yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-27313: An arbitrary file deletion vulnerability in Gitea v1.16.3 allows attackers to cause a Denial of Service (DoS) via deleting the configuration file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), file deletion, denial of service (dos), arbitrary file, arbitrary file deletion
CVE-2022-2732: Missing Authorization in GitHub repository openemr/openemr prior to 7.0.0.1.
Key phrases: missing authorization
CVE-2022-2733: Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.
Key phrases: cross-site scripting (xss)
CVE-2022-27330: A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_product of E-Commerce Website v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Product Title text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-27331: An access control issue in Zammad v5.0.3 broadcasts administrative configuration changes to all users who have an active application instance, including settings that should only be visible to authenticated users.
Key phrases: access control issue
CVE-2022-27332: An access control issue in Zammad v5.0.3 allows attackers to write entries to the CTI caller log without authentication. This vulnerability can allow attackers to execute phishing attacks or cause a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), write entries to the CTI caller log without, execute phishing attacks or cause a Denial of, access control issue, denial of service (dos)
CVE-2022-27333: idcCMS v1.10 was discovered to contain an issue which allows attackers to arbitrarily delete the install.lock file, resulting in a reset of the CMS settings and data.
Key phrases: arbitrarily delete the install.lock file, reset of the cms settings and data
CVE-2022-27336: Seacms v11.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/weixin.php.
Key phrases: remote code execution (rce)
CVE-2022-27337: A logic error in the Hints::Hints function of Poppler v22.03.0 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), logic error, denial of service (dos)
CVE-2022-2734: Improper Restriction of Rendered UI Layers or Frames in GitHub repository openemr/openemr prior to 7.0.0.1.
Key phrases: improper restriction
CVE-2022-27340: MCMS v5.2.7 contains a Cross-Site Request Forgery (CSRF) via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data.
Key phrases: escalate privileges and modify data, cross-site request forgery (csrf)
CVE-2022-27341: JFinalCMS v2.0 was discovered to contain a SQL injection vulnerability via the Article Management function.
Key phrases: sql injection
CVE-2022-27342: Link-Admin v0.0.1 was discovered to contain a SQL injection vulnerability via DictRest.ResponseResult().
Key phrases: sql injection
CVE-2022-27346: Ecommece-Website v1.1.0 was discovered to contain an arbitrary file upload vulnerability via /admin/index.php?slides. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-27348: Social Codia SMS v1 was discovered to contain a stored cross-site scripting (XSS) vulnerability via add_post.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Post Title text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-27349: Social Codia SMS v1 was discovered to contain an arbitrary file upload vulnerability via addteacher.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-2735: A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons. A privilege escalation could happen by obtaining an authentication token for a hacluster user. With the "hacluster" token, this flaw allows an attacker to have complete control over the cluster managed by PCS.
Key phrases: have complete control over the cluster managed by, privilege escalation
CVE-2022-27351: Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /public_html/apply_vacancy. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-27352: Simple House Rental System v1 was discovered to contain an arbitrary file upload vulnerability via /app/register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-27357: Ecommerce-Website v1 was discovered to contain an arbitrary file upload vulnerability via /customer_register.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-27359: Foxit PDF Reader before 12.0.1 and PDF Editor before 12.0.1 allow a this.maildoc NULL pointer dereference.
Key phrases: a this.maildoc NULL pointer dereference, null pointer dereference
CVE-2022-2736: A vulnerability was found in SourceCodester Company Website CMS. It has been classified as critical. This affects an unknown part of the file /dashboard/updatelogo.php of the component Background Upload Logo Icon. The manipulation of the argument xfile/ufile leads to unrestricted upload. It is possible to initiate the attack remotely. The identifier VDB-205881 was assigned to this vulnerability.
Key phrases: unrestricted upload
CVE-2022-27360: SpringBlade v3.2.0 and below was discovered to contain a SQL injection vulnerability via the component customSqlSegment.
Key phrases: sql injection
CVE-2022-27365: Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Dance.php_del.
Key phrases: sql injection
CVE-2022-27366: Cscms Music Portal System v4.2 was discovered to contain a blind SQL injection vulnerability via the component dance_Dance.php_hy.
Key phrases: blind sql injection
CVE-2022-27367: Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Topic.php_del.
Key phrases: sql injection
CVE-2022-27368: Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component dance_Lists.php_zhuan.
Key phrases: sql injection
CVE-2022-27369: Cscms Music Portal System v4.2 was discovered to contain a SQL injection vulnerability via the component news_News.php_hy.
Key phrases: sql injection
CVE-2022-2737: The WP STAGING WordPress plugin before 2.9.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-27373: Shanghai Feixun Data Communication Technology Co., Ltd router fir302b A2 was discovered to contain a remote command execution (RCE) vulnerability via the Ping function.
Key phrases: remote command execution (rce)
CVE-2022-27374: Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_42E328 at /goform/SysToolReboot.
Key phrases: cross-site request forgery (csrf)
CVE-2022-27375: Tenda AX12 V22.03.01.21_CN was discovered to contain a Cross-Site Request Forgery (CSRF) via the function sub_422168 at /goform/WifiExtraSet.
Key phrases: cross-site request forgery (csrf)
CVE-2022-27376: MariaDB Server v10.6.5 and below was discovered to contain an use-after-free in the component Item_args::walk_arg, which is exploited via specially crafted SQL statements.
Key phrases: use-after-free, use after free
CVE-2022-27377: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.
Key phrases: use-after-free, use after free
CVE-2022-27378: An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-27379: An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-2738: The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945, which was previously fixed via RHSA-2020:2117. This issue could possibly be used to crash or cause potential code execution in Go applications that use the Go GPGME wrapper library, under certain conditions, during GPG signature verification.
Key phrases: code execution, crash
CVE-2022-27380: An issue in the component my_decimal::operator= of MariaDB Server v10.6.3 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-27381: An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-27382: MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component Item_field::used_tables/update_depend_map_for_order.
Key phrases: segmentation fault
CVE-2022-27383: MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.
Key phrases: use-after-free, use after free
CVE-2022-27384: An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-27385: An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-27386: MariaDB Server v10.7 and below was discovered to contain a segmentation fault via the component sql/sql_class.cc.
Key phrases: segmentation fault
CVE-2022-27387: MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.
Key phrases: global buffer overflow
CVE-2022-2739: The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056. This issue could possibly allow an attacker to gain access to sensitive information stored in environment variables.
Key phrases: gain access, gain access to sensitive information stored in environment, access sensitive information
CVE-2022-2740: A vulnerability was found in SourceCodester Company Website CMS. It has been declared as critical. This vulnerability affects unknown code of the file /dashboard/add-blog.php of the component Add Blog. The manipulation of the argument ufile leads to unrestricted upload. The attack can be initiated remotely. VDB-205882 is the identifier assigned to this vulnerability.
Key phrases: unrestricted upload
CVE-2022-27404: FreeType commit 1e2eb65048f75c64b68708efed6ce904c31f3b2f was discovered to contain a heap buffer overflow via the function sfnt_init_face.
Key phrases: heap buffer overflow
CVE-2022-27405: FreeType commit 53dfdcd8198d2b3201a23c4bad9190519ba918db was discovered to contain a segmentation violation via the function FNT_Size_Request.
Key phrases: segmentation violation
CVE-2022-27406: FreeType commit 22a0cccb4d9d002f33c1ba7a4b36812c7d4f46b5 was discovered to contain a segmentation violation via the function FT_Request_Size.
Key phrases: segmentation violation
CVE-2022-2741: The denial-of-service can be triggered by transmitting a carefully crafted CAN frame on the same CAN network as the vulnerable node. The frame must have a CAN ID matching an installed filter in the vulnerable node (this can easily be guessed based on CAN traffic analyses). The frame must contain the opposite RTR bit as what the filter installed in the vulnerable node contains (if the filter matches RTR frames, the frame must be a data frame or vice versa).
Key phrases: vulnerable node, denial of service
CVE-2022-27411: TOTOLINK N600R v5.3c.5507_B20171031 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter in the "Main" function.
Key phrases: command injection
CVE-2022-27412: Explore CMS v1.0 was discovered to contain a SQL injection vulnerability via a /page.php?id= request.
Key phrases: sql injection
CVE-2022-27413: Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the adminname parameter in admin.php.
Key phrases: sql injection
CVE-2022-27416: Tcpreplay v4.4.1 was discovered to contain a double-free via __interceptor_free.
Key phrases: double-free, double free
CVE-2022-27418: Tcpreplay v4.4.1 has a heap-based buffer overflow in do_checksum_math at /tcpedit/checksum.c.
Key phrases: heap-based buffer overflow, heap based buffer overflow
CVE-2022-27419: rtl_433 21.12 was discovered to contain a stack overflow in the function acurite_00275rm_decode at /devices/acurite.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2022-2742: Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interactions. (Chrome security severity: High)
Key phrases: use after free, heap corruption, convince
CVE-2022-27420: Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the patient_contact parameter in patientsearch.php.
Key phrases: sql injection
CVE-2022-27421: Chamilo LMS v1.11.13 lacks validation on the user modification form, allowing attackers to escalate privileges to Platform Admin.
Key phrases: escalate privileges to Platform Admin, validation
CVE-2022-27422: A reflected cross-site scripting (XSS) vulnerability in Chamilo LMS v1.11.13 allows attackers to execute arbitrary web scripts or HTML via user interaction with a crafted URL.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via user, reflected cross-site scripting (xss)
CVE-2022-27423: Chamilo LMS v1.11.13 was discovered to contain a SQL injection vulnerability via the blog_id parameter at /blog/blog.php.
Key phrases: sql injection
CVE-2022-27425: Chamilo LMS v1.11.13 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /blog/blog.php.
Key phrases: cross-site scripting (xss)
CVE-2022-27426: A Server-Side Request Forgery (SSRF) in Chamilo LMS v1.11.13 allows attackers to enumerate the internal network and execute arbitrary system commands via a crafted Phar file.
Key phrases: execute arbitrary system, enumerate the internal network and execute arbitrary system, server-side request forgery (ssrf)
CVE-2022-27428: A stored cross-site scripting (XSS) vulnerability in /index.php/album/add of GalleryCMS v2.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the album_name parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-27429: Jizhicms v1.9.5 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability via /admin.php/Plugins/update.html.
Key phrases: server-side request forgery (ssrf)
CVE-2022-2743: Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user to engage in specific UI interactions to perform an out of bounds memory write via crafted UI interactions. (Chrome security severity: High)
Key phrases: integer overflow, out of bounds memory write, convince
CVE-2022-27431: Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the groupid parameter at /coreframe/app/member/admin/group.php.
Key phrases: sql injection
CVE-2022-27432: A Cross-Site Request Forgery (CSRF) in Pluck CMS v4.7.15 allows attackers to change the password of any given user by exploiting this feature leading to account takeover.
Key phrases: change the password of any given user by, cross-site request forgery (csrf), account takeover
CVE-2022-27434: UNIT4 TETA Mobile Edition (ME) before 29.5.HF17 was discovered to contain a SQL injection vulnerability via the ProfileName parameter in the errorReporting page.
Key phrases: sql injection
CVE-2022-27435: An unrestricted file upload at /public/admin/index.php?add_product of Ecommerce-Website v1.1.0 allows attackers to upload a webshell via the Product Image component.
Key phrases: upload a webshell via the Product Image component, unrestricted file upload
CVE-2022-27436: A cross-site scripting (XSS) vulnerability in /public/admin/index.php?add_user at Ecommerce-Website v1.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-27438: Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer (Advanced Updater) are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an affected installation to trigger the update check.
Key phrases: remote code execution
CVE-2022-2744: A vulnerability, which was classified as critical, has been found in SourceCodester Gym Management System. Affected by this issue is some unknown functionality of the file /admin/add_exercises.php of the component Background Management. The manipulation of the argument exer_img leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-206012.
Key phrases: unrestricted upload
CVE-2022-27441: A stored cross-site scripting (XSS) vulnerability in TPCMS v3.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Phone text box.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-27442: TPCMS v3.2 allows attackers to access the ThinkPHP log directory and obtain sensitive information such as the administrator's user name and password.
Key phrases: obtain sensitive information, access the ThinkPHP log directory and obtain sensitive
CVE-2022-27444: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_subselect.cc.
Key phrases: segmentation fault
CVE-2022-27445: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/sql_window.cc.
Key phrases: segmentation fault
CVE-2022-27446: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.h.
Key phrases: segmentation fault
CVE-2022-27447: MariaDB Server v10.9 and below was discovered to contain a use-after-free via the component Binary_string::free_buffer() at /sql/sql_string.h.
Key phrases: use-after-free, use after free
CVE-2022-27448: There is an Assertion failure in MariaDB Server v10.9 and below via 'node->pcur->rel_pos == BTR_PCUR_ON' at /row/row0mysql.cc.
Key phrases: assertion failure
CVE-2022-27449: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_func.cc:148.
Key phrases: segmentation fault
CVE-2022-2745: A vulnerability, which was classified as critical, was found in SourceCodester Gym Management System. This affects an unknown part of the file /admin/add_trainers.php of the component Add New Trainer. The manipulation of the argument trainer_name leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-206013 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-27451: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/field_conv.cc.
Key phrases: segmentation fault
CVE-2022-27452: MariaDB Server v10.9 and below was discovered to contain a segmentation fault via the component sql/item_cmpfunc.cc.
Key phrases: segmentation fault
CVE-2022-27455: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_wildcmp_8bit_impl at /strings/ctype-simple.c.
Key phrases: use-after-free, use after free
CVE-2022-27456: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component VDec::VDec at /sql/sql_type.cc.
Key phrases: use-after-free, use after free
CVE-2022-27457: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component my_mb_wc_latin1 at /strings/ctype-latin1.c.
Key phrases: use-after-free, use after free
CVE-2022-27458: MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Binary_string::free_buffer() at /sql/sql_string.h.
Key phrases: use-after-free, use after free
CVE-2022-2746: A vulnerability has been found in SourceCodester Simple Online Book Store System and classified as critical. This vulnerability affects unknown code of the file Admin_ add.php. The manipulation leads to unrestricted upload. The attack can be initiated remotely. VDB-206014 is the identifier assigned to this vulnerability.
Key phrases: unrestricted upload
CVE-2022-27461: In nopCommerce 4.50.1, an open redirect vulnerability can be triggered by luring a user to authenticate to a nopCommerce page by clicking on a crafted link.
Key phrases: open redirect
CVE-2022-27462: Cross Site Scripting (XSS) vulnerability in objects/function.php in function getDeviceID in WWBN AVideo through 11.6, via the yptDevice parameter to view/include/head.php.
Key phrases: cross site scripting (xss)
CVE-2022-27463: Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.
Key phrases: arbitrarily redirect users from a crafted url to, open redirect
CVE-2022-27466: MCMS v5.2.27 was discovered to contain a SQL injection vulnerability in the orderBy parameter at /dict/list.do.
Key phrases: sql injection
CVE-2022-27468: Monstaftp v2.10.3 was discovered to contain an arbitrary file upload which allows attackers to execute arbitrary code via a crafted file uploaded to the web server.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted file uploaded, arbitrary file upload
CVE-2022-27469: Monstaftp v2.10.3 was discovered to allow attackers to execute Server-Side Request Forgery (SSRF).
Key phrases: execute Server-Side Request Forgery (SSRF, server-side request forgery (ssrf)
CVE-2022-2747: A vulnerability was found in SourceCodester Simple Online Book Store and classified as critical. This issue affects some unknown processing of the file book.php. The manipulation of the argument book_isbn leads to sql injection. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-206015.
Key phrases: sql injection
CVE-2022-27470: SDL_ttf v2.0.18 and below was discovered to contain an arbitrary memory write via the function TTF_RenderText_Solid(). This vulnerability is triggered via a crafted TTF file.
Key phrases: arbitrary memory write
CVE-2022-27472: SQL injection vulnerability in Topics Counting feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter remotely.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the "s, sql injection
CVE-2022-27473: SQL injection vulnerability in Topics Searching feature of Roothub 2.6.0 allows unauthorized attackers to execute arbitrary SQL commands via the "s" parameter remotely.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the "s, sql injection
CVE-2022-27474: SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field.
Key phrases: remote code execution via a crafted payload injected
CVE-2022-27475: Cross site scripting (XSS) vulnerability in tramyardg hotel-mgmt-system, allows attackers to execute arbitrary code when when /admin.php is loaded.
Key phrases: execute arbitrary code, execute arbitrary code when when /admin.php is loaded, cross site scripting (xss)
CVE-2022-27476: A cross-site scripting (XSS) vulnerability at /admin/goods/update in Newbee-Mall v1.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the goodsName parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-27477: Newbee-Mall v1.0.0 was discovered to contain an arbitrary file upload via the Upload function at /admin/goods/edit.
Key phrases: arbitrary file upload
CVE-2022-27478: Victor v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component admin/profile.php?section=admin.
Key phrases: remote code execution (rce)
CVE-2022-27479: Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
Key phrases: sql injection
CVE-2022-2748: A vulnerability was found in SourceCodester Simple Online Book Store System. It has been classified as problematic. Affected is an unknown function of the file /admin/edit.php. The manipulation of the argument eid leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-206016.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-27480: A vulnerability has been identified in SICAM A8000 CP-8031 (All versions < V4.80), SICAM A8000 CP-8050 (All versions < V4.80). Affected devices do not require an user to be authenticated to access certain files. This could allow unauthenticated attackers to download these files.
Key phrases: download these files
CVE-2022-27481: A vulnerability has been identified in SCALANCE W1788-1 M12 (All versions < V3.0.0), SCALANCE W1788-2 EEC M12 (All versions < V3.0.0), SCALANCE W1788-2 M12 (All versions < V3.0.0), SCALANCE W1788-2IA M12 (All versions < V3.0.0). Affected devices do not properly handle resources of ARP requests. This could allow an attacker to cause a race condition that leads to a crash of the entire device.
Key phrases: cause a race condition that leads to a, scalance, scalance eec, crash
CVE-2022-27482: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.1, 6.2.0 through 6.2.2, 6.1.0 through 6.1.6, 6.0.x, 5.x.x allows attacker to execute arbitrary shell code as `root`via CLI commands.
Key phrases: execute arbitrary shell code, execute arbitrary shell code as `root`via CLI, os command injection
CVE-2022-27483: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiManager version 7.0.0 through 7.0.3, 6.4.0 through 6.4.7, 6.2.x and 6.0.x and FortiAnalyzer version 7.0.0 through 7.0.3, version 6.4.0 through 6.4.7, 6.2.x and 6.0.x allows attacker to execute arbitrary shell code as `root` user via `diagnose system` CLI commands.
Key phrases: execute arbitrary shell code, execute arbitrary shell code as `root`, os command injection
CVE-2022-27484: A unverified password change in Fortinet FortiADC version 6.2.0 through 6.2.3, 6.1.x, 6.0.x, 5.x.x allows an authenticated attacker to bypass the Old Password check in the password change form via a crafted HTTP request.
Key phrases: bypass the Old Password check, bypass the Old Password check in the password, unverified password change, old password check
CVE-2022-27485: A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox version 4.2.0, 4.0.0 through 4.0.2, 3.2.0 through 3.2.3, 3.1.x and 3.0.x allows a remote and authenticated attacker with read permission to retrievearbitrary files from the underlying Linux system via a crafted HTTP request.
Key phrases: retrievearbitrary files from the underlying Linux system via, sql command, sql injection
CVE-2022-27487: A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor version 4.1.0, 4.0.0 through 4.0.2 and before 3.3.3 allows a remote authenticated attacker to perform unauthorized API calls via crafted HTTP or HTTPS requests.
Key phrases: perform unauthorized API calls via crafted HTTP or, improper privilege management
CVE-2022-27488: A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.0 through 6.2.7, 6.0.x, FortiMail version 7.0.0 through 7.0.3, 6.4.0 through 6.4.6, 6.2.x, 6.0.x FortiRecorder version 6.4.0 through 6.4.2, 6.0.x, 2.7.x, 2.6.x, FortiNDR version 1.x.x allows a remote unauthenticated attacker to execute commands on the CLI viatricking an authenticated administrator to execute malicious GET requests.
Key phrases: execute commands on the CLI viatricking an authenticated, cross-site request forgery (csrf), malicious get requests, cross site request forgery
CVE-2022-27489: A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiExtender 7.0.0 through 7.0.3, 5.3.2, 4.2.4 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.
Key phrases: execute unauthorized code or commands via crafted HTTP, os command injection
CVE-2022-2749: A vulnerability was found in SourceCodester Gym Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /mygym/admin/index.php?view_exercises. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206017 was assigned to this vulnerability.
Key phrases: unrestricted upload
CVE-2022-27490: A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0.0 through 6.0.4, FortiPortal version 6.0.0 through 6.0.9, 5.3.0 through 5.3.8, 5.2.x, 5.1.0, 5.0.x, 4.2.x, 4.1.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 through 6.4.10, 6.2.x, 6.0.x allows an attacker which has obtained access to a restricted administrative account to obtain sensitive information via `diagnose debug` commands.
Key phrases: obtain sensitive information, a restricted administrative account to obtain sensitive information, exposure of sensitive information
CVE-2022-27491: A improper verification of source of a communication channel in Fortinet FortiOS with IPS engine version 7.201 through 7.214, 7.001 through 7.113, 6.001 through 6.121, 5.001 through 5.258 and before 4.086 allows a remote and unauthenticated attacker to trigger the sending of "blocked page" HTML data to an arbitrary victim via crafted TCP requests, potentially flooding the victim.
Key phrases: trigger the sending of "blocked page", improper verification of source of a communication channel, flooding
CVE-2022-27492: An integer underflow in WhatsApp could have caused remote code execution when receiving a crafted video file.
Key phrases: integer underflow, remote code execution
CVE-2022-27493: Improper initialization in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable an escalation of privilege via local access.
Key phrases: potentially enable an escalation of privilege via local, improper initialization, local access, escalation privilege
CVE-2022-27494: Aethon TUG Home Base Server versions prior to version 24 are affected by un unauthenticated attacker who can freely access hashed user credentials.
Key phrases: hashed user credentials
CVE-2022-27495: On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2022-27496: Cross-site scripting vulnerability in Zero-channel BBS Plus v0.7.4 and earlier allows a remote attacker to inject an arbitrary script via unspecified vectors.
Key phrases: inject an arbitrary script via unspecified vectors, cross-site scripting
CVE-2022-27497: Null pointer dereference in firmware for Intel(R) AMT before version 11.8.93, 11.22.93, 11.12.93, 12.0.92, 14.1.67, 15.0.42, 16.1.25 may allow an unauthenticated user to potentially enable denial of service via network access.
Key phrases: potentially enable denial of service via network access, null pointer dereference
CVE-2022-27498: A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: directory traversal, arbitrary file read
CVE-2022-27499: Premature release of resource during expected lifetime in the Intel(R) SGX SDK software may allow a privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, premature release of resource
CVE-2022-2750: A vulnerability, which was classified as critical, was found in SourceCodester Company Website CMS. Affected is an unknown function of the file /dashboard/add-service.php of the component Add Service Handler. The manipulation leads to unrestricted upload. It is possible to launch the attack remotely. VDB-206022 is the identifier assigned to this vulnerability.
Key phrases: unrestricted upload
CVE-2022-27500: Incorrect default permissions for the Intel(R) Support Android application before 21.07.40 may allow an authenticated user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, incorrect default permissions
CVE-2022-27502: RealVNC VNC Server 6.9.0 through 5.1.0 for Windows allows local privilege escalation because an installer repair operation executes %TEMP% files as SYSTEM.
Key phrases: local privilege escalation because an installer repair operation
CVE-2022-27503: Cross-site Scripting (XSS) vulnerability in Citrix StoreFront affects version 1912 before CU5 and version 3.12 before CU9
Key phrases: cross-site scripting (xss)
CVE-2022-27505: Reflected cross site scripting (XSS)
Key phrases: reflected cross site scripting (xss)
CVE-2022-27506: Hard-coded credentials allow administrators to access the shell via the SD-WAN CLI
Key phrases: access the shell via the SD-WAN, hard-coded credentials, hard coded credentials
CVE-2022-27507: Authenticated denial of service
Key phrases: authenticated, denial of service
CVE-2022-27508: Unauthenticated denial of service
Key phrases: unauthenticated, denial of service
CVE-2022-27509: Unauthenticated redirection to a malicious website
Key phrases: unauthenticated redirection
CVE-2022-2751: A vulnerability was found in SourceCodester Company Website CMS and classified as critical. Affected by this issue is some unknown functionality of the file /dashboard/add-portfolio.php. The manipulation of the argument ufile leads to unrestricted upload. The attack may be launched remotely. The identifier of this vulnerability is VDB-206024.
Key phrases: unrestricted upload
CVE-2022-27510: Unauthorized access to Gateway user capabilities 
Key phrases: unauthorized access, gateway user capabilities
CVE-2022-27511: Corruption of the system by a remote, unauthenticated user. The impact of this can include the reset of the administrator password at the next device reboot, allowing an attacker with ssh access to connect with the default administrator credentials after the device has rebooted.
Key phrases: connect with the default administrator credentials after the, corruption of the system, reboot
CVE-2022-27512: Temporary disruption of the ADM license service. The impact of this includes preventing new licenses from being issued or renewed by Citrix ADM.
Key phrases: temporary disruption
CVE-2022-27513: Remote desktop takeover via phishing  
Key phrases: remote desktop takeover
CVE-2022-27516: User login brute force protection functionality bypass   
Key phrases: bypass   , User login brute force protection functionality bypass
CVE-2022-27518: Unauthenticated remote arbitrary code execution
Key phrases: unauthenticated, arbitrary code execution
CVE-2022-2752: A vulnerability in the web server of Secomea GateManager allows a local user to impersonate as the previous user under some failed login conditions.This issue affects:Secomea GateManager versions from 9.4 through 9.7.
Key phrases: impersonate as the previous user under some failed
CVE-2022-27523: A buffer over-read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Key phrases: buffer over-read, exposure of sensitive information, crash, code execution, buffer over read
CVE-2022-27524: An out-of-bounds read can be exploited in Autodesk TrueView 2022 may lead to an exposure of sensitive information or a crash through using a maliciously crafted DWG file as an Input. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Key phrases: out-of-bounds read, sensitive information, crash, code execution, out of bounds read, exposure of sensitive information
CVE-2022-27525: A malicious crafted .dwf or .pct file when consumed through DesignReview.exe application could lead to memory corruption vulnerability by write access violation. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Key phrases: memory corruption, write access violation, code execution
CVE-2022-27526: A malicious crafted TGA file when consumed through DesignReview.exe application could lead to memory corruption vulnerability. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Key phrases: memory corruption, code execution
CVE-2022-27527: A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files. It was fixed in PDFTron earlier than 9.0.7 version in Autodesk Navisworks 2022, and 2020.
Key phrases: memory corruption, code execution
CVE-2022-27528: A maliciously crafted DWFX and SKP files in Autodesk Navisworks 2022 can be used to trigger use-after-free vulnerability. Exploitation of this vulnerability may lead to code execution.
Key phrases: use-after-free, code execution, use after free
CVE-2022-27529: A maliciously crafted PICT, BMP, PSD or TIF file in Autodesk AutoCAD 2022, 2021, 2020, 2019 may be used to write beyond the allocated buffer while parsing PICT, BMP, PSD or TIF file. This vulnerability may be exploited to execute arbitrary code.
Key phrases: execute arbitrary code
CVE-2022-2753: The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made
Key phrases: perform Cross-Site Scripting attacks logged in, cross-site scripting
CVE-2022-27530: A maliciously crafted TIF or PICT file in Autodesk AutoCAD 2022, 2021, 2020, 2019 can be used to write beyond the allocated buffer through Buffer overflow vulnerability. This vulnerability may be exploited to execute arbitrary code.
Key phrases: execute arbitrary code, buffer overflow
CVE-2022-27531: A maliciously crafted TIF file can be forced to read beyond allocated boundaries in Autodesk 3ds Max 2022, and 2021 when parsing the TIF files. This vulnerability in conjunction with other vulnerabilities could lead to code execution in the context of the current process.
Key phrases: tif file, code execution
CVE-2022-27532: A maliciously crafted TIF file in Autodesk 3ds Max 2022 and 2021 can be used to write beyond the allocated buffer while parsing TIF files. This vulnerability in conjunction with other vulnerabilities could lead to arbitrary code execution.
Key phrases: tif file, arbitrary code execution
CVE-2022-27534: Kaspersky Anti-Virus products for home and Kaspersky Endpoint Security with antivirus databases released before 12 March 2022 had a bug in a data parsing module that potentially allowed an attacker to execute arbitrary code. The fix was delivered automatically. Credits: Georgy Zaytsev (Positive Technologies).
Key phrases: execute arbitrary code
CVE-2022-27535: Kaspersky VPN Secure Connection for Windows version up to 21.5 was vulnerable to arbitrary file deletion via abuse of its 'Delete All Service Data And Reports' feature by the local authenticated attacker.
Key phrases: arbitrary file deletion
CVE-2022-27536: Certificate.Verify in crypto/x509 in Go 1.18.x before 1.18.1 can be caused to panic on macOS when presented with certain malformed certificates. This allows a remote TLS server to cause a TLS client to panic.
Key phrases: cause a TLS client to panic, malformed certificates
CVE-2022-27537: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate these potential vulnerabilities.
Key phrases: allow arbitrary code execution, mitigate these potential vulnerabilities, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-27538: A potential Time-of-Check to Time-of-Use (TOCTOU) vulnerability has been identified in the BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure. HP is releasing BIOS updates to mitigate the potential vulnerability.
Key phrases: allow arbitrary code execution, mitigate the potential vulnerability, time-of-check to time-of-use (toctou), denial of service, information disclosure
CVE-2022-27539: Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, time-of-check to time-of use (toctou), denial of service, information disclosure
CVE-2022-2754: The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using them in SQL statements, which could allow unauthenticated attackers to perform SQL Injection attacks
Key phrases: perform SQL Injection attacks, sql injection
CVE-2022-27541: Potential Time-of-Check to Time-of Use (TOCTOU) vulnerabilities have been identified in the HP BIOS for certain HP PC products which may allow arbitrary code execution, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, time-of-check to time-of use (toctou), denial of service, information disclosure
CVE-2022-27544: BigFix Web Reports authorized users may see SMTP credentials in clear text.
Key phrases: clear text
CVE-2022-27545: BigFix Web Reports authorized users may perform HTML injection for the email administrative configuration page.
Key phrases: html injection
CVE-2022-27546: HCL iNotes is susceptible to a Reflected Cross-site Scripting (XSS) vulnerability caused by improper validation of user-supplied input supplied with a form POST request. A remote attacker could exploit this vulnerability using a specially-crafted URL to execute script in a victim's web browser within the security context of the hosting web site and/or steal the victim's cookie-based authentication credentials.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-27547: HCL iNotes is susceptible to a link to non-existent domain vulnerability. An attacker could use this vulnerability to trick a user into supplying sensitive information such as username, password, credit card number, etc.
Key phrases: domain, sensitive information
CVE-2022-27548: HCL Launch stores user credentials in plain clear text which can be read by a local user.
Key phrases: plain clear text
CVE-2022-27549: HCL Launch may store certain data for recurring activities in a plain text format.
Key phrases: plain text format
CVE-2022-27551: HCL Launch could allow an authenticated user to obtain sensitive information in some instances due to improper security checking.
Key phrases: obtain sensitive information, obtain sensitive information in some instances due to, improper security checking
CVE-2022-27558: HCL iNotes is susceptible to a Broken Password Strength Checks vulnerability. Custom password policies are not enforced on certain iNotes forms which could allow users to set weak passwords, leading to easier cracking.
Key phrases: set weak passwords, broken password strength checks, easier cracking
CVE-2022-2756: Server-Side Request Forgery (SSRF) in GitHub repository kareadita/kavita prior to 0.5.4.1.
Key phrases: server-side request forgery (ssrf)
CVE-2022-27560: HCL VersionVault Express exposes administrator credentials.
Key phrases: administrator credentials
CVE-2022-27561: There is a reflected Cross-Site Scripting vulnerability in the HCL Traveler web admin (LotusTraveler.nsf).
Key phrases: cross-site scripting
CVE-2022-27563: An unauthenticated user can overload a part of HCL VersionVault Express and cause a denial of service.
Key phrases: denial of service
CVE-2022-27567: Null pointer dereference vulnerability in parser_hvcC function of libsimba library prior to SMR Apr-2022 Release 1 allows out of bounds write by remote attackers.
Key phrases: out of bounds write by remote attackers, null pointer dereference
CVE-2022-27568: Heap-based buffer overflow vulnerability in parser_iloc function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
Key phrases: code execution by remote attacker, heap-based buffer overflow, heap based buffer overflow
CVE-2022-27569: Heap-based buffer overflow vulnerability in parser_infe function in libsimba library prior to SMR Apr-2022 Release 1 allows code execution by remote attacker.
Key phrases: code execution by remote attacker, heap-based buffer overflow, heap based buffer overflow