yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-37939: A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. The vulnerability could be locally exploited to allow disclosure of information. HPE has made the following software to resolve the vulnerability in HPE Superdome Flex Servers v3.65.8 and Superdome Flex 280 Servers v1.45.8.
Key phrases: resolve the vulnerability in HPE Superdome Flex Servers, disclosure of information
CVE-2022-3794: The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6.  Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not use capability checks for this purpose.
Key phrases: bypass in various AJAX actions in versions up, authorization bypass
CVE-2022-37940: Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series. These vulnerabilities could be remotely exploited to allow host header injection and URL redirection. HPE has made the following software to resolve the vulnerability in HPE FlexFabric 5700 Switch Series version R2432P61 or later.
Key phrases: resolve the vulnerability in HPE FlexFabric 5700 Switch, host header injection, url redirection
CVE-2022-37952: A reflected cross-site scripting (XSS) vulnerability exists in the iHistorian Data Display of WorkstationST (<v07.09.15) could allow an attacker to compromise a victim's browser. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.09.07 SP8 and greater.
Key phrases: compromise a victim's browser, cross-site scripting (xss), attack complexity
CVE-2022-37953: An HTTP response splitting vulnerability exists in the AM Gateway Challenge-Response dialog of WorkstationST (<v07.09.15) and could allow an attacker to compromise a victim's browser/session. WorkstationST is only deployed in specific, controlled environments rendering attack complexity significantly higher than if the attack were conducted on the software in isolation. WorkstationST v07.09.15 can be found in ControlST v07.09.07 SP8 and greater.
Key phrases: compromise a victim's browser/session, http response splitting, attack complexity
CVE-2022-37954: DirectX Graphics Kernel Elevation of Privilege Vulnerability
Key phrases: directx graphics kernel elevation of privilege
CVE-2022-37955: Windows Group Policy Elevation of Privilege Vulnerability
Key phrases: windows group policy elevation of privilege
CVE-2022-37956: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-37957: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-37958: SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-37959: Network Device Enrollment Service (NDES) Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2022-37961: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-37962: Microsoft PowerPoint Remote Code Execution Vulnerability
Key phrases: microsoft powerpoint remote code execution
CVE-2022-37963: Microsoft Office Visio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-37964: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-37965: Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability
Key phrases: windows point-to-point tunneling protocol, denial of service
CVE-2022-37966: Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-37967: Windows Kerberos Elevation of Privilege Vulnerability
Key phrases: windows kerberos elevation of privilege
CVE-2022-37968: <p>Microsoft has identified a vulnerability affecting the cluster connect feature of Azure Arc-enabled Kubernetes clusters. This vulnerability could allow an unauthenticated user to elevate their privileges and potentially gain administrative control over the Kubernetes cluster. Additionally, because Azure Stack Edge allows customers to deploy Kubernetes workloads on their devices via Azure Arc, Azure Stack Edge devices are also vulnerable to this vulnerability.</p>
Key phrases: gain administrative control, elevate their privileges and potentially gain administrative control, deploy Kubernetes workloads on their devices via Azure, elevate privileges
CVE-2022-37969: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2022-3797: A vulnerability was found in eolinker apinto-dashboard. It has been rated as problematic. This issue affects some unknown processing of the file /login. The manipulation of the argument callback leads to open redirect. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212633 was assigned to this vulnerability.
Key phrases: open redirect
CVE-2022-37970: Windows DWM Core Library Elevation of Privilege Vulnerability
Key phrases: windows dwm core library elevation of privilege
CVE-2022-37971: Microsoft Windows Defender Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-37972: Microsoft Endpoint Configuration Manager Spoofing Vulnerability
Key phrases: spoofing
CVE-2022-37973: Windows Local Session Manager (LSM) Denial of Service Vulnerability
Key phrases: windows local session manager (lsm), denial of service
CVE-2022-37974: Windows Mixed Reality Developer Tools Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-37975: Windows Group Policy Elevation of Privilege Vulnerability
Key phrases: windows group policy elevation of privilege
CVE-2022-37976: Active Directory Certificate Services Elevation of Privilege Vulnerability
Key phrases: active directory certificate services elevation of privilege
CVE-2022-37977: Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-37978: Windows Active Directory Certificate Services Security Feature Bypass
Key phrases: Security Feature Bypass, security feature bypass
CVE-2022-37979: Windows Hyper-V Elevation of Privilege Vulnerability
Key phrases: windows hyper-v elevation of privilege
CVE-2022-3798: A vulnerability classified as critical has been found in IBAX go-ibax. Affected is an unknown function of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212634 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-37980: Windows DHCP Client Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-37981: Windows Event Logging Service Denial of Service Vulnerability
Key phrases: windows event logging service denial of service
CVE-2022-37982: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-37983: Microsoft DWM Core Library Elevation of Privilege Vulnerability
Key phrases: microsoft dwm core library elevation of privilege
CVE-2022-37984: Windows WLAN Service Elevation of Privilege Vulnerability
Key phrases: windows wlan service elevation of privilege
CVE-2022-37985: Windows Graphics Component Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-37986: Windows Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-37987: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-37988: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-37989: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-3799: A vulnerability classified as critical was found in IBAX go-ibax. Affected by this vulnerability is an unknown functionality of the file /api/v2/open/tablesInfo. The manipulation leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212635.
Key phrases: sql injection
CVE-2022-37990: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-37991: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-37992: Windows Group Policy Elevation of Privilege Vulnerability
Key phrases: windows group policy elevation of privilege
CVE-2022-37993: Windows Group Policy Preference Client Elevation of Privilege Vulnerability
Key phrases: windows group policy preference client elevation of privilege
CVE-2022-37994: Windows Group Policy Preference Client Elevation of Privilege Vulnerability
Key phrases: windows group policy preference client elevation of privilege
CVE-2022-37995: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-37996: Windows Kernel Memory Information Disclosure Vulnerability
Key phrases: windows kernel memory information disclosure
CVE-2022-37997: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2022-37998: Windows Local Session Manager (LSM) Denial of Service Vulnerability
Key phrases: windows local session manager (lsm), denial of service
CVE-2022-37999: Windows Group Policy Preference Client Elevation of Privilege Vulnerability
Key phrases: windows group policy preference client elevation of privilege
CVE-2022-3800: A vulnerability, which was classified as critical, has been found in IBAX go-ibax. Affected by this issue is some unknown functionality of the file /api/v2/open/rowsInfo. The manipulation of the argument table_name leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212636.
Key phrases: sql injection
CVE-2022-38000: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: windows point-to-point tunneling protocol remote code execution
CVE-2022-38001: Microsoft Office Spoofing Vulnerability
Key phrases: microsoft office spoofing
CVE-2022-38003: Windows Resilient File System Elevation of Privilege
Key phrases: elevation of privilege
CVE-2022-38004: Windows Fax Service Remote Code Execution Vulnerability
Key phrases: windows fax service remote code execution
CVE-2022-38005: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-38006: Windows Graphics Component Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-38007: Azure Guest Configuration and Azure Arc-enabled servers Elevation of Privilege Vulnerability
Key phrases: azure guest configuration, elevation of privilege
CVE-2022-38008: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-38009: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-3801: A vulnerability, which was classified as critical, was found in IBAX go-ibax. This affects an unknown part of the file /api/v2/open/rowsInfo. The manipulation of the argument order leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212637 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-38010: Microsoft Office Visio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-38011: Raw Image Extension Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-38012: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-38013: .NET Core and Visual Studio Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-38014: Windows Subsystem for Linux (WSL2) Kernel Elevation of Privilege Vulnerability
Key phrases: kernel elevation of privilege
CVE-2022-38015: Windows Hyper-V Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-38016: Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-38017: StorSimple 8000 Series Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-38019: AV1 Video Extension Remote Code Execution Vulnerability
Key phrases: video extension remote code execution
CVE-2022-3802: A vulnerability has been found in IBAX go-ibax and classified as critical. This vulnerability affects unknown code of the file /api/v2/open/rowsInfo. The manipulation of the argument where leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-212638 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-38020: Visual Studio Code Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-38021: Connected User Experiences and Telemetry Elevation of Privilege Vulnerability
Key phrases: telemetry elevation of privilege
CVE-2022-38022: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-38023: Netlogon RPC Elevation of Privilege Vulnerability
Key phrases: netlogon rpc elevation of privilege
CVE-2022-38025: Windows Distributed File System (DFS) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-38026: Windows DHCP Client Information Disclosure Vulnerability
Key phrases: windows dhcp client information disclosure
CVE-2022-38027: Windows Storage Elevation of Privilege Vulnerability
Key phrases: windows storage elevation of privilege
CVE-2022-38028: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-38029: Windows ALPC Elevation of Privilege Vulnerability
Key phrases: windows alpc elevation of privilege
CVE-2022-3803: A vulnerability was found in eolinker apinto-dashboard and classified as problematic. This issue affects some unknown processing of the file /api/discoveries/. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212639.
CVE-2022-38030: Windows USB Serial Driver Information Disclosure Vulnerability
Key phrases: windows usb serial driver information disclosure
CVE-2022-38031: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-38032: Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2022-38033: Windows Server Remotely Accessible Registry Keys Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-38034: Windows Workstation Service Elevation of Privilege Vulnerability
Key phrases: windows workstation service elevation of privilege
CVE-2022-38036: Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-38037: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-38038: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-38039: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-3804: A vulnerability was found in eolinker apinto-dashboard. It has been classified as problematic. Affected is an unknown function of the file /login. The manipulation of the argument callback leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212640.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-38040: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-38041: Windows Secure Channel Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-38042: Active Directory Domain Services Elevation of Privilege Vulnerability
Key phrases: active directory domain services elevation of privilege
CVE-2022-38043: Windows Security Support Provider Interface Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-38044: Windows CD-ROM File System Driver Remote Code Execution Vulnerability
Key phrases: windows cd-rom file system driver remote code execution
CVE-2022-38045: Windows Server Service Elevation of Privilege Vulnerability
Key phrases: windows server service elevation of privilege
CVE-2022-38046: Web Account Manager Information Disclosure Vulnerability
Key phrases: web account manager information disclosure
CVE-2022-38047: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: windows point-to-point tunneling protocol remote code execution
CVE-2022-38048: Microsoft Office Remote Code Execution Vulnerability
Key phrases: microsoft office remote code execution
CVE-2022-38049: Microsoft Office Graphics Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-3805: The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
Key phrases: bypass in various functions used to update the plugin settings, authorization bypass
CVE-2022-38050: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-38051: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2022-38053: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-38054: In Apache Airflow versions 2.2.4 through 2.3.3, the `database` webserver session backend was susceptible to session fixation.
Key phrases: session fixation
CVE-2022-38056: Improper neutralization in the Intel(R) EMA software before version 1.8.1.0 may allow a privileged user to potentially enable escalation of privilege via network access.
Key phrases: potentially enable escalation of privilege via network access, improper neutralization, escalation privilege
CVE-2022-38058: Authenticated (subscriber+) Plugin Setting change vulnerability in WP Shamsi plugin <= 4.1.1 at WordPress.
Key phrases: plugin setting change
CVE-2022-38059: Cross-Site Request Forgery (CSRF) vulnerability in Alexey Trofimov's Access Code Feeder plugin <= 1.0.3 at WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-3806: Inconsistent handling of error cases in bluetooth hci may lead to a double free condition of a network buffer.
Key phrases: double free condition
CVE-2022-38060: A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a container can lead to increased privileges.
Key phrases: privilege escalation, increased privileges
CVE-2022-38061: Authenticated (author+) CSV Injection vulnerability in Export Post Info plugin <= 1.2.0 at WordPress.
Key phrases: csv injection
CVE-2022-38062: Cross-Site Request Forgery (CSRF) vulnerability in Metagauss Download Theme plugin <=1.0.9 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-38063: Cross-Site Request Forgery (CSRF) vulnerability in Social Login WP plugin<= 5.0.0.0 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-38064: OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. Local attackers can bypass permission control and get sensitive information.
Key phrases: bypass permission, permission bypass, sensitive information
CVE-2022-38065: A privilege escalation vulnerability exists in the oslo.privsep functionality of OpenStack git master 05194e7618 and prior. Overly permissive functionality within tools leveraging this library within a container can lead increased privileges.
Key phrases: privilege escalation, increased privileges
CVE-2022-38066: An OS command injection vulnerability exists in the httpd SNMP functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP response can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability.
Key phrases: os command injection, arbitrary command execution, arbitrary commands
CVE-2022-38067: Unauthenticated Event Deletion vulnerability in Totalsoft Event Calendar  Calendar plugin <= 1.4.6 at WordPress.
Key phrases: unauthenticated event deletion
CVE-2022-38068: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Apasionados Export Post Info plugin <= 1.1.0 at WordPress.
Key phrases: stored cross-site scripting (xss)
CVE-2022-38069: Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient information or modification of device parameters
Key phrases: gain privileged, gain privileged access to any device, default credentials,
CVE-2022-3807: A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Incomplete Fix CVE-2019-13238. The manipulation leads to resource consumption. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212660.
Key phrases: resource consumption
CVE-2022-38070: Privilege Escalation (subscriber+) vulnerability in Pop-up plugin <= 1.1.5 at WordPress.
Key phrases: privilege escalation
CVE-2022-38072: An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and v0.98.4. A specially-crafted stl file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: array index validation, heap buffer overflow, malicious file
CVE-2022-38073: Multiple Authenticated (custom specific plugin role) Persistent Cross-Site Scripting (XSS) vulnerability in Awesome Support plugin <= 6.0.7 at WordPress.
Key phrases: persistent cross-site scripting (xss)
CVE-2022-38074: SQL Injection vulnerability in VeronaLabs WP Statistics plugin<= 13.2.10 versions.
Key phrases: sql injection
CVE-2022-38075: Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS) in Mantenimiento web plugin <= 0.13 on WordPress.
Key phrases: cross-site request forgery (csrf), stored cross-site scripting (xss)
CVE-2022-38076: Improper input validation in some Intel(R) PROSet/Wireless WiFi and Killer(TM) WiFi software may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2022-38077: Cross-Site Request Forgery (CSRF) vulnerability in WP OnlineSupport, Essential Plugin Popup Anything  A Marketing Popup and Lead Generation Conversions plugin <=2.2.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-38078: Movable Type XMLRPC API provided by Six Apart Ltd. contains a command injection vulnerability. Sending a specially crafted message by POST method to Movable Type XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products and versions are as follows: Movable Type 7 r.5202 and earlier, Movable Type Advanced 7 r.5202 and earlier, Movable Type 6.8.6 and earlier, Movable Type Advanced 6.8.6 and earlier, Movable Type Premium 1.52 and earlier, and Movable Type Premium Advanced 1.52 and earlier. Note that all versions of Movable Type 4.0 or later including unsupported (End-of-Life, EOL) versions are also affected by this vulnerability.
Key phrases: allow arbitrary Perl script execution, command injection, arbitrary os command
CVE-2022-38079: Cross-Site Request Forgery (CSRF) vulnerability Backup Scheduler plugin <= 1.5.13 at WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-38080: Reflected cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.
Key phrases: inject an arbitrary script, reflected cross-site scripting
CVE-2022-38081: OpenHarmony-v3.1.2 and prior versions have a permission bypass vulnerability. LAN attackers can bypass the distributed permission control.To take advantage of this weakness, attackers need another vulnerability to obtain system.
Key phrases: bypass the distributed permission, permission bypass, obtain system.
CVE-2022-38083: Improper initialization in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper initialization
CVE-2022-38085: Cross-Site Request Forgery (CSRF) vulnerability in Read more By Adam plugin <= 1.1.8 at WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-38086: Cross-Site Request Forgery (CSRF) vulnerability in Shortcodes Ultimate plugin <= 5.12.0 at WordPress leading to plugin preset settings change.
Key phrases: cross-site request forgery (csrf), plugin preset settings change
CVE-2022-38087: Exposure of resource to wrong sphere in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, exposure of resource
CVE-2022-38088: A directory traversal vulnerability exists in the httpd downfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: directory traversal, arbitrary file read
CVE-2022-38089: Stored cross-site scripting vulnerability in Exment ((PHP8) exceedone/exment v5.0.2 and earlier and exceedone/laravel-admin v3.0.0 and earlier, (PHP7) exceedone/exment v4.4.2 and earlier and exceedone/laravel-admin v2.2.2 and earlier) allows a remote authenticated attacker to inject an arbitrary script.
Key phrases: inject an arbitrary script, cross-site scripting
CVE-2022-3809: A vulnerability was found in Axiomatic Bento4 and classified as problematic. Affected by this issue is the function ParseCommandLine of the file Mp4Tag/Mp4Tag.cpp of the component mp4tag. The manipulation leads to denial of service. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212666 is the identifier assigned to this vulnerability.
Key phrases: denial of service
CVE-2022-38090: Improper isolation of shared resources in some Intel(R) Processors when using Intel(R) Software Guard Extensions may allow a privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper isolation of shared resources
CVE-2022-38093: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in All in One SEO plugin <= 4.2.3.1 at WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-38094: OS command injection vulnerability in the telnet function of CentreCOM AR260S V2 firmware versions prior to Ver.3.3.7 allows a remote authenticated attacker to execute an arbitrary OS command.
Key phrases: execute an arbitrary OS command, os command injection, execute arbitrary, arbitrary os command
CVE-2022-38095: Cross-Site Request Forgery (CSRF) vulnerability in AlgolPlus Advanced Dynamic Pricing for WooCommerce plugin <= 4.1.3 at WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-38096: A NULL pointer dereference vulnerability was found in vmwgfx driver in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in GPU component of Linux kernel with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS).
Key phrases: denial of service(DoS), gain privilege, null pointer dereference, denial of service(dos), gain privileges
CVE-2022-38097: A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.0.1.12430. By prematurely destroying annotation objects, a specially-crafted PDF document can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. An attacker needs to trick the user into opening the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
Key phrases: use-after-free, arbitrary code execution, exploitation, use after free
CVE-2022-38099: Improper input validation in BIOS firmware for some Intel(R) NUC 11 Compute Elements before version EBTGL357.0065 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper input validation, escalation privilege
CVE-2022-3810: A vulnerability was found in Axiomatic Bento4. It has been classified as problematic. This affects the function AP4_File::AP4_File of the file Mp42Hevc.cpp of the component mp42hevc. The manipulation leads to denial of service. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212667.
Key phrases: denial of service
CVE-2022-38100: The CMS800 device fails while attempting to parse malformed network data sent by a threat actor. A threat actor with network access can remotely issue a specially formatted UDP request that will cause the entire device to crash and require a physical reboot. A UDP broadcast request could be sent that causes a mass denial-of-service attack on all CME8000 devices connected to the same network.
Key phrases: malformed network data, network access, mass denial-of-service, crash, reboot, denial of service
CVE-2022-38101: Uncontrolled search path in some Intel(R) NUC Chaco Canyon BIOS update software before version iFlashV Windows 5.13.00.2105 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path, escalation privilege
CVE-2022-38102: Improper Input validation in firmware for some Intel(R) Converged Security and Management Engine before versions 15.0.45, and 16.1.27 may allow a privileged user to potentially enable denial of service via local access.
Key phrases: potentially enable denial of service via local access, improper input validation
CVE-2022-38103: Insecure inherited permissions in the Intel(R) NUC Software Studio Service installer before version 1.17.38.0 may allow an authenticated user to potentially enable escalation of privilege via local access
Key phrases: potentially enable escalation of privilege via local access, insecure inherited permissions, escalation privilege
CVE-2022-38104: Auth. WordPress Options Change (siteurl, users_can_register, default_role, admin_email and new_admin_email) vulnerability in Biplob Adhikari's Accordions  Multiple Accordions or FAQs Builder plugin (versions <= 2.0.3 on WordPress.
Key phrases: new_admin_email
CVE-2022-38105: An information disclosure vulnerability exists in the cm_processREQ_NC opcode of Asus RT-AX82U 3.0.0.4.386_49674-ge182230 router's configuration service. A specially-crafted network packets can lead to a disclosure of sensitive information. An attacker can send a network request to trigger this vulnerability.
Key phrases: information disclosure, sensitive information
CVE-2022-38106: This vulnerability happens in the web client versions 15.3.0 to Serv-U 15.3.1. This vulnerability affects the directory creation function.
CVE-2022-38107: Sensitive information could be displayed when a detailed technical error message is posted. This information could disclose environmental details.
Key phrases: sensitive information, environmental details
CVE-2022-38108: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
Key phrases: execute arbitrary commands, SolarWinds Web Console to execute arbitrary commands, deserialization of untrusted data
CVE-2022-3811: The EU Cookie Law for GDPR/CCPA WordPress plugin through 3.1.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-38110: In Database Performance Analyzer (DPA) 2022.4 and older releases, certain URL vectors are susceptible to authenticated reflected cross-site scripting.
Key phrases: url vectors, authenticated reflected cross-site scripting
CVE-2022-38111: SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. This vulnerability allows a remote adversary with Orion admin-level account access to SolarWinds Web Console to execute arbitrary commands.
Key phrases: execute arbitrary commands, SolarWinds Web Console to execute arbitrary commands, deserialization of untrusted data
CVE-2022-38112: In DPA 2022.4 and older releases, generated heap memory dumps contain sensitive information in cleartext.
Key phrases: heap memory dumps, cleartext, sensitive information
CVE-2022-38113: This vulnerability discloses build and services versions in the server response header.
CVE-2022-38114: This vulnerability occurs when a web server fails to correctly process the Content-Length of POST requests. This can lead to HTTP request smuggling or XSS.
Key phrases: http request smuggling, xss
CVE-2022-38115: Insecure method vulnerability in which allowed HTTP methods are disclosed. E.g., OPTIONS, DELETE, TRACE, and PUT
Key phrases: insecure method
CVE-2022-38116: Le-yan Personnel and Salary Management System has hard-coded database account and password within the website source code. An unauthenticated remote attacker can access, modify system data or disrupt service.
Key phrases: hard-coded database account, disrupt service
CVE-2022-38117: Juiker app hard-coded its AES key in the source code. A physical attacker, after getting the Android root privilege, can use the AES key to decrypt users ciphertext and tamper with it.
Key phrases: android root privilege
CVE-2022-38118: OAKlouds Portal websites Meeting Room has insufficient validation for user input. A remote attacker with general user privilege can perform SQL-injection to access, modify, delete database, perform system operations and disrupt service.
Key phrases: sql-injection, disrupt service
CVE-2022-38119: UPSMON Pro login function has insufficient authentication. An unauthenticated remote attacker can exploit this vulnerability to bypass authentication and get administrator privilege to access, control system or disrupt service.
Key phrases: bypass authentication, disrupt service
CVE-2022-3812: A vulnerability was found in Axiomatic Bento4. It has been rated as problematic. Affected by this issue is the function AP4_ContainerAtom::AP4_ContainerAtom of the component mp4encrypt. The manipulation leads to memory leak. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-212678 is the identifier assigned to this vulnerability.
Key phrases: memory leak
CVE-2022-38120: UPSMON PROs has a path traversal vulnerability. A remote attacker with general user privilege can exploit this vulnerability to bypass authentication and access arbitrary system files.
Key phrases: access arbitrary system files, bypass authentication, upsmon pros, path traversal
CVE-2022-38121: UPSMON PRO configuration file stores user password in plaintext under public user directory. A remote attacker with general user privilege can access all users and administrators' account names and passwords via this unprotected configuration file.
Key phrases: unprotected configuration file
CVE-2022-38122: UPSMON PRO transmits sensitive data in cleartext over HTTP protocol. An unauthenticated remote attacker can exploit this vulnerability to access sensitive data.
CVE-2022-38123: Improper Input Validation of plugin files in Administrator Interface of Secomea GateManager allows a server administrator to inject code into the GateManager interface.This issue affects:Secomea GateManagerversions prior to 10.0.
Key phrases: inject code into the GateManager interface, improper input validation
CVE-2022-38124: Debug tool in Secomea SiteManager allows logged-in administrator to modify system state in an unintended manner.
Key phrases: modify system state in an unintended manner
CVE-2022-38125: Improper Restriction of Communication Channel to Intended Endpoints vulnerability in Secomea SiteManager (FTP Agent modules) allows Exploiting Trust in Client.
Key phrases: Exploiting Trust in Client, improper restriction of communication channel, exploiting trust in client
CVE-2022-38129: A path traversal vulnerability exists in the com.keysight.tentacle.licensing.LicenseManager.addLicenseFile() method in the Keysight Sensor Management Server (SMS). This allows an unauthenticated remote attacker to upload arbitrary files to the SMS host.
Key phrases: upload arbitrary files, upload arbitrary files to the SMS host, path traversal
CVE-2022-3813: A vulnerability classified as problematic has been found in Axiomatic Bento4. This affects an unknown part of the component mp4edit. The manipulation leads to memory leak. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212679.
Key phrases: memory leak
CVE-2022-38130: The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. It takes the path of the zipped database file as the single parameter. An unauthenticated, remote attacker can specify an UNC path for the database file (i.e., \\\\\\\\<attacker-host>\\\\sms\\\\<attacker-db.zip>), effectively controlling the content of the database to be restored.
CVE-2022-38131: RStudio Connect prior to 2023.01.0 is affected by an Open Redirect issue. The vulnerability could allow an attacker to redirect users to malicious websites.
Key phrases: redirect users to malicious websites, open redirect
CVE-2022-38132: Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL construction arguments, allowing URL redirection to an arbitrary server, downloading an arbitrary script file, and eventually executing the file in the device. This issue affects: Linksys MR8300 Router 1.0.
Key phrases: execute arbitrary OS commands, an arbitrary server, command injection, arbitrary os command, arbitrary script
CVE-2022-38133: In JetBrains TeamCity before 2022.04.3 the private SSH key could be written to the server log in some cases
CVE-2022-38134: Authenticated (subscriber+) Broken Access Control vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress.
Key phrases: broken access control
CVE-2022-38135: Broken Access Control vulnerability in Dean Oakley's Photospace Gallery plugin <= 2.3.5 at WordPress allows users with subscriber or higher role to change plugin settings.
Key phrases: change plugin settings, broken access control
CVE-2022-38136: Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel Fortran Compiler for Windows before version 2022.2.1 for some Intel(R) oneAPI Toolkits before version 2022.3.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path, escalation privilege
CVE-2022-38137: Cross-Site Request Forgery (CSRF) vulnerability in Analytify plugin <= 4.2.2 on WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-38138: The Triangle Microworks IEC 61850 Library (Any client or server using the C language library with a version number of 11.2.0 or earlier and any client or server using the C++, C#, or Java language library with a version number of 5.0.1 or earlier) and 60870-6 (ICCP/TASE.2) Library (Any client or server using a C++ language library with a version number of 4.4.3 or earlier) are vulnerable to access given to a small number of uninitialized pointers within their code. This could allow an attacker to target any client or server using the affected libraries to cause a denial-of-service condition.
Key phrases: target any client or server using the affected, uninitialized pointers, denial-of-service condition, denial of service
CVE-2022-38139: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in RD Station plugin <= 5.2.0 at WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-3814: A vulnerability classified as problematic was found in Axiomatic Bento4. This vulnerability affects unknown code of the component mp4decrypt. The manipulation leads to memory leak. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212680.
Key phrases: memory leak
CVE-2022-38140: Auth. (contributor+)Arbitrary File Upload inSEO Plugin by Squirrly SEO plugin <=12.1.10 on WordPress.
Key phrases: arbitrary file upload
CVE-2022-38142: Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway service port without proper verification. An attacker could provide malicious serialized objects to execute arbitrary code upon deserialization.
Key phrases: execute arbitrary code
CVE-2022-38143: A heap out-of-bounds write vulnerability exists in the way OpenImageIO v2.3.19.0 processes RLE encoded BMP images. A specially-crafted bmp file can write to arbitrary out of bounds memory, which can lead to arbitrary code execution. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: heap out-of-bounds write, arbitrary code execution, malicious file, out of bounds write, file write, out of bounds memory
CVE-2022-38144: Cross-Site Request Forgery (CSRF) vulnerability in gVectors Team wpForo Forum plugin <= 2.0.5 at WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-38145: Silverstripe silverstripe/framework through 4.11 allows XSS (issue 1 of 3) via remote attackers adding a Javascript payload to a page's meta description and get it executed in the versioned history compare view.
Key phrases: a page's meta description and get it, xss
CVE-2022-38146: Silverstripe silverstripe/framework through 4.11 allows XSS (issue 2 of 3).
Key phrases: XSS (issue 2 of 3), xss
CVE-2022-38147: Silverstripe silverstripe/framework through 4.11 allows XSS (issue 3 of 3).
Key phrases: XSS (issue 3 of 3), xss
CVE-2022-38148: Silverstripe silverstripe/framework through 4.11 allows SQL Injection.
Key phrases: SQL Injection, sql injection
CVE-2022-38149: HashiCorp Consul Template up to 0.27.2, 0.28.2, and 0.29.1 may expose the contents of Vault secrets in the error returned by the *template.Template.Execute method, when given a template using Vault secret contents incorrectly. Fixed in 0.27.3, 0.28.3, and 0.29.2.
CVE-2022-3815: A vulnerability, which was classified as problematic, has been found in Axiomatic Bento4. This issue affects some unknown processing of the component mp4decrypt. The manipulation leads to memory leak. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-212681 was assigned to this vulnerability.
Key phrases: memory leak
CVE-2022-38150: In Varnish Cache 7.0.0, 7.0.1, 7.0.2, and 7.1.0, it is possible to cause the Varnish Server to assert and automatically restart through forged HTTP/1 backend responses. An attack uses a crafted reason phrase of the backend response status line. This is fixed in 7.0.3 and 7.1.1.
CVE-2022-38152: An issue was discovered in wolfSSL before 5.5.0. When a TLS 1.3 client connects to a wolfSSL server and SSL_clear is called on its session, the server crashes with a segmentation fault. This occurs in the second session, which is created through TLS session resumption and reuses the initial struct WOLFSSL. If the server reuses the previous session structure (struct WOLFSSL) by calling wolfSSL_clear(WOLFSSL* ssl) on it, the next received Client Hello (that resumes the previous session) crashes the server. Note that this bug is only triggered when resuming sessions using TLS session resumption. Only servers that use wolfSSL_clear instead of the recommended SSL_free; SSL_new sequence are affected. Furthermore, wolfSSL_clear is part of wolfSSL's compatibility layer and is not enabled by default. It is not part of wolfSSL's native API.
Key phrases: crash, segmentation fault
CVE-2022-38153: An issue was discovered in wolfSSL before 5.5.0 (when --enable-session-ticket is used); however, only version 5.3.0 is exploitable. Man-in-the-middle attackers or a malicious server can crash TLS 1.2 clients during a handshake. If an attacker injects a large ticket (more than 256 bytes) into a NewSessionTicket message in a TLS 1.2 handshake, and the client has a non-empty session cache, the session cache frees a pointer that points to unallocated memory, causing the client to crash with a "free(): invalid pointer" message. NOTE: It is likely that this is also exploitable during TLS 1.3 handshakes between a client and a malicious server. With TLS 1.3, it is not possible to exploit this as a man-in-the-middle.
Key phrases: exploitable, man-in-the-middle, man in the middle, crash
CVE-2022-38155: TEE_Malloc in Samsung mTower through 0.3.0 allows a trusted application to achieve Excessive Memory Allocation via a large len value, as demonstrated by a Numaker-PFM-M2351 TEE kernel crash.
Key phrases: achieve Excessive Memory Allocation via a large len, excessive memory allocation, crash
CVE-2022-38156: A remote command injection issues exists in the web server of the Kratos SpectralNet device with SpectralNet Narrowband (NB) before 1.7.5. As an admin user, an attacker can send a crafted password in order to execute Linux commands as the root user.
Key phrases: remote command injection
CVE-2022-3816: A vulnerability, which was classified as problematic, was found in Axiomatic Bento4. Affected is an unknown function of the component mp4decrypt. The manipulation leads to memory leak. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-212682 is the identifier assigned to this vulnerability.
Key phrases: memory leak