yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-35673: Adobe FrameMaker versions 2019 Update 8 (and earlier) and 2020 Update 4 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds read, out of bounds read, execute code
CVE-2022-35674: Adobe FrameMaker versions 2019 Update 8 (and earlier) and 2020 Update 4 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds read, out of bounds read, execute code
CVE-2022-35675: Adobe FrameMaker versions 2019 Update 8 (and earlier) and 2020 Update 4 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: use after free, arbitrary code execution
CVE-2022-35676: Adobe FrameMaker versions 2019 Update 8 (and earlier) and 2020 Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: heap-based buffer overflow, arbitrary code execution
CVE-2022-35677: Adobe FrameMaker versions 2019 Update 8 (and earlier) and 2020 Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: heap-based buffer overflow, arbitrary code execution
CVE-2022-35678: Adobe Acrobat Reader versions 22.001.20169 (and earlier), 20.005.30362 (and earlier) and 17.012.30249 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, out-of-bounds read, out of bounds read, disclosure
CVE-2022-3568: The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.
Key phrases: call arbitrary PHP Objects, deserialization, untrusted input, malicious actions, pop chain
CVE-2022-35689: Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to impact the availability of a user's minor feature. Exploitation of this issue does not require user interaction.
Key phrases: Security feature bypass, improper access control, security feature bypass, availability of a users minor feature, feature bypass,
CVE-2022-3569: Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' user can effectively coerce postfix into running arbitrary commands as 'root'.
Key phrases: running arbitrary commands, local privilege escalation issue
CVE-2022-35690: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.
Key phrases: stack-based buffer overflow, arbitrary code execution
CVE-2022-35691: Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by a NULL Pointer Dereference vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve an application denial-of-service in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: null pointer dereference, application denial-of-service, denial of service
CVE-2022-35692: Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. An attacker could leverage this vulnerability to leak minor information of another user's account detials. Exploitation of this issue does not require user interaction.
Key phrases: Security feature bypass, improper access control, security feature bypass, minor information, feature bypass,
CVE-2022-35693: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-35694: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-35695: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-35696: Adobe Experience Manager version 6.5.14 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-35697: Adobe Experience Manager Core Components version 2.20.6 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Exploitation of this issue requires a low author privilege access.
Key phrases: reflected cross-site scripting (xss), convince
CVE-2022-35698: Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. Exploitation of this issue does not require user interaction and could result in a post-authentication arbitrary code execution.
Key phrases: stored cross-site scripting, post-authentication arbitrary code execution
CVE-2022-35699: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, exploitation, out of bounds write
CVE-2022-3570: Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact
Key phrases: trigger unsafe or out of bounds memory access, heap buffer overflows, application crash, information disclosure, context-dependent impact
CVE-2022-35700: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, exploitation, out of bounds write
CVE-2022-35701: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, exploitation, out of bounds write
CVE-2022-35702: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds read, out of bounds read, execute code
CVE-2022-35703: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds read, out of bounds read, execute code
CVE-2022-35704: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: use after free, arbitrary code execution
CVE-2022-35705: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds read, out of bounds read, execute code
CVE-2022-35706: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: heap-based buffer overflow, arbitrary code execution
CVE-2022-35707: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to execute code in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds read, out of bounds read, execute code
CVE-2022-35708: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: heap-based buffer overflow, arbitrary code execution
CVE-2022-35709: Adobe Bridge version 12.0.2 (and earlier) and 11.1.3 (and earlier) are affected by a Use After Free vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: bypass mitigations such as ASLR, use after free, exploitation, disclosure
CVE-2022-35710: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.
Key phrases: stack-based buffer overflow, arbitrary code execution
CVE-2022-35711: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.
Key phrases: heap-based buffer overflow, arbitrary code execution
CVE-2022-35712: Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction, the vulnerability is triggered when a crafted network packet is sent to the server.
Key phrases: heap-based buffer overflow, arbitrary code execution
CVE-2022-35713: Adobe Photoshop versions 22.5.8 (and earlier) and 23.4.2 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Key phrases: out-of-bounds write, arbitrary code execution, exploitation, out of bounds write
CVE-2022-35714: IBM Maximo Asset Management 7.6.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231116.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2022-35715: IBM InfoSphere Information Server 11.7 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in a stack trace. This information could be used in further attacks against the system. IBM X-Force ID: 231202.
Key phrases: obtain sensitive information, obtain sensitive information when a detailed technical error
CVE-2022-35716: IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.16, 7.0.0.0 through 7.0.5.11, 7.1.0.0 through 7.1.2.7, and 7.2.0.0 through 7.2.3.0 could allow an authenticated user to obtain sensitive information in some instances due to improper security checking. IBM X-Force ID: 231360.
Key phrases: obtain sensitive information, obtain sensitive information in some instances due to, improper security checking
CVE-2022-35717: "IBM InfoSphere Information Server 11.7 could allow a locally authenticated attacker to execute arbitrary commands on the system by sending a specially crafted request. IBM X-"Force ID: 231361.
Key phrases: execute arbitrary commands, execute arbitrary commands on the system by sending
CVE-2022-35719: IBM MQ Internet Pass-Thru 2.1, 9.2 LTS and 9.2 CD stores potentially sensitive information in trace files that could be read by a local user.
Key phrases: sensitive information, file read
CVE-2022-3572: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.
Key phrases: perform arbitrary actions, cross-site scripting, reflected xss
CVE-2022-35720: IBM Sterling External Authentication Server 6.1.0 and IBM Sterling Secure Proxy 6.0.3 uses weaker than expected cryptographic algorithms during installation that could allow a local attacker to decrypt sensitive information.  IBM X-Force ID:  231373.
Key phrases: decrypt sensitive information, weaker than expected cryptographic algorithms
CVE-2022-35721: IBM Jazz for Service Management 1.1.3 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231380.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, stored cross-site scripting, credentials disclosure
CVE-2022-35722: IBM Jazz for Service Management is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 231381.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, stored cross-site scripting, credentials disclosure
CVE-2022-35724: It is possible to provide data to be read that leads the reader to loop in cycles endlessly, consuming CPU. This issue affects Rust applications using Apache Avro Rust SDK prior to 0.14.0 (previously known as avro-rs). Users should update to apache-avro version 0.14.0 which addresses this issue.
CVE-2022-35725: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Hans Matzen's wp-forecast plugin <= 7.5 at WordPress.
Key phrases: stored cross-site scripting (xss)
CVE-2022-35726: Broken Authentication vulnerability in yotuwp Video Gallery plugin <= 1.3.4.5 at WordPress.
Key phrases: broken authentication
CVE-2022-35728: In BIG-IP Versions 17.0.x before 17.0.0.1, 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, and BIG-IQ version 8.x before 8.2.0 and all versions of 7.x, an authenticated user's iControl REST token may remain valid for a limited time after logging out from the Configuration utility. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
CVE-2022-35729: Out of bounds read in firmware for OpenBMC in some Intel(R) platforms before version 0.72 may allow unauthenticated user to potentially enable denial of service via network access.
Key phrases: potentially enable denial of service via network access, out of bounds read
CVE-2022-3573: An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. Due to the improper filtering of query parameters in the wiki changes page, an attacker can execute arbitrary JavaScript on the self-hosted instances running without strict CSP.
Key phrases: execute arbitrary JavaScript, arbitrary javascript
CVE-2022-35730: Cross-Site Request Forgery (CSRF) vulnerability inOceanwp sticky header plugin <=1.0.8 on WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-35733: Missing authentication for critical function vulnerability in UNIMO Technology digital video recorders (UDR-JA1004/JA1008/JA1016 firmware versions v1.0.20.13 and earlier, and UDR-JA1016 firmware versions v2.0.20.13 and earlier) allows a remote unauthenticated attacker to execute an arbitrary OS command by sending a specially crafted request to the affected device web interface.
Key phrases: execute an arbitrary OS command by sending a, missing authentication, critical function, missing authentication for critical function, execute arbitrary, arbitrary os command
CVE-2022-35734: 'Hulu / ????' App for Android from version 3.0.47 to the version prior to 3.1.2 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.
Key phrases: hard-coded api key
CVE-2022-35735: In BIG-IP Versions 16.1.x before 16.1.3.1, 15.1.x before 15.1.6.1, 14.1.x before 14.1.5.1, and all versions of 13.1.x, an authenticated attacker with Resource Administrator or Manager privileges can create or modify existing monitor objects in the Configuration utility in an undisclosed manner leading to a privilege escalation. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: privilege escalation
CVE-2022-35737: SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
Key phrases: a C API, array-bounds overflow
CVE-2022-35739: PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a devices icon, which can be modified to insert arbitrary content into the style tag for that device. When the device page loads, the arbitrary Cascading Style Sheets (CSS) data is inserted into the style tag, loading malicious content. Due to PRTG Network Monitor preventing characters, and from modern browsers disabling JavaScript support in style tags, this vulnerability could not be escalated into a Cross-Site Scripting vulnerability.
Key phrases: insert arbitrary content, cross-site scripting
CVE-2022-3574: The WPForms Pro WordPress plugin before 1.7.7 does not validate its form data when generating the exported CSV, which could lead to CSV injection.
Key phrases: csv injection
CVE-2022-35740: dotCMS before 22.06 allows remote attackers to bypass intended access control and obtain sensitive information by using a semicolon in a URL to introduce a matrix parameter. (This is also fixed in 5.3.8.12, 21.06.9, and 22.03.2 for LTS users.) Some Java application frameworks, including those used by Spring or Tomcat, allow the use of matrix parameters: these are URI parameters separated by semicolons. Through precise semicolon placement in a URI, it is possible to exploit this feature to avoid dotCMS's path-based XSS prevention (such as "require login" filters), and consequently access restricted resources. For example, an attacker could place a semicolon immediately before a / character that separates elements of a filesystem path. This could reveal file content that is ordinarily only visible to signed-in users. This issue can be chained with other exploit code to achieve XSS attacks against dotCMS.
Key phrases: bypass intended access control, obtain sensitive information, bypass intended access control and obtain sensitive information, exploit this feature to avoid dotCMS's path, xss
CVE-2022-35741: Apache CloudStack version 4.5.0 and later has a SAML 2.0 authentication Service Provider plugin which is found to be vulnerable to XML external entity (XXE) injection. This plugin is not enabled by default and the attacker would require that this plugin be enabled to exploit the vulnerability. When the SAML 2.0 plugin is enabled in affected versions of Apache CloudStack could potentially allow the exploitation of XXE vulnerabilities. The SAML 2.0 messages constructed during the authentication flow in Apache CloudStack are XML-based and the XML data is parsed by various standard libraries that are now understood to be vulnerable to XXE injection attacks such as arbitrary file reading, possible denial of service, server-side request forgery (SSRF) on the CloudStack management server.
Key phrases: be vulnerable to XXE injection attacks such as, xml external entity (xxe), xxe injection, arbitrary file reading, denial of service, server-side request forgery (ssrf), server side request forgery
CVE-2022-35742: Microsoft Outlook Denial of Service Vulnerability
Key phrases: microsoft outlook denial of service
CVE-2022-35743: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35744: Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35745: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35746: Windows Digital Media Receiver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35747: Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability
Key phrases: windows point-to-point protocol (ppp) denial of service
CVE-2022-35748: HTTP.sys Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-35749: Windows Digital Media Receiver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-3575: Frauscher Sensortechnik GmbH FDS102 for FAdC R2 and FAdCi R2 v2.8.0 to v2.9.1 are vulnerable to malicious code upload without authentication by using the configuration upload function. This could lead to a complete compromise of the FDS102 device.
Key phrases: malicious code upload, configuration upload function, complete compromise
CVE-2022-35750: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35751: Windows Hyper-V Elevation of Privilege Vulnerability
Key phrases: windows hyper-v elevation of privilege
CVE-2022-35752: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35753: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35754: Unified Write Filter Elevation of Privilege Vulnerability
Key phrases: unified write filter elevation of privilege
CVE-2022-35755: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35756: Windows Kerberos Elevation of Privilege Vulnerability
Key phrases: windows kerberos elevation of privilege
CVE-2022-35757: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows cloud files mini filter driver elevation of privilege
CVE-2022-35758: Windows Kernel Memory Information Disclosure Vulnerability
Key phrases: windows kernel memory information disclosure
CVE-2022-35759: Windows Local Security Authority (LSA) Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-3576: A vulnerability regarding out-of-bounds read is found in the session processing functionality of Out-of-Band (OOB) Management. This allows remote attackers to obtain sensitive information via unspecified vectors. The following models with Synology DiskStation Manager (DSM) versions before 7.1.1-42962-2 may be affected: DS3622xs+, FS3410, and HD6500.
Key phrases: obtain sensitive information, obtain sensitive information via unspecified vectors, out-of-bounds read, out of bounds read
CVE-2022-35760: Microsoft ATA Port Driver Elevation of Privilege Vulnerability
Key phrases: microsoft ata port driver elevation of privilege
CVE-2022-35761: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-35762: Storage Spaces Direct Elevation of Privilege Vulnerability
Key phrases: direct elevation of privilege
CVE-2022-35763: Storage Spaces Direct Elevation of Privilege Vulnerability
Key phrases: direct elevation of privilege
CVE-2022-35764: Storage Spaces Direct Elevation of Privilege Vulnerability
Key phrases: direct elevation of privilege
CVE-2022-35765: Storage Spaces Direct Elevation of Privilege Vulnerability
Key phrases: direct elevation of privilege
CVE-2022-35766: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35767: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35768: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-35769: Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability
Key phrases: windows point-to-point protocol (ppp) denial of service
CVE-2022-3577: An out-of-bounds memory write flaw was found in the Linux kernels Kid-friendly Wired Controller driver. This flaw allows a local user to crash or potentially escalate their privileges on the system. It is in bigben_probe of drivers/hid/hid-bigbenff.c. The reason is incorrect assumption - bigben devices all have inputs. However, malicious devices can break this assumption, leaking to out-of-bound write.
Key phrases: crash or potentially escalate their privileges on the, out-of-bounds memory write flaw, out-of-bound write, out of bounds memory, escalate privilege, out of bound write
CVE-2022-35770: Windows NTLM Spoofing Vulnerability
Key phrases: windows ntlm spoofing
CVE-2022-35771: Windows Defender Credential Guard Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35772: Azure Site Recovery Remote Code Execution Vulnerability
Key phrases: azure site recovery remote code execution
CVE-2022-35773: Azure RTOS GUIX Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35774: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35775: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35776: Azure Site Recovery Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-35777: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35779: Azure RTOS GUIX Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-3578: The ProfileGrid WordPress plugin before 5.1.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-35780: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35781: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35782: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35783: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35784: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35785: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35786: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35787: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35788: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35789: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-3579: A vulnerability classified as critical was found in SourceCodester Cashier Queuing System 1.0. This vulnerability affects unknown code of the file /queuing/login.php of the component Login Page. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-211186 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-35790: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35791: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35792: Storage Spaces Direct Elevation of Privilege Vulnerability
Key phrases: direct elevation of privilege
CVE-2022-35793: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35794: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35795: Windows Error Reporting Service Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35796: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35797: Windows Hello Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows hello security feature bypass
CVE-2022-35798: Azure Arc Jumpstart Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-35799: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-3580: A vulnerability, which was classified as problematic, has been found in SourceCodester Cashier Queuing System 1.0.1. This issue affects some unknown processing of the component User Creation Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-211187.
Key phrases: cross site scripting
CVE-2022-35800: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35801: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35802: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35803: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2022-35804: SMB Client and Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35805: Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35806: Azure RTOS GUIX Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35807: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35808: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35809: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-3581: A vulnerability, which was classified as problematic, was found in SourceCodester Cashier Queuing System 1.0. Affected is an unknown function of the component Cashiers Tab. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-211188.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-35810: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35811: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35812: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35813: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35814: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35815: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35816: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35817: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35818: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35819: Azure Site Recovery Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-3582: A vulnerability has been found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation of the argument change password leads to cross-site request forgery. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-211189 was assigned to this vulnerability.
Key phrases: cross-site request forgery, cross site request forgery
CVE-2022-35820: Windows Bluetooth Driver Elevation of Privilege Vulnerability
Key phrases: windows bluetooth driver elevation of privilege
CVE-2022-35821: Azure Sphere Information Disclosure Vulnerability
Key phrases: azure sphere information disclosure
CVE-2022-35822: Windows Defender Credential Guard Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2022-35823: Microsoft SharePoint Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35824: Azure Site Recovery Remote Code Execution Vulnerability
Key phrases: azure site recovery remote code execution
CVE-2022-35825: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35826: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35827: Visual Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35828: Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-35829: Service Fabric Explorer Spoofing Vulnerability
Key phrases: spoofing
CVE-2022-3583: A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been declared as critical. This vulnerability affects unknown code of the file login.php. The manipulation of the argument business leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-211192.
Key phrases: sql injection
CVE-2022-35830: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35831: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-35832: Windows Event Tracing Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-35833: Windows Secure Channel Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-35834: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35835: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35836: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35837: Windows Graphics Component Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-35838: HTTP V3 Denial of Service Vulnerability
Key phrases: http denial of service
CVE-2022-3584: A vulnerability was found in SourceCodester Canteen Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file edituser.php. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-211193 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-35840: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35841: Windows Enterprise App Management Service Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-35842: An exposure of sensitive information to an unauthorized actor vulnerabiltiy [CWE-200] in FortiOS SSL-VPN versions 7.2.0, versions 7.0.0 through 7.0.6 and versions 6.4.0 through 6.4.9 may allow a remote unauthenticated attacker to gain information about LDAP and SAML settings configured in FortiOS.
Key phrases: gain information, gain information about LDAP and SAML settings configured, cwe-200, exposure of sensitive information
CVE-2022-35843: An authentication bypass by assumed-immutable data vulnerability [CWE-302] in the FortiOS SSH login component 7.2.0,  7.0.0 through 7.0.7,  6.4.0 through 6.4.9, 6.2 all versions, 6.0 all versions and FortiProxy SSH login component 7.0.0 through 7.0.5, 2.0.0 through 2.0.10, 1.2.0 all versions may allow a remote and unauthenticated attacker to login into the device via sending specially crafted Access-Challenge response from the Radius server.
Key phrases: bypass by assumed-immutable data vulnerability [CWE-302, authentication bypass, login into the device via sending specially crafted
CVE-2022-35844: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to commands of the certificate import feature.
Key phrases: execute unauthorized commands via specifically crafted arguments to, os command
CVE-2022-35845: Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiTester 7.1.0, 7.0 all versions, 4.0.0 through 4.2.0, 2.3.0 through 3.9.1 may allow an authenticated attacker to execute arbitrary commands in the underlying shell.
Key phrases: execute arbitrary commands, execute arbitrary commands in the underlying shell, os command injection
CVE-2022-35846: An improper restriction of excessive authentication attempts vulnerability [CWE-307] in FortiTester Telnet port 2.3.0 through 3.9.1, 4.0.0 through 4.2.0, 7.0.0 through 7.1.0 may allow an unauthenticated attacker to guess the credentials of an admin user via a brute force attack.
Key phrases: guess the credentials of an admin user via, cwe-307, brute force
CVE-2022-35847: An improper neutralization of special elements used in a template engine vulnerability [CWE-1336] in FortiSOAR management interface 7.2.0, 7.0.0 through 7.0.3, 6.4.0 through 6.4.4 may allow a remote and authenticated attacker to execute arbitrary code via a crafted payload.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted payload, template engine
CVE-2022-35849: An improper neutralization of special elements used in an OS command vulnerability [CWE-78]in the management interface of FortiADC 7.1.0 through 7.1.1, 7.0.0 through 7.0.3, 6.2.0 through 6.2.5 and  6.1.0 all versions may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.
Key phrases: execute unauthorized commands via specifically crafted arguments to, os command
CVE-2022-3585: A vulnerability classified as problematic has been found in SourceCodester Simple Cold Storage Management System 1.0. Affected is an unknown function of the file /csms/?page=contact_us of the component Contact Us. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-211194 is the identifier assigned to this vulnerability.
Key phrases: cross site request forgery
CVE-2022-35850: An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4.4, 6.3.0 through 6.3.3, all versions of 6.2 and 6.1 may allow a remote unauthenticated attacker to trigger a reflected cross site scripting (XSS) attack via the "reset-password" page.
Key phrases: trigger a reflected cross site scripting (XSS, web page, cwe-80, reflected cross site scripting (xss)
CVE-2022-35851: An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiADC management interface 7.1.0 may allow a remote and authenticated attacker to trigger a stored cross site scripting (XSS) attack via configuring a specially crafted IP Address.
Key phrases: trigger a stored cross site scripting (XSS, web page generation, stored cross site scripting (xss), improper neutralization of input during web page generation
CVE-2022-35857: kvf-admin through 2022-02-12 allows remote attackers to execute arbitrary code because deserialization is mishandled. The rememberMe parameter is encrypted with a hardcoded key from the com.kalvin.kvf.common.shiro.ShiroConfig file.
Key phrases: execute arbitrary code, execute arbitrary code because deserialization is mishandled, hardcoded
CVE-2022-35858: The TEE_PopulateTransientObject and __utee_from_attr functions in Samsung mTower 0.3.0 allow a trusted application to trigger a memory overwrite, denial of service, and information disclosure by invoking the function TEE_PopulateTransientObject with a large number in the parameter attrCount.
Key phrases: trigger a memory overwrite, denial of service, information disclosure
CVE-2022-3586: A flaw was found in the Linux kernels networking code. A use-after-free was found in the way the sch_sfb enqueue function used the socket buffer (SKB) cb field after the same SKB had been enqueued (and freed) into a child qdisc. This flaw allows a local, unprivileged user to crash the system, causing a denial of service.
Key phrases: crash the system, use-after-free, denial of service, use after free, crash system
CVE-2022-35860: Missing AES encryption in Corsair K63 Wireless 3.1.3 allows physically proximate attackers to inject and sniff keystrokes via 2.4 GHz radio transmissions.
Key phrases: inject and sniff keystrokes via 2.4 GHz radio, missing aes encryption
CVE-2022-35861: pyenv 1.2.24 through 2.3.2 allows local users to gain privileges via a .python-version file in the current working directory. An attacker can craft a Python version string in .python-version to execute shims under their control. (Shims are executables that pass a command along to a specific version of pyenv. The version string is used to construct the path to the command, and there is no validation of whether the version specified is a valid version. Thus, relative path traversal can occur.)
Key phrases: gain privileges, gain privileges via a .python-version file, relative path traversal
CVE-2022-35864: This vulnerability allows remote attackers to disclose sensitive information on affected installations of BMC Track-It! 20.21.02.109. Authentication is required to exploit this vulnerability. The specific flaw exists within the GetPopupSubQueryDetails endpoint. The issue results from the lack of proper validation of a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-16690.
Key phrases: disclose sensitive information on affected installations of BMC, compromise
CVE-2022-35865: This vulnerability allows remote attackers to execute arbitrary code on affected installations of BMC Track-It! 20.21.2.109. Authentication is not required to exploit this vulnerability. The specific flaw exists within the authorization of HTTP requests. The issue results from the lack of authentication prior to allowing access to functionality. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-16709.
Key phrases: execute arbitrary code, execute arbitrary code on affected installations of BMC, functionality, execute code