yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-46701: The issue was addressed with improved bounds checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, tvOS 16.2. Connecting to a malicious NFS server may lead to arbitrary code execution with kernel privileges.
Key phrases: arbitrary code execution
CVE-2022-46702: The issue was addressed with improved memory handling. This issue is fixed in iOS 16.2 and iPadOS 16.2. An app may be able to disclose kernel memory.
Key phrases: disclose kernel memory
CVE-2022-46703: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. An app may be able to read sensitive location information
Key phrases: sensitive location information
CVE-2022-46704: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to modify protected parts of the file system.
CVE-2022-46705: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1, Safari 16.2. Visiting a malicious website may lead to address bar spoofing.
Key phrases: spoofing issue, address bar spoofing
CVE-2022-46706: A type confusion issue was addressed with improved state handling. This issue is fixed in Security Update 2022-003 Catalina, macOS Monterey 12.3, macOS Big Sur 11.6.5. An application may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code, type confusion issue
CVE-2022-46709: A memory corruption issue was addressed with improved state management. This issue is fixed in macOS Ventura 13, iOS 16. An app may be able to execute arbitrary code with kernel privileges
Key phrases: execute arbitrary code, memory corruption issue
CVE-2022-4671: The PixCodes WordPress plugin before 2.3.7 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-46710: A logic issue was addressed with improved checks. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. Location data may be shared via iCloud links even if Location metadata is disabled via the Share Sheet.
CVE-2022-46712: A use after free issue was addressed with improved memory management. This issue is fixed in macOS Ventura 13. An app may be able to cause unexpected system termination or potentially execute code with kernel privileges.
Key phrases: use after free issue, unexpected system termination, execute code
CVE-2022-46713: A race condition was addressed with additional validation. This issue is fixed in macOS Ventura 13, macOS Monterey 12.6.1, macOS Big Sur 11.7.1. An app may be able to modify protected parts of the file system.
Key phrases: race condition
CVE-2022-46715: A logic issue was addressed with improved checks. This issue is fixed in iOS 16.1 and iPadOS 16. An app may be able to bypass certain Privacy preferences
Key phrases: bypass certain Privacy preferences
CVE-2022-46716: A logic issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.1, iOS 16.2 and iPadOS 16.2. Private Relay functionality did not match system settings
CVE-2022-46717: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 16.2 and iPadOS 16.2. A user with physical access to a locked Apple Watch may be able to view user photos via accessibility features
Key phrases: logic issue
CVE-2022-46718: A logic issue was addressed with improved restrictions. This issue is fixed in iOS 15.7.2 and iPadOS 15.7.2, macOS Ventura 13.1, macOS Big Sur 11.7.2, macOS Monterey 12.6.2. An app may be able to read sensitive location information
Key phrases: sensitive location information
CVE-2022-4672: The WordPress Simple Shopping Cart WordPress plugin before 4.6.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-46720: An integer overflow was addressed with improved input validation. This issue is fixed in iOS 16.2 and iPadOS 16.2, macOS Ventura 13.1. An app may be able to break out of its sandbox
Key phrases: integer overflow
CVE-2022-46721: The issue was addressed with improved memory handling. This issue is fixed in macOS Ventura 13. An app may be able to execute arbitrary code with kernel privileges.
Key phrases: execute arbitrary code
CVE-2022-46722: A logic issue was addressed with improved checks. This issue is fixed in macOS Ventura 13. An app may be able to modify protected parts of the file system.
Key phrases: logic issue
CVE-2022-46723: This issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.6.1, macOS Big Sur 11.7.1. A remote user may be able to write arbitrary files.
Key phrases: write arbitrary files
CVE-2022-46724: This issue was addressed by restricting options offered on a locked device. This issue is fixed in iOS 16.4 and iPadOS 16.4. A person with physical access to an iOS device may be able to view the last image used in Magnifier from the lock screen.
CVE-2022-46725: A spoofing issue existed in the handling of URLs. This issue was addressed with improved input validation. This issue is fixed in iOS 16.4 and iPadOS 16.4. Visiting a malicious website may lead to address bar spoofing.
Key phrases: spoofing issue, address bar spoofing
CVE-2022-4673: The Rate my Post WordPress plugin before 3.3.9 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-46732: Even if the authentication fails for local service authentication, the requested command could still execute regardless of authentication status.
CVE-2022-46733: Sewios Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site scripting in its backup services. An attacker could take advantage of this vulnerability to execute arbitrary commands.
Key phrases: execute arbitrary commands, cross-site scripting
CVE-2022-46738: The affected product exposes multiple sensitive data fields of the affected product. An attacker can use the SNMP command to get device mac address and login as admin.
Key phrases: sensitive data fields
CVE-2022-4674: The Ibtana WordPress plugin before 1.1.8.8 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-46740: There is a denial of service vulnerability in the Wi-Fi module of the HUAWEI WS7100-20 Smart WiFi Router.Successful exploit could cause a denial of service (DoS) condition.
Key phrases: denial of service (DoS), denial of service (dos) condition
CVE-2022-46741: Out-of-bounds read in gather_tree in PaddlePaddle before 2.4.
Key phrases: out-of-bounds read, out of bounds read
CVE-2022-46742: Code injection in paddle.audio.functional.get_window in PaddlePaddle 2.4.0-rc0 allows arbitrary code execution.
Key phrases: allows arbitrary code execution, code injection
CVE-2022-4675: The Mongoose Page Plugin WordPress plugin before 1.9.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-46751: Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2.When Apache Ivy prior to 2.5.2 parses XML files - either its own configuration, Ivy files or Apache Maven POMs - it will allow downloading external document type definitions and expand any entity references contained therein when used.This can be used to exfiltrate data, access resources only the machine running Ivy has access to or disturb the execution of Ivy in different ways.Starting with Ivy 2.5.2 DTD processing is disabled by default except when parsing Maven POMs where the default is to allow DTD processing but only to include a DTD snippet shipping with Ivy that is needed to deal with existing Maven POMs that are not valid XML files but are nevertheless accepted by Maven. Access can be be made more lenient via newly introduced system properties where needed.Users of Ivy prior to version 2.5.2 can use Java system properties to restrict processing of external DTDs, see the section about "JAXP Properties for External Access restrictions" inside Oracle's "Java API for XML Processing (JAXP) Security Guide".
Key phrases: exfiltrate data, include a DTD snippet shipping with Ivy that, improper restriction of xml external entity reference, xml injection (aka blind xpath injection)
CVE-2022-46752: Dell BIOS contains an Improper Authorization vulnerability. An unauthenticated physical attacker may potentially exploit this vulnerability, leading to denial of service.
Key phrases: improper authorization, denial of service
CVE-2022-46754: Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user might access certain pro license features for which this admin is not authorized in order to configure user controlled external entities.
Key phrases: access control, improper access control
CVE-2022-46755: Wyse Management Suite 3.8 and below contain an improper access control vulnerability. A authenticated malicious admin user can edit general client policy for which the user is not authorized.
Key phrases: improper access control
CVE-2022-46756: Dell VxRail, versions prior to 7.0.410, contain a Container Escape Vulnerability. A local high-privileged attacker could potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the container's underlying OS. Exploitation may lead to a system take over by an attacker.
Key phrases: container escape, system take over, arbitrary os command
CVE-2022-4676: The OSM WordPress plugin through 6.01 does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-46761: The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may cause malicious hiding of app icons.
Key phrases: malicious hiding
CVE-2022-46762: The memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.
Key phrases: logic bypass, data confidentiality
CVE-2022-46763: A SQL injection issue in a database stored function in TrueConf Server 5.2.0.10225 allows a low-privileged database user to execute arbitrary SQL commands as the database administrator, resulting in execution of arbitrary code.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands as the database administrator, sql injection, arbitrary code
CVE-2022-46764: A SQL injection issue in the web API in TrueConf Server 5.2.0.10225 allows remote unauthenticated attackers to execute arbitrary SQL commands, ultimately leading to remote code execution.
Key phrases: execute arbitrary SQL commands, sql injection, remote code execution
CVE-2022-46768: Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. The service does not have proper validation for URL parameters before reading the files.
Key phrases: arbitrary file read
CVE-2022-46769: An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability in Sling App CMS version 1.1.2 and prior may allow an authenticated remote attacker to perform a reflected cross-site scripting (XSS) attack in the site group feature.Upgrade to Apache Sling App CMS >= 1.1.4 
Key phrases: perform a reflected cross-site scripting (, reflected cross-site scripting (xss), improper neutralization of input during web page generation
CVE-2022-4677: The Leaflet Maps Marker WordPress plugin before 3.12.7 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack.
Key phrases: perform Stored Cross-Site Scripting attack, stored cross-site scripting
CVE-2022-46770: qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a crafted multicast UDP packet (IP address range of 224.0.0.0 through 239.255.255.255).
Key phrases: denial of service (CPU consumption and loss of forwarding), cause a denial of service (CPU consumption, cpu consumption
CVE-2022-46771: IBM UrbanCode Deploy (UCD) 6.2.0.0 through 6.2.7.18, 7.0.5.0 through 7.0.5.13, 7.1.0.0 through 7.1.2.9, 7.2.0.0 through 7.2.3.2 and 7.3.0.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 242273.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2022-46773: IBM Robotic Process Automation 21.0.0 - 21.0.7 and 23.0.0 is vulnerable to client-side validation bypass for credential pools. Invalid credential pools may be created as a result.  IBM X-Force ID:  242951.
Key phrases: bypass for credential pools, validation bypass, client-side validation bypass
CVE-2022-46774: IBM Manage Application 8.8.0 and 8.9.0 in the IBM Maximo Application Suite is vulnerable to incorrect default permissions which could give access to a user to actions that they should not have access to.  IBM X-Force ID:  242953.
Key phrases: default permissions
CVE-2022-4678: The TemplatesNext ToolKit WordPress plugin before 3.2.8 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-46781: An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU memory processing operations to access a limited amount outside of buffer bounds. This affects Valhall r29p0 through r41p0 before r42p0 and Avalon r41p0 before r42p0.
Key phrases: non-privileged user
CVE-2022-46782: An issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to only launch the VPNSSL Client, can use the OpenVPN instance to execute malicious code as administrator on the local machine.
CVE-2022-46783: An issue was discovered in Stormshield SSL VPN Client before 3.2.0. If multiple address books are used, an attacker may be able to access the other encrypted address book.
CVE-2022-46784: SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows open redirection. (The issue was originally found in 5.5.1 GA.)
Key phrases: open redirection
CVE-2022-46785: SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 1 of 2).
Key phrases: XSS (issue 1 of 2), xss
CVE-2022-46786: SquaredUp Dashboard Server SCOM edition before 5.7.1 GA allows XSS (issue 2 of 2).
Key phrases: XSS (issue 2 of 2), xss
CVE-2022-4679: The Wufoo Shortcode WordPress plugin before 1.52 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-46792: Hasura GraphQL Engine before 2.15.2 mishandles row-level authorization in the Update Many API for Postgres backends. The fixed versions are 2.10.2, 2.11.3, 2.12.1, 2.13.2, 2.14.1, and 2.15.2. (Versions before 2.10.0 are unaffected.)
CVE-2022-46793: Cross-Site Request Forgery (CSRF) vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin <=12.4.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46794: Cross-Site Request Forgery (CSRF) vulnerability in weightbasedshipping.Com WooCommerce Weight Based Shipping plugin <=5.4.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46797: Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <=5.2.3 leads to plugin settings change.
Key phrases: cross-site request forgery (csrf), plugin settings change
CVE-2022-46798: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <=2.5.1 leading to plugin settings change.
Key phrases: cross-site request forgery (csrf), plugin settings change
CVE-2022-46799: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Easy Testimonial Slider and Form plugin <=1.0.15 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-4680: The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
Key phrases: perform PHP Object Injection when a suitable gadget, php object injection
CVE-2022-46800: Cross-Site Request Forgery (CSRF) vulnerability in LiteSpeed Technologies LiteSpeed Cache plugin <=5.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46801: Improper Neutralization of Formula Elements in a CSV File vulnerability in Paul Ryley Site Reviews.This issue affects Site Reviews: from n/a through 6.2.0.
Key phrases: improper neutralization of formula elements, site reviews
CVE-2022-46802: Improper Neutralization of Formula Elements in a CSV File vulnerability in WebToffee Product Reviews Import Export for WooCommerce.This issue affects Product Reviews Import Export for WooCommerce: from n/a through 1.4.8.
Key phrases: improper neutralization of formula elements
CVE-2022-46803: Improper Neutralization of Formula Elements in a CSV File vulnerability in Noptin Newsletter Simple Newsletter Plugin  Noptin.This issue affects Simple Newsletter Plugin  Noptin: from n/a through 1.9.5.
Key phrases: improper neutralization of formula elements
CVE-2022-46804: Improper Neutralization of Formula Elements in a CSV File vulnerability in Narola Infotech Solutions LLP Export Users Data Distinct.This issue affects Export Users Data Distinct: from n/a through 1.3.
Key phrases: improper neutralization of formula elements
CVE-2022-46805: Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <=2.3.1 leading toactivation/deactivation of plugin rulesets.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46806: Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <=1.1.10 leading to cart modification.
Key phrases: cross-site request forgery (csrf), cart modification
CVE-2022-46808: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Repute Infosystems ARMember armember-membership allows SQL Injection.This issue affects ARMember: from n/a through 3.4.11.
Key phrases: SQL Injection, sql command, sql injection
CVE-2022-46809: Improper Neutralization of Formula Elements in a CSV File vulnerability in WPDeveloper ReviewX  Multi-criteria Rating & Reviews for WooCommerce.This issue affects ReviewX  Multi-criteria Rating & Reviews for WooCommerce: from n/a through 1.6.7.
Key phrases: improper neutralization of formula elements
CVE-2022-4681: The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
Key phrases: sql injection
CVE-2022-46810: Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce  Increase Your Sales plugin <=1.0.13 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46812: Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Thank You Page Customizer for WooCommerce  Increase Your Sales plugin <=1.0.13 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46813: Cross-Site Request Forgery (CSRF) vulnerability in Younes JFR. Advanced Database Cleaner plugin <=3.1.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46814: Cross-Site Request Forgery (CSRF) vulnerability in Pierre Lebedel Kodex Posts likes plugin <=2.4.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46815: Cross-Site Request Forgery (CSRF) vulnerability inLauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46816: Cross-Site Request Forgery (CSRF) vulnerability in Booking Ultra Pro Appointments Booking Calendar Plugin plugin <=1.1.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46817: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Flyzoo Flyzoo Chat plugin <=2.3.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-46818: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Gopi Ramasamy Email posts to subscribers allows SQL Injection.This issue affects Email posts to subscribers: from n/a through 6.2.
Key phrases: subscribers: from n/a through 6.2, sql command, sql injection
CVE-2022-46819: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Gopi Ramasamy Continuous announcement scroller plugin <=13.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-4682: The Lightbox Gallery WordPress plugin before 0.9.5 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks
Key phrases: perform Stored Cross-Site Scripting attacks, stored cross-site scripting
CVE-2022-46820: Cross-Site Request Forgery (CSRF) vulnerability in WPJoli Joli Table Of Contents plugin <=1.3.9 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46821: Improper Neutralization of Formula Elements in a CSV File vulnerability in Jackmail & Sarbacane Emails & Newsletters with Jackmail.This issue affects Emails & Newsletters with Jackmail: from n/a through 1.2.22.
Key phrases: improper neutralization of formula elements
CVE-2022-46822: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in JC Development Team WooCommerce JazzCash Gateway Plugin plugin <=2.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-46823: A vulnerability has been identified in Mendix SAML (Mendix 8 compatible) (All versions >= V2.3.0 < V2.3.4), Mendix SAML (Mendix 9 compatible, New Track) (All versions >= V3.3.0 < V3.3.9), Mendix SAML (Mendix 9 compatible, Upgrade Track) (All versions >= V3.3.0 < V3.3.8). The affected module is vulnerable to reflected cross-site scripting (XSS) attacks. This could allow an attacker to extract sensitive information by tricking users into accessing a malicious link.
Key phrases: extract sensitive information by tricking users into accessing, reflected cross-site scripting (xss)
CVE-2022-46824: In JetBrains IntelliJ IDEA before 2022.2.4 a buffer overflow in the fsnotifier daemon on macOS was possible.
Key phrases: buffer overflow
CVE-2022-46825: In JetBrains IntelliJ IDEA before 2022.3 the built-in web server leaked information about open projects.
Key phrases: leaked information, leak information
CVE-2022-46826: In JetBrains IntelliJ IDEA before 2022.3 the built-in web server allowed an arbitrary file to be read by exploiting a path traversal vulnerability.
Key phrases: path traversal, arbitrary file, arbitrary file read
CVE-2022-46827: In JetBrains IntelliJ IDEA before 2022.3 an XXE attack leading to SSRF via requests to custom plugin repositories was possible.
Key phrases: xxe, ssrf
CVE-2022-46828: In JetBrains IntelliJ IDEA before 2022.3 a DYLIB injection on macOS was possible.
Key phrases: dylib injection
CVE-2022-46829: In JetBrains JetBrains Gateway before 2022.3 a client could connect without a valid token if the host consented.
CVE-2022-4683: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: sensitive cookie
CVE-2022-46830: In JetBrains TeamCity between 2022.10 and 2022.10.1 a custom STS endpoint allowed internal port scanning.
Key phrases: custom sts endpoint, internal port scanning
CVE-2022-46831: In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators.
Key phrases: default credential provider chain
CVE-2022-46832: Use of a Broken or Risky Cryptographic Algorithm in SICK RFU62x firmware version < 2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
Key phrases: decrypt the encrypted data if the user requested
CVE-2022-46833: Use of a Broken or Risky Cryptographic Algorithm in SICK RFU63x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
Key phrases: decrypt the encrypted data if the user requested
CVE-2022-46834: Use of a Broken or Risky Cryptographic Algorithm in SICK RFU65x firmware version < v2.21 allows a low-privileged remote attacker to decrypt the encrypted data if the user requested weak cipher suites to be used for encryption via the SSH interface. The patch and installation procedure for the firmware update is available from the responsible SICK customer contact person.
Key phrases: decrypt the encrypted data if the user requested
CVE-2022-46835: IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6 allow access to arbitrary files in the application server filesystem due to a path traversal vulnerability in JavaServer Faces (JSF) 2.2.20 documented in CVE-2020-6950.
Key phrases: arbitrary files in the application server filesystem due, path traversal
CVE-2022-46836: PHP code injection in watolib auth.php and hosttags.php in Tribe29's Checkmk <= 2.1.0p10, Checkmk <= 2.0.0p27, and Checkmk <= 1.6.0p29 allows an attacker to inject and execute PHP code which will be executed upon request of the vulnerable component.
Key phrases: inject and execute PHP code which will be, php code injection
CVE-2022-46839: Unrestricted Upload of File with Dangerous Type vulnerability in JS Help Desk JS Help Desk  Best Help Desk & Support Plugin.This issue affects JS Help Desk  Best Help Desk & Support Plugin: from n/a through 2.7.1.
Key phrases: dangerous type
CVE-2022-4684: Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: improper access control
CVE-2022-46841: Cross-Site Request Forgery (CSRF) vulnerability in Soflyy Oxygen Builder plugin <=4.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46842: Cross-Site Request Forgery (CSRF) vulnerability inJS Help Desk plugin <= 2.7.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46843: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Le Van Toan Woocommerce Vietnam Checkout plugin <=2.0.4 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-46844: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in PixelGrade PixFields plugin <=0.7.0 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-46848: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Themeisle Visualizer: Tables and Charts Manager for WordPress plugin <=3.9.1 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-46849: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar Coming Soon Page  Responsive Coming Soon & Maintenance Mode allows SQL Injection.This issue affects Coming Soon Page  Responsive Coming Soon & Maintenance Mode: from n/a through 1.5.9.
Key phrases: SQL Injection, sql injection
CVE-2022-46850: Auth. (author+) Broken Access Control vulnerability leading to Arbitrary File Deletion in Nabil Lemsieh Easy Media Replace plugin <=0.1.3 versions.
Key phrases: broken access control, arbitrary file deletion
CVE-2022-46851: Cross-Site Request Forgery (CSRF) vulnerability in Brainstorm Force Starter Templates plugin <=3.1.20 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46852: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Table Builder plugin <=1.4.6 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-46853: Cross-Site Request Forgery (CSRF) vulnerability in RadiusTheme The Post Grid plugin <=5.0.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46854: Cross-Site Request Forgery (CSRF) vulnerability in Obox Themes Launchpad  Coming Soon & Maintenance Mode plugin <=1.0.13 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46855: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WP Darko Responsive Pricing Table plugin <=5.1.6 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-46856: Cross-Site Request Forgery (CSRF) vulnerability in ORION Woocommerce Products Designer plugin <=4.3.3 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46857: Cross-Site Request Forgery (CSRF) vulnerability in SiteAlert plugin <=1.9.7 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46858: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Amin A.Rezapour Product Specifications for Woocommerce plugin <=0.6.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-46859: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Spiffy Plugins Spiffy Calendar spiffy-calendar allows SQL Injection.This issue affects Spiffy Calendar: from n/a through 4.9.1.
Key phrases: SQL Injection, sql injection
CVE-2022-4686: Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: Bypass Through User-Controlled, Authorization Bypass, authorization bypass
CVE-2022-46860: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaizenCoders Short URL allows SQL Injection.This issue affects Short URL: from n/a through 1.6.4.
Key phrases: SQL Injection, sql command, sql injection
CVE-2022-46861: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Zia Imtiaz Custom Login Page Styler for WordPress plugin <=6.2 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-46862: Cross-Site Request Forgery (CSRF) vulnerability in ExpressTech Quiz And Survey Master  Best Quiz, Exam and Survey Plugin for WordPress plugin <=8.0.7 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46863: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Event Manager plugin <=9.6.4 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-46864: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Umair Saleem Woocommerce Custom Checkout Fields Editor With Drag & Drop plugin <=0.1 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-46865: Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Bulk Resize Media plugin <=1.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46866: Cross-Site Request Forgery (CSRF) vulnerability in Marty Thornley Import External Images plugin <=1.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46867: Cross-Site Request Forgery (CSRF) vulnerability in Chasil Universal Star Rating plugin <=2.1.0 version.
Key phrases: cross-site request forgery (csrf)
CVE-2022-46868: Local privilege escalation during recovery due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40173.
Key phrases: local privilege escalation
CVE-2022-46869: Local privilege escalation during installation due to improper soft link handling. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40278.
Key phrases: local privilege escalation
CVE-2022-4687: Incorrect Use of Privileged APIs in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: privileged apis
CVE-2022-46870: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers.This issue affects Apache Zeppelin before 0.8.2. Users are recommended to upgrade to a supported version of Zeppelin.
Key phrases: execute arbitrary javascript, execute arbitrary javascript in other users' browsers, improper neutralization of input during web page generation, cross-site scripting
CVE-2022-46871: An out of date library (libusrsctp) contained vulnerabilities that could potentially be exploited. This vulnerability affects Firefox < 108.
CVE-2022-46872: An attacker who compromised a content process could have partially escaped the sandbox to read arbitrary files via clipboard-related IPC messages.<br>*This bug only affects Thunderbird for Linux. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.
Key phrases: read arbitrary files
CVE-2022-46873: Because Firefox did not implement the <code>unsafe-hashes</code> CSP directive, an attacker who was able to inject markup into a page otherwise protected by a Content Security Policy may have been able to inject executable script. This would be severely constrained by the specified Content Security Policy of the document. This vulnerability affects Firefox < 108.
CVE-2022-46874: A file with a long filename could have had its filename truncated to remove the valid extension, leaving a malicious extension in its place. This could potentially led to user confusion and the execution of malicious code.<br/>*Note*: This issue was originally included in the advisories for Thunderbird 102.6, but a patch (specific to Thunderbird) was omitted, resulting in it actually being fixed in Thunderbird 102.6.1. This vulnerability affects Firefox < 108, Thunderbird < 102.6.1, Thunderbird < 102.6, and Firefox ESR < 102.6.
Key phrases: user confusion
CVE-2022-46875: The executable file warning was not presented when downloading .atloc and .ftploc files, which can run commands on a user's computer. <br>*Note: This issue only affected Mac OS operating systems. Other operating systems are unaffected.*. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.
Key phrases: executable file, run commands
CVE-2022-46877: By confusing the browser, the fullscreen notification could have been delayed or suppressed, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox < 108.
Key phrases: user confusion, spoofing
CVE-2022-46878: Mozilla developers Randell Jesup, Valentin Gosu, Olli Pettay, and the Mozilla Fuzzing Team reported memory safety bugs present in Thunderbird 102.5. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108, Firefox ESR < 102.6, and Thunderbird < 102.6.
Key phrases: run arbitrary code, memory safety bugs, memory corruption
CVE-2022-46879: Mozilla developers and community members Lukas Bernhard, Gabriele Svelto, Randell Jesup, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 107. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 108.
Key phrases: run arbitrary code, memory safety bugs, memory corruption
CVE-2022-4688: Improper Authorization in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: improper authorization
CVE-2022-46880: A missing check related to tex units could have led to a use-after-free and potentially exploitable crash.<br />*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 105. This vulnerability affects Firefox ESR < 102.6, Firefox < 105, and Thunderbird < 102.6.
Key phrases: use-after-free, exploitable crash, use after free
CVE-2022-46881: An optimization in WebGL was incorrect in some cases, and could have led to memory corruption and a potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after we better understood the impact of the issue. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106, Firefox ESR < 102.6, and Thunderbird < 102.6.
Key phrases: memory corruption, exploitable crash
CVE-2022-46882: A use-after-free in WebGL extensions could have led to a potentially exploitable crash. This vulnerability affects Firefox < 107, Firefox ESR < 102.6, and Thunderbird < 102.6.
Key phrases: use-after-free, exploitable crash, use after free
CVE-2022-46883: Mozilla developers Gabriele Svelto, Yulia Startsev, Andrew McCreight and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 106. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.<br />*Note*: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 107. This vulnerability affects Firefox < 107.
Key phrases: memory safety bugs, memory corruption, arbitrary code
CVE-2022-46884: A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time.  This could have lead to memory corruption or a potentially exploitable crash.*Note*: This advisory was added on December 13th, 2022 after discovering it was inadvertently left out of the original advisory. The fix was included in the original release of Firefox 106. This vulnerability affects Firefox < 106.
Key phrases: use-after-free, memory corruption, exploitable crash, use after free
CVE-2022-46885: Mozilla developers Timothy Nikkel, Ashley Hale, and the Mozilla Fuzzing Team reported memory safety bugs present in Firefox 105. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability affects Firefox < 106.
Key phrases: run arbitrary code, memory safety bugs, memory corruption
CVE-2022-46886: There exists an open redirect within the response list update functionality of ServiceNow. This allows attackers to redirect users to arbitrary domains when clicking on a URL within a service-now domain.
Key phrases: redirect users to arbitrary domains when clicking on, open redirect
CVE-2022-46887: Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delcheater parameter in cheaterbox.php; or the usernw parameter in nowarn.php.
Key phrases: execute arbitrary SQL commands, execute arbitrary SQL commands via the conuser[, sql injection, arbitrary sql commands
CVE-2022-46888: Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web script or HTML via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id parameter in /viewrequests.php.
Key phrases: inject arbitrary web script or HTML, inject arbitrary web script or HTML via the, reflective cross-site scripting (xss)
CVE-2022-46889: A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php.
Key phrases: inject arbitrary web script or HTML, permanently inject arbitrary web script or HTML via, cross-site scripting (xss)
CVE-2022-4689: Improper Access Control in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: improper access control
CVE-2022-46890: Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of checks performed by the /forums.php?action=post page).
Key phrases: edit any post in the forum (this, weak access control
CVE-2022-46891: An issue was discovered in the Arm Mali GPU Kernel Driver. There is a use-after-free. A non-privileged user can make improper GPU processing operations to gain access to already freed memory. This affects Midgard r13p0 through r32p0, Bifrost r1p0 through r40p0, and Valhall r19p0 through r40p0.
Key phrases: gain access, use-after-free, use after free
CVE-2022-46892: In Ampere AltraMax and Ampere Altra before 2.10c, improper access controls allows the OS to reinitialize a disabled root complex.
Key phrases: reinitialize a disabled root complex, improper access controls
CVE-2022-46898: An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal via the "restore SQL data" filename. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive that expects a SQL import file. The filename provided is not properly sanitized and allows for the inclusion of a path-traversal payload that can be used to escape the intended Vocera restoration directory. An attacker could exploit this vulnerability to point to a crafted ZIP archive that contains SQL commands that could be executed against the database.
Key phrases: escape the intended Vocera restoration directory, path traversal
CVE-2022-46899: An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Arbitrary File Upload. The BaseController class, that each of the service controllers derives from, allows for the upload of arbitrary files. If the HTTP request is a multipart/form-data POST request, any parameters with a filename entry will have their content written to a file in the Vocera upload-staging directory with the specified filename in the parameter.
Key phrases: Arbitrary File Upload, a file in the Vocera upload-staging, arbitrary file upload, to write files
CVE-2022-4690: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: cross-site scripting (xss)
CVE-2022-46900: An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is Path Traversal in the Task Exec filename. The Vocera Report Console contains various jobs that are executed on the server at specified intervals, e.g., backup, etc. An authenticated user has the ability to modify these entries and set the executable path and parameters.
Key phrases: path traversal
CVE-2022-46901: An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is an Access Control Violation for Database Operations. The Vocera Report Console contains a websocket interface that allows for the unauthenticated execution of various tasks and database functions. This includes system tasks, and backing up, loading, and clearing of the database.
Key phrases: for the unauthenticated execution of various tasks and, access control violation
CVE-2022-46902: An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8. There is a Path Traversal for an Unzip operation. The Vocera Report Console contains a websocket function that allows for the restoration of the database from a ZIP archive that expects a SQL import file. During the unzip operation, the code takes file paths from the ZIP archive and writes them to a Vocera temporary directory. Unfortunately, the code does not properly check if the file paths include directory traversal payloads that would escape the intended destination.
Key phrases: a Vocera temporary directory, path traversal, directory traversal payloads
CVE-2022-46903: Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Stored XSS.
Key phrases: inject arbitrary HTML tags, inject arbitrary HTML tags into the page processed, stored xss
CVE-2022-46904: Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Self-XSS.
Key phrases: inject arbitrary HTML tags, inject arbitrary HTML tags into the page processed, self-xss
CVE-2022-46905: Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an unauthenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Reflected XSS.
Key phrases: inject arbitrary HTML tags, inject arbitrary HTML tags into the page processed, reflected xss
CVE-2022-46906: Insufficient processing of user input in WebSoft HCM 2021.2.3.327 allows an authenticated attacker to inject arbitrary HTML tags into the page processed by the user's browser, including scripts in the JavaScript programming language, which leads to Reflected XSS.
Key phrases: inject arbitrary HTML tags, inject arbitrary HTML tags into the page processed, reflected xss
CVE-2022-46907: A carefully crafted request on several JSPWiki plugins could trigger an XSS vulnerability on Apache JSPWiki, which could allow the attacker to execute javascript in the victim's browser and get some sensitive information about the victim.  Apache JSPWiki users should upgrade to 2.12.0 or later.
Key phrases: execute javascript in the victim's browser and, xss, sensitive information
CVE-2022-46908: SQLite through 3.40.0, when relying on --safe for execution of an untrusted CLI script, does not properly implement the azProhibitedFunctions protection mechanism, and instead allows UDF functions such as WRITEFILE.
Key phrases: UDF functions such as WRITEFILE
CVE-2022-4691: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.0.
Key phrases: cross-site scripting (xss)