022-44462: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-44463: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-44465: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-44466: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-44467: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-44468: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-44469: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-4447: The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Key phrases: sql injection
CVE-2022-44470: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-44471: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-44473: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-44474: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-4448: The GiveWP WordPress plugin before 2.24.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-44488: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a URL Redirection to Untrusted Site ('Open Redirect') vulnerability. A low-privilege authenticated attacker could leverage this vulnerability to redirect users to malicious websites. Exploitation of this issue requires user interaction.
Key phrases: url redirection to untrusted site, exploitation
CVE-2022-4449: The Page scroll to id WordPress plugin before 1.7.6 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-44498: Adobe Illustrator versions 26.5.1 (and earlier), and 27.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2022-44499: Adobe Illustrator versions 26.5.1 (and earlier), and 27.0 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure