yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-31526: The ThundeRatz/ThunderDocs repository through 2020-05-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31527: The Wildog/flask-file-server repository through 2020-02-20 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31528: The bonn-activity-maps/bam_annotation_tool repository through 2021-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31529: The cinemaproject/monorepo repository through 2021-03-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-3153: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0404.
Key phrases: null pointer dereference
CVE-2022-31530: The csm-aut/csm repository through 3.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31531: The dainst/cilantro repository through 0.0.4 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31532: The dankolbman/travel_blahg repository through 2016-01-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31533: The decentraminds/umbral repository through 2020-01-15 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31534: The echoleegroup/PythonWeb repository through 2018-10-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31535: The freefood89/Fishtank repository through 2015-06-24 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31536: The jaygarza1982/ytdl-sync repository through 2021-01-02 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31537: The jmcginty15/Solar-system-simulator repository through 2021-07-26 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31538: The joaopedro-fg/mp-m08-interface repository through 2020-12-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31539: The kotekan/kotekan repository through 2021.11 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-3154: The Woo Billingo Plus WordPress plugin before 4.4.5.4, Integration for Billingo & Gravity Forms WordPress plugin before 1.0.4, Integration for Szamlazz.hu & Gravity Forms WordPress plugin before 1.2.7 are lacking CSRF checks in various AJAX actions, which could allow attackers to make logged in Shop Managers and above perform unwanted actions, such as deactivate the plugin's license
Key phrases: make logged in Shop Managers and above perform, csrf checks, unwanted actions
CVE-2022-31540: The kumardeepak/hin-eng-preprocessing repository through 2019-07-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31541: The lyubolp/Barry-Voice-Assistant repository through 2021-01-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31542: The mandoku/mdweb repository through 2015-05-07 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31543: The maxtortime/SetupBox repository through 1.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31544: The meerstein/rbtm repository through 1.5 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31545: The ml-inory/ModelConverter repository through 2021-04-26 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31546: The nlpweb/glance repository through 2014-06-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31547: The noamezekiel/sphere repository through 2020-05-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31548: The nrlakin/homepage repository through 2017-03-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31549: The olmax99/helm-flask-celery repository before 2022-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-3155: When saving or opening an email attachment on macOS, Thunderbird did not set attribute com.apple.quarantine on the received file. If the received file was an application and the user attempted to open it, then the application was started immediately without asking the user to confirm. This vulnerability affects Thunderbird < 102.3.
CVE-2022-31550: The olmax99/pyathenastack repository through 2019-11-08 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31551: The pleomax00/flask-mongo-skel repository through 2012-11-01 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31552: The project-anuvaad/anuvaad-corpus repository through 2020-11-23 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31553: The rainsoupah/sleep-learner repository through 2021-02-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31554: The rohitnayak/movie-review-sentiment-analysis repository through 2017-05-07 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31555: The romain20100/nursequest repository through 2018-02-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31556: The rusyasoft/TrainEnergyServer repository through 2017-08-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31557: The seveas/golem repository through 2016-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31558: The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31559: The tsileo/flask-yeoman repository through 2013-09-13 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-3156: A remote code execution vulnerability exists in Rockwell Automation Studio 5000 Logix Emulate software. Users are granted elevated permissions on certain product services when the software is installed.Due to this misconfiguration, a malicious user could potentially achieve remote code execution on the targeted software. 
Key phrases: remote code execution
CVE-2022-31560: The uncleYiba/photo_tag repository through 2020-08-31 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31561: The varijkapil13/Sphere_ImageBackend repository through 2019-10-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31562: The waveyan/internshipsystem repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31563: The whmacmac/vprj repository through 2022-04-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31564: The woduq1414/munhak-moa repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31565: The yogson/syrabond repository through 2020-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31566: The DSAB-local/DSAB repository through 2019-02-18 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31567: The DSABenchmark/DSAB repository through 2.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31568: The Rexians/rex-web repository through 2022-06-05 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-3157: A vulnerability exists in the Rockwell Automation controllers that allows a malformed CIP request to cause a major non-recoverable fault (MNRF) and a denial-of-service condition (DOS). 
Key phrases: cause a major non-recoverable fault (, major non-recoverable fault (mnrf), denial of service
CVE-2022-31570: The adriankoczuruek/ceneo-web-scrapper repository through 2021-03-15 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31571: The akashtalole/python-flask-restful-api repository through 2019-09-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31572: The ceee-vip/cockybook repository through 2015-04-16 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31573: The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31574: The deepaliupadhyay/RealEstate repository through 2018-11-30 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31575: The duducosmos/livro_python repository through 2018-06-06 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31576: The heidi-luong1109/shackerpanel repository through 2021-05-25 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31577: The longmaoteamtf/audio_aligner_app repository through 2020-01-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31578: The piaoyunsoft/bt_lnmp repository through 2019-10-10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31579: The ralphjzhang/iasset repository through 2022-05-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-3158: Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an input validation vulnerability. The FactoryTalk VantagePoint SQL Server lacks input validation when users enter SQL statements to retrieve information from the back-end database. If successfully exploited, this could allow a user with basic user privileges to perform remote code execution on the server.
Key phrases: perform remote code execution on the server, input validation
CVE-2022-31580: The sanojtharindu/caretakerr-api repository through 2021-05-17 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31581: The scorelab/OpenMF repository before 2022-05-03 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31582: The shaolo1/VideoServer repository through 2019-09-21 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31583: The sravaniboinepelli/AutomatedQuizEval repository through 2020-04-27 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31584: The stonethree/s3label repository through 2019-08-14 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31585: The umeshpatil-dev/Home__internet repository through 2020-08-28 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31586: The unizar-30226-2019-06/ChangePop-Back repository through 2019-06-04 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31587: The yuriyouzhou/KG-fashion-chatbot repository through 2018-05-22 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31588: The zippies/testplatform repository through 2016-07-19 on GitHub allows absolute path traversal because the Flask send_file function is used unsafely.
Key phrases: absolute path traversal because the Flask send_file function
CVE-2022-31589: Due to improper authorization check, business users who are using Israeli File from SHAAM program (/ATL/VQ23 transaction), are granted more than needed authorization to perform certain transaction, which may lead to users getting access to data that would otherwise be restricted.
Key phrases: access to data, improper authorization
CVE-2022-3159: The APDFL.dll contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, stack-based buffer overflow, stack based buffer overflow
CVE-2022-31590: SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around systems root disk access restrictions to Write/Create a program file on system disk root path, which could then be executed with elevated privileges of the application during application start up or reboot, potentially compromising Confidentiality, Integrity and Availability of the system.
Key phrases: work around systems root disk access restrictions to, local access, reboot
CVE-2022-31591: SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service
Key phrases: gain elevated privileges, unquoted element
CVE-2022-31592: The application SAP Enterprise Extension Defense Forces & Public Security - versions 605, 606, 616,617,618, 802, 803, 804, 805, 806, does not perform necessary authorization checks for an authenticated user over the network, resulting in escalation of privileges leading to a limited impact on confidentiality.
Key phrases: escalation of privileges, limited impact on confidentiality, escalation privilege
CVE-2022-31593: SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
Key phrases: inject code that can be executed by the, behavior
CVE-2022-31594: A highly privileged user can exploit SUID-root program to escalate his privileges to root on a local Unix system.
Key phrases: suid-root program, escalate privilege
CVE-2022-31595: SAP Financial Consolidation - version 1010,?does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
Key phrases: escalation of privileges, escalation privilege
CVE-2022-31596: Under certain conditions, an attacker authenticated as a CMS administrator and with high privileges access to the Network in SAP BusinessObjects Business Intelligence Platform (Monitoring DB) - version 430, can access BOE Monitoring database to retrieve and modify (non-personal) system data which would otherwise be restricted. Also, a potential attack could be used to leave the CMS's scope and impact the database. A successful attack could have a low impact on confidentiality, a high impact on integrity, and a low impact on availability.
Key phrases: availability, confidentiality, integrity
CVE-2022-31597: Within SAP S/4HANA - versions S4CORE 101, 102, 103, 104, 105, 106, SAPSCORE 127, the application business partner extension for Spain/Slovakia does not perform necessary authorization checks for a low privileged authenticated user over the network, resulting in escalation of privileges leading to low impact on confidentiality and integrity of the data.
Key phrases: escalation of privileges, low impact, escalation privilege, confidentiality, confidentiality and integrity
CVE-2022-31598: Due to insufficient input validation, SAP Business Objects - version 420, allows an authenticated attacker to submit a malicious request through an allowed operation. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
Key phrases: submit a malicious request through an allowed operation, successful exploitation, limited impact, insufficient input validation, confidentiality, confidentiality and integrity
CVE-2022-31599: NVIDIA DGX A100 contains a vulnerability in SBIOS in the Ofbd, where a local user with elevated privileges can cause access to an uninitialized pointer, which may lead to code execution, escalation of privileges, denial of service, and information disclosure. The scope of impact can extend to other components.
Key phrases: uninitialized pointer, denial of service, information disclosure, scope of impact, code execution, escalation privilege
CVE-2022-3160: The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, out-of-bounds write, out of bounds write
CVE-2022-31600: NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmmCore, where a user with high privileges can chain another vulnerability to this vulnerability, causing an integer overflow, possibly leading to code execution, escalation of privileges, denial of service, compromised integrity, and information disclosure. The scope of impact can extend to other components.
Key phrases: integer overflow, code execution, escalation of privileges, denial of service, compromised integrity, information disclosure, scope of impact, escalation privilege
CVE-2022-31601: NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmbiosPei, which may allow a highly privileged local attacker to cause an out-of-bounds write, which may lead to code execution, denial of service, compromised integrity, and information disclosure.
Key phrases: cause an out-of-bounds write, code execution, denial of service, compromised integrity, information disclosure, out of bounds write
CVE-2022-31602: NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with elevated privileges and a preconditioned heap can exploit an out-of-bounds write vulnerability, which may lead to code execution, denial of service, data integrity impact, and information disclosure.
Key phrases: out-of-bounds write, code execution, denial of service, data integrity impact, information disclosure, out of bounds write
CVE-2022-31603: NVIDIA DGX A100 contains a vulnerability in SBIOS in the IpSecDxe, where a user with high privileges and preconditioned IpSecDxe global data can exploit improper validation of an array index to cause code execution, which may lead to denial of service, data integrity impact, and information disclosure.
Key phrases: ipsecdxe, code execution, denial of service, data integrity impact, information disclosure
CVE-2022-31604: NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via pickle and no safe deserialization. The deserialization of Untrusted Data may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
Key phrases: cause Remote Code Execution, remote code execution, denial of service
CVE-2022-31605: NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.safe_load(). The deserialization of Untrusted Data, may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
Key phrases: cause Remote Code Execution, remote code execution, denial of service
CVE-2022-31606: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a failure to properly validate data might allow an attacker with basic user capabilities to cause an out-of-bounds access in kernel mode, which could lead to denial of service, information disclosure, escalation of privileges, or data tampering.
Key phrases: cause an out-of-bounds access, denial of service, information disclosure, escalation of privileges, data tampering, out of bounds access, escalation privilege
CVE-2022-31607: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where a local user with basic capabilities can cause improper input validation, which may lead to denial of service, escalation of privileges, data tampering, and limited information disclosure.
Key phrases: denial of service, escalation of privileges, data tampering, limited information disclosure, improper input validation, escalation privilege
CVE-2022-31608: NVIDIA GPU Display Driver for Linux contains a vulnerability in an optional D-Bus configuration file, where a local user with basic capabilities can impact protected D-Bus endpoints, which may lead to code execution, denial of service, escalation of privileges, information disclosure, and data tampering.
Key phrases: code execution, denial of service, escalation of privileges, information disclosure, data tampering, escalation privilege
CVE-2022-31609: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it allows the guest VM to allocate resources for which the guest is not authorized. This vulnerability may lead to loss of data integrity and confidentiality, denial of service, or information disclosure.
Key phrases: allocate resources for which the guest is not, loss of data integrity and confidentiality, denial of service, information disclosure
CVE-2022-3161: The APDFL.dll contains a memory corruption vulnerability while parsing specially crafted PDF files. This could allow an attacker to execute code in the context of the current process.
Key phrases: execute code in the context of the current, memory corruption
CVE-2022-31610: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabilities can cause an out-of-bounds write, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
Key phrases: out-of-bounds write, code execution, denial of service, escalation of privileges, information disclosure, data tampering, out of bounds write, escalation privilege
CVE-2022-31611: NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an attacker with user level privileges may cause the installer to load an arbitrary DLL when the installer is launched. A successful exploit of this vulnerability could lead to escalation of privileges and code execution.
Key phrases: uncontrolled search path, escalation of privileges, code execution, escalation privilege
CVE-2022-31612: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic capabilities can cause an out-of-bounds read, which may lead to a system crash or a leak of internal kernel information.
Key phrases: out-of-bounds read, system crash, leak of internal kernel information, out of bounds read
CVE-2022-31613: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer, where any local user can cause a null-pointer dereference, which may lead to a kernel panic.
Key phrases: null-pointer dereference, kernel panic, null pointer, null pointer dereference
CVE-2022-31614: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin) where it may double-free some resources. An attacker may exploit this vulnerability with other vulnerabilities to cause denial of service, code execution, and information disclosure.
Key phrases: denial of service, code execution, information disclosure, double free
CVE-2022-31615: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.
Key phrases: null-pointer dereference, denial of service, null pointer, null pointer dereference
CVE-2022-31616: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a local user with basic capabilities can cause an out-of-bounds read, which may lead to denial of service, or information disclosure.
Key phrases: out-of-bounds read, denial of service, information disclosure, out of bounds read
CVE-2022-31617: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys), where a local user with basic capabilities can cause an out-of-bounds read, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
Key phrases: out-of-bounds read, code execution, denial of service, escalation of privileges, information disclosure, data tampering, out of bounds read, escalation privilege
CVE-2022-31618: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (vGPU plugin), where it can dereference a null pointer, which may lead to denial of service.
Key phrases: null pointer, denial of service
CVE-2022-31619: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.13), Teamcenter V13.0 (All versions < V13.0.0.9), Teamcenter V13.1 (All versions < V13.1.0.9), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.3), Teamcenter V14.0 (All versions < V14.0.0.2). Java EE Server Manager HTML Adaptor in Teamcenter consists of default hardcoded credentials. Access to the application allows a user to perform a series of actions that could potentially lead to remote code execution with elevated permissions.
Key phrases: perform a series of actions that could potentially, hardcoded, hardcoded credentials, remote code execution
CVE-2022-3162: Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group.
Key phrases: clusters
CVE-2022-31620: In libjpeg before 1.64, BitStream<false>::Get in bitstream.hpp has an assertion failure that may cause denial of service. This is related to out-of-bounds array access during arithmetically coded lossless scan or arithmetically coded sequential scan.
Key phrases: assertion failure, denial of service, out-of-bounds array access
CVE-2022-31621: MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_xbstream.cc, when an error occurs (stream_ctxt->dest_file == NULL) while executing the method xbstream_open, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock.
Key phrases: trigger a denial of service due to the
CVE-2022-31622: MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (pthread_create returns a nonzero value) while executing the method create_worker_threads, the held lock is not released correctly, which allows local users to trigger a denial of service due to the deadlock.
Key phrases: trigger a denial of service due to the
CVE-2022-31623: MariaDB Server before 10.7 is vulnerable to Denial of Service. In extra/mariabackup/ds_compress.cc, when an error occurs (i.e., going to the err label) while executing the method create_worker_threads, the held lock thd->ctrl_mutex is not released correctly, which allows local users to trigger a denial of service due to the deadlock.
Key phrases: trigger a denial of service due to the
CVE-2022-31624: MariaDB Server before 10.7 is vulnerable to Denial of Service. While executing the plugin/server_audit/server_audit.c method log_statement_ex, the held lock lock_bigbuffer is not released correctly, which allows local users to trigger a denial of service due to the deadlock.
Key phrases: trigger a denial of service due to the
CVE-2022-31625: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametrized query may lead to PHP attempting to free memory using uninitialized data as pointers. This could lead to RCE vulnerability or denial of service.
Key phrases: rce, denial of service
CVE-2022-31626: In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when pdo_mysql extension with mysqlnd driver, if the third party is allowed to supply host to connect to and the password for the connection, password of excessive length can trigger a buffer overflow in PHP, which can lead to a remote code execution vulnerability.
Key phrases: buffer overflow, remote code execution
CVE-2022-31627: In PHP versions 8.1.x below 8.1.8, when fileinfo functions, such as finfo_buffer, due to incorrect patch applied to the third party code from libmagic, incorrect function may be used to free allocated memory, which may lead to heap corruption.
Key phrases: heap corruption
CVE-2022-31628: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the phar uncompressor code would recursively uncompress "quines" gzip files, resulting in an infinite loop.
Key phrases: infinite loop
CVE-2022-31629: In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications.
CVE-2022-31630: In PHP versions prior to 7.4.33, 8.0.25 and 8.2.12, when using imageloadfont() function in gd extension, it is possible to supply a specially crafted font file, such as if the loaded font is used with imagechar() function, the read outside allocated buffer will be used. This can lead to crashes or disclosure of confidential information.
Key phrases: read outside allocated buffer, crashes, disclosure of confidential information
CVE-2022-31635: Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31636: Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31637: Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31638: Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31639: Potential time-of-check to time-of-use (TOCTOU) vulnerabilities have been identified in the BIOS for certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31640: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31641: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31642: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31643: A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity. HP is releasing firmware updates to mitigate the potential vulnerability.
Key phrases: mitigate the potential vulnerability, loss of integrity
CVE-2022-31644: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31645: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure. 
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31646: Potential vulnerabilities have been identified in the system BIOS of certain HP PC products, which might allow arbitrary code execution, escalation of privilege, denial of service, and information disclosure.
Key phrases: allow arbitrary code execution, escalation of privilege, denial of service, information disclosure, escalation privilege
CVE-2022-31647: Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in the DataFolder parameter, a different vulnerability than CVE-2022-26659.
Key phrases: delete any file through the hyperv/destroy
CVE-2022-31648: Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in TPS-5233, for versions 7.3.x in TPS-5324, and for versions 7.2.x in TPS-5235. Earlier versions of Talend Administration Center may also be impacted; users are encouraged to update to a supported version.
Key phrases: cross-site scripting (xss) issue
CVE-2022-31649: ownCloud owncloud/core before 10.10.0 Improperly Removes Sensitive Information Before Storage or Transfer.
CVE-2022-3165: An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.
Key phrases: integer underflow issue, denial of service
CVE-2022-31650: In SoX 14.4.2, there is a floating-point exception in lsx_aiffstartwrite in aiff.c in libsox.a.
CVE-2022-31651: In SoX 14.4.2, there is an assertion failure in rate_init in rate.c in libsox.a.
Key phrases: assertion failure
CVE-2022-31654: VMware vRealize Log Insight in versions prior to 8.8.2 contain a stored cross-site scripting vulnerability due to improper input sanitization in configurations.
Key phrases: stored cross-site scripting
CVE-2022-31655: VMware vRealize Log Insight in versions prior to 8.8.2 contain a stored cross-site scripting vulnerability due to improper input sanitization in alerts.
Key phrases: cross-site scripting
CVE-2022-31656: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. A malicious actor with network access to the UI may be able to obtain administrative access without the need to authenticate.
Key phrases: authentication bypass, obtain administrative access, local domain users
CVE-2022-31657: VMware Workspace ONE Access and Identity Manager contain a URL injection vulnerability. A malicious actor with network access may be able to redirect an authenticated user to an arbitrary domain.
Key phrases: url injection
CVE-2022-31658: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
Key phrases: remote code execution
CVE-2022-31659: VMware Workspace ONE Access and Identity Manager contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
Key phrases: remote code execution
CVE-2022-3166: Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to a denial-of-service condition. The security vulnerability could be exploited by an attacker with network access to the affected systems by sending TCP packets to webserver and closing it abruptly which would cause a denial-of-service condition for the web server application on the device
Key phrases: denial of service
CVE-2022-31660: VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
Key phrases: privilege escalation, escalate privilege
CVE-2022-31661: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two privilege escalation vulnerabilities. A malicious actor with local access can escalate privileges to 'root'.
Key phrases: privilege escalation, escalate privilege
CVE-2022-31662: VMware Workspace ONE Access, Identity Manager, Connectors and vRealize Automation contain a path traversal vulnerability. A malicious actor with network access may be able to access arbitrary files.
Key phrases: access arbitrary files, path traversal
CVE-2022-31663: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a reflected cross-site scripting (XSS) vulnerability. Due to improper user input sanitization, a malicious actor with some user interaction may be able to inject javascript code in the target user's window.
Key phrases: reflected cross-site scripting (xss), target users window
CVE-2022-31664: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
Key phrases: privilege escalation, escalate privilege
CVE-2022-31665: VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a remote code execution vulnerability. A malicious actor with administrator and network access can trigger a remote code execution.
Key phrases: remote code execution
CVE-2022-3167: Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1.
Key phrases: improper restriction
CVE-2022-31672: VMware vRealize Operations contains a privilege escalation vulnerability. A malicious actor with administrative network access can escalate privileges to root.
Key phrases: privilege escalation, escalate privilege
CVE-2022-31673: VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can create and leak hex dumps, leading to information disclosure. Successful exploitation can lead to a remote code execution.
Key phrases: information disclosure, remote code execution
CVE-2022-31674: VMware vRealize Operations contains an information disclosure vulnerability. A low-privileged malicious actor with network access can access log files that lead to information disclosure.
Key phrases: information disclosure
CVE-2022-31675: VMware vRealize Operations contains an authentication bypass vulnerability. An unauthenticated malicious actor with network access may be able to create a user with administrative privileges.
Key phrases: authentication bypass
CVE-2022-31676: VMware Tools (12.0.0, 11.x.y and 10.x.y) contains a local privilege escalation vulnerability. A malicious actor with local non-administrative access to the Guest OS can escalate privileges as a root user in the virtual machine.
Key phrases: local privilege escalation, escalate privilege
CVE-2022-31677: An Insufficient Session Expiration issue was discovered in the Pinniped Supervisor (before v0.19.0). A user authenticating to Kubernetes clusters via the Pinniped Supervisor could potentially use their access token to continue their session beyond what proper use of their refresh token might allow.
Key phrases: insufficient session expiration issue
CVE-2022-31678: VMware Cloud Foundation (NSX-V) contains an XML External Entity (XXE) vulnerability. On VCF 3.x instances with NSX-V deployed, this may allow a user to exploit this issue leading to a denial-of-service condition or unintended information disclosure.
Key phrases: exploit this issue leading to a denial-, xml external entity (xxe), denial-of-service condition, unintended information disclosure, denial of service
CVE-2022-31679: Applications that allow HTTP PATCH access to resources exposed by Spring Data REST in versions 3.6.0 - 3.5.5, 3.7.0 - 3.7.2, and older unsupported versions, if an attacker knows about the structure of the underlying domain model, they can craft HTTP requests that expose hidden entity attributes.
Key phrases: resources exposed by Spring Data REST in versions, hidden entity attributes
CVE-2022-31680: The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). A malicious actor with admin access on vCenter server may exploit this issue to execute arbitrary code on the underlying operating system that hosts the vCenter Server.
Key phrases: execute arbitrary code, deserialisation
CVE-2022-31681: VMware ESXi contains a null-pointer deference vulnerability. A malicious actor with privileges within the VMX process only, may create a denial of service condition on the host.
Key phrases: null-pointer deference, denial of service condition, null pointer
CVE-2022-31682: VMware Aria Operations contains an arbitrary file read vulnerability. A malicious actor with administrative privileges may be able to read arbitrary files containing sensitive data.
Key phrases: read arbitrary files, arbitrary file read