yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-21939: Sensitive Cookie Without 'HttpOnly' Flag vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Key phrases: the cookie, access
CVE-2022-2194: The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-21940: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute vulnerability in Johnson Controls System Configuration Tool (SCT) version 14 prior to 14.2.3 and version 15 prior to 15.0.3 could allow access to the cookie.
Key phrases: the cookie, access
CVE-2022-21941: All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.
Key phrases: the system, command injection, root access
CVE-2022-21944: A UNIX Symbolic Link (Symlink) Following vulnerability in the systemd service file for watchman of openSUSE Backports SLE-15-SP3, Factory allows local attackers to escalate to root. This issue affects: openSUSE Backports SLE-15-SP3 watchman versions prior to 4.9.0. openSUSE Factory watchman versions prior to 4.9.0-9.1.
Key phrases: escalate to root, unix symbolic link
CVE-2022-21945: A Insecure Temporary File vulnerability in cscreen of openSUSE Factory allows local attackers to cause DoS for cscreen and a system DoS for non-default systems. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.
Key phrases: cause DoS for cscreen and a system DoS, insecure temporary file, dos
CVE-2022-21946: A Incorrect Permission Assignment for Critical Resource vulnerability in the sudoers configuration in cscreen of openSUSE Factory allows any local users to gain the privileges of the tty and dialout groups and access and manipulate any running cscreen seesion. This issue affects: openSUSE Factory cscreen version 1.2-1.3 and prior versions.
Key phrases: gain the privileges, gain the privileges of the tty and dialout, incorrect permission assignment for critical resource, gain privileges
CVE-2022-21947: A Exposure of Resource to Wrong Sphere vulnerability in Rancher Desktop of SUSE allows attackers in the local network to connect to the Dashboard API (steve) to carry out arbitrary actions. This issue affects: SUSE Rancher Desktop versions prior to V.
Key phrases: connect to the Dashboard API (steve), exposure of resource, arbitrary actions
CVE-2022-21948: An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in paste allows remote attackers to place Javascript into SVG files. This issue affects: openSUSE paste paste version b57b9f87e303a3db9465776e657378e96845493b and prior versions.
Key phrases: place Javascript into SVG files, improper neutralization of input during web page generation, cross-site scripting
CVE-2022-21949: A Improper Restriction of XML External Entity Reference vulnerability in SUSE Open Build Service allows remote attackers to reference external entities in certain operations. This can be used to gain information from the server that can be abused to escalate to Admin privileges on OBS. This issue affects: SUSE Open Build Service Open Build Service versions prior to 2.10.13.
Key phrases: gain information, reference external entities in certain operations, improper restriction of xml external entity reference
CVE-2022-21950: A Improper Access Control vulnerability in the systemd service of cana in openSUSE Backports SLE-15-SP3, openSUSE Backports SLE-15-SP4 allows local users to hijack the UNIX domain socket This issue affects: openSUSE Backports SLE-15-SP3 canna versions prior to canna-3.7p3-bp153.2.3.1. openSUSE Backports SLE-15-SP4 canna versions prior to 3.7p3-bp154.3.3.1. openSUSE Factory was also affected. Instead of fixing the package it was deleted there.
Key phrases: hijack the UNIX domain socket This issue affects, improper access control
CVE-2022-21951: A Cleartext Transmission of Sensitive Information vulnerability in SUSE Rancher, Rancher allows attackers on the network to read and change network data due to missing encryption of data transmitted via the network when a cluster is created from an RKE template with the CNI value overridden This issue affects: SUSE Rancher Rancher versions prior to 2.5.14; Rancher versions prior to 2.6.5.
Key phrases: read and change network data due to missing, cleartext transmission of sensitive information
CVE-2022-21952: A Missing Authentication for Critical Function vulnerability in spacewalk-java of SUSE Manager Server 4.1, SUSE Manager Server 4.2 allows remote attackers to easily exhaust available disk resources leading to DoS. This issue affects: SUSE Manager Server 4.1 spacewalk-java versions prior to 4.1.46. SUSE Manager Server 4.2 spacewalk-java versions prior to 4.2.37.
Key phrases: easily exhaust available disk resources leading to DoS., missing authentication for critical function, dos
CVE-2022-21953: A Missing Authorization vulnerability in of SUSE Rancher allows authenticated user to create an unauthorized shell pod and kubectl access in the local cluster This issue affects: SUSE Rancher Rancher versions prior to 2.5.17; Rancher versions prior to 2.6.10; Rancher versions prior to 2.7.1.
Key phrases: create an unauthorized shell pod and kubectl access, authorization
CVE-2022-21954: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21957: Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability
Key phrases: on-premises remote code execution
CVE-2022-21958: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21959: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-2196: A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks.L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPBafter running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit2e7eab81425a
Key phrases: speculative execution, spectre, code execution, execute code
CVE-2022-21960: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21961: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21962: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21963: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21964: Remote Desktop Licensing Diagnoser Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-21965: Microsoft Teams Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-21967: Xbox Live Auth Manager for Windows Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21968: Microsoft SharePoint Server Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2022-21969: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-2197: By using a specific credential string, an attacker with network access to the devices web interface could circumvent the authentication scheme and perform administrative operations.
Key phrases: network access
CVE-2022-21970: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21971: Windows Runtime Remote Code Execution Vulnerability
Key phrases: windows runtime remote code execution
CVE-2022-21972: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: windows point-to-point tunneling protocol remote code execution
CVE-2022-21973: Windows Media Center Update Denial of Service Vulnerability
Key phrases: windows media center update denial of service
CVE-2022-21974: Roaming Security Rights Management Services Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21975: Windows Hyper-V Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-21977: Media Foundation Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-21978: Microsoft Exchange Server Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21979: Microsoft Exchange Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-2198: The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced.
Key phrases: read other users private message using the message, brute forced
CVE-2022-21980: Microsoft Exchange Server Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21981: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21983: Win32 Stream Enumeration Remote Code Execution Vulnerability
Key phrases: stream enumeration, remote code execution
CVE-2022-21984: Windows DNS Server Remote Code Execution Vulnerability
Key phrases: windows dns server remote code execution
CVE-2022-21985: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-21986: .NET Denial of Service Vulnerability
Key phrases: .net denial of service
CVE-2022-21987: Microsoft SharePoint Server Spoofing Vulnerability
Key phrases: spoofing
CVE-2022-21988: Microsoft Office Visio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21989: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-2199: The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request.
Key phrases: gain control, gain control by tricking a user into making, reflected cross-site scripting
CVE-2022-21990: Remote Desktop Client Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21991: Visual Studio Code Remote Development Extension Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21992: Windows Mobile Device Management Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21993: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
Key phrases: driver information disclosure
CVE-2022-21994: Windows DWM Core Library Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21995: Windows Hyper-V Remote Code Execution Vulnerability
Key phrases: windows hyper-v remote code execution
CVE-2022-21996: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21997: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: windows print spooler elevation of privilege
CVE-2022-21998: Windows Common Log File System Driver Information Disclosure Vulnerability
Key phrases: windows common log file system driver information disclosure
CVE-2022-21999: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: windows print spooler elevation of privilege
CVE-2022-2200: If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11.
Key phrases: object prototype, privileged code execution
CVE-2022-22000: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-22001: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-22002: Windows User Account Profile Picture Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-22003: Microsoft Office Graphics Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22004: Microsoft Office ClickToRun Remote Code Execution Vulnerability
Key phrases: clicktorun remote code execution
CVE-2022-22005: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22006: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22007: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22008: Windows Hyper-V Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22009: Windows Hyper-V Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22010: Media Foundation Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-22011: Windows Graphics Component Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-22012: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22013: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22014: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22015: Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-22016: Windows PlayToManager Elevation of Privilege Vulnerability
Key phrases: windows playtomanager elevation of privilege
CVE-2022-22017: Remote Desktop Client Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22018: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22019: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22021: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22022: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-22023: Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2022-22024: Windows Fax Service Remote Code Execution Vulnerability
Key phrases: windows fax service remote code execution
CVE-2022-22025: Windows Internet Information Services Cachuri Module Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-22026: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-22027: Windows Fax Service Remote Code Execution Vulnerability
Key phrases: windows fax service remote code execution
CVE-2022-22028: Windows Network File System Information Disclosure Vulnerability
Key phrases: windows network file system information disclosure
CVE-2022-22029: Windows Network File System Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22031: Windows Credential Guard Domain-joined Public Key Elevation of Privilege Vulnerability
Key phrases: public key elevation of privilege
CVE-2022-22034: Windows Graphics Component Elevation of Privilege Vulnerability
Key phrases: windows graphics component elevation of privilege
CVE-2022-22035: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability
Key phrases: windows point-to-point tunneling protocol remote code execution
CVE-2022-22036: Performance Counters for Windows Elevation of Privilege Vulnerability
Key phrases: performance counters, windows elevation of privilege
CVE-2022-22037: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Key phrases: windows advanced local procedure call (alpc) elevation of privilege
CVE-2022-22038: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22039: Windows Network File System Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-22040: Internet Information Services Dynamic Compression Module Denial of Service Vulnerability
Key phrases: dynamic compression module, denial of service
CVE-2022-22041: Windows Print Spooler Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-22042: Windows Hyper-V Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-22043: Windows Fast FAT File System Driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-22045: Windows.Devices.Picker.dll Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-22047: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-22048: BitLocker Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, bitlocker security feature bypass
CVE-2022-22049: Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-22050: Windows Fax Service Elevation of Privilege Vulnerability
Key phrases: windows fax service elevation of privilege
CVE-2022-22054: ASUS RT-AX56Us login function contains a path traversal vulnerability due to its inadequate filtering for special characters in URL parameters, which allows an unauthenticated local area network attacker to access restricted system paths and download arbitrary files.
Key phrases: download arbitrary files, access restricted system paths and download arbitrary files, path traversal
CVE-2022-22055: The Le-yan dental management system contains an SQL-injection vulnerability. An unauthenticated remote attacker can inject SQL commands into the input field of the login page to acquire administrators privilege and perform arbitrary operations on the system or disrupt service.
Key phrases: perform arbitrary operations, sql-injection, disrupt service
CVE-2022-22056: The Le-yan dental management system contains a hard-coded credentials vulnerability in the web page source code, which allows an unauthenticated remote attacker to acquire administrators privilege and control the system or disrupt service.
Key phrases: acquire administrators privilege and control the system or, hard-coded credentials, disrupt service, hard coded credentials
CVE-2022-22057: Use after free in graphics fence due to a race condition while closing fence file descriptor and destroy graphics timeline simultaneously in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Key phrases: use after free, race condition
CVE-2022-22058: Memory corruption due to use after free issue in kernel while processing ION handles in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: memory corruption, use after free issue
CVE-2022-22059: Memory corruption due to out of bound read while parsing a video file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Key phrases: memory corruption, out of bound read
CVE-2022-2206: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
Key phrases: out-of-bounds read
CVE-2022-22060: Assertion occurs while processing Reconfiguration message due to improper validation
Key phrases: assertion, improper validation
CVE-2022-22061: Out of bounds writing is possible while verifying device IDs due to improper length check before copying the data in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
Key phrases: out of bounds writing, out of bounds write
CVE-2022-22062: An out-of-bounds read can occur while parsing a server certificate due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon IoT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables, Snapdragon Wired Infrastructure and Networking
Key phrases: out-of-bounds read, out of bounds read
CVE-2022-22063: Memory corruption in Core due to improper configuration in boot remapper.
Key phrases: memory corruption
CVE-2022-22064: Possible buffer over read due to lack of size validation while unpacking frame in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: buffer over read
CVE-2022-22065: Out of bound read in WLAN HOST due to improper length check can lead to DOS in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: out of bound read, improper length check, dos
CVE-2022-22066: Memory corruption occurs while processing command received from HLOS due to improper length check in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: memory corruption
CVE-2022-22067: Potential memory leak in modem during the processing of NSA RRC Reconfiguration with invalid Radio Bearer Config in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
Key phrases: memory leak
CVE-2022-22068: kernel event may contain unexpected content which is not generated by NPU software in asynchronous execution mode in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: kernel event
CVE-2022-22069: Devices with keyprotect off may store unencrypted keybox in RPMB and cause cryptographic issue in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Key phrases: unencrypted keybox, cryptographic issue
CVE-2022-2207: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Key phrases: heap-based buffer overflow
CVE-2022-22070: Memory corruption in audio due to lack of check of invalid routing address into APR Routing table in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: memory corruption
CVE-2022-22071: Possible use after free when process shell memory is freed using IOCTL munmap call and process initialization is in progress in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Key phrases: use after free
CVE-2022-22072: Buffer overflow can occur due to improper validation of NDP application information length in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Key phrases: buffer overflow
CVE-2022-22074: Memory Corruption during wma file playback due to integer overflow in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: memory corruption, integer overflow
CVE-2022-22075: Information Disclosure in Graphics during GPU context switch.
Key phrases: information disclosure
CVE-2022-22076: information disclosure due to cryptographic issue in Core during RPMB read request.
Key phrases: information disclosure, cryptographic issue
CVE-2022-22077: Memory corruption in graphics due to use-after-free in graphics dispatcher logic in Snapdragon Mobile
Key phrases: memory corruption, use-after-free, use after free
CVE-2022-22078: Denial of service in BOOT when partition size for a particular partition is requested due to integer overflow when blocks are calculated in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Key phrases: denial of service, integer overflow
CVE-2022-22079: Denial of service while processing fastboot flash command on mmc due to buffer over read
Key phrases: denial of service, buffer over read
CVE-2022-2208: NULL Pointer Dereference in GitHub repository vim/vim prior to 8.2.5163.
Key phrases: null pointer dereference
CVE-2022-22080: Improper validation of backend id in PCM routing process can lead to memory corruption in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music
Key phrases: improper validation of backend id, memory corruption
CVE-2022-22081: Memory corruption in audio module due to integer overflow in Snapdragon Auto, Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables
Key phrases: memory corruption, integer overflow
CVE-2022-22082: Memory corruption due to possible buffer overflow while parsing DSF header with corrupted channel count in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: memory corruption, buffer overflow
CVE-2022-22083: Denial of service due to memory corruption while extracting ape header from clips in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: denial of service, memory corruption
CVE-2022-22084: Memory corruption when extracting qcp audio file due to lack of check on data length in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: memory corruption
CVE-2022-22085: Memory corruption in video due to buffer overflow while reading the dts file in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: memory corruption, buffer overflow
CVE-2022-22086: Memory corruption in video due to double free while parsing 3gp clip with invalid meta data atoms in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: memory corruption, double free
CVE-2022-22087: memory corruption in video due to buffer overflow while parsing mkv clip with no codechecker in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Voice & Music, Snapdragon Wearables
Key phrases: memory corruption, buffer overflow
CVE-2022-22088: Memory corruption in Bluetooth HOST due to buffer overflow while parsing the command response received from remote
Key phrases: memory corruption, buffer overflow
CVE-2022-22089: Memory corruption in audio while playing record due to improper list handling in two threads in Snapdragon Connectivity, Snapdragon Mobile, Snapdragon Wearables
Key phrases: memory corruption
CVE-2022-22090: Memory corruption in audio due to use after free while managing buffers from internal cache in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Mobile
Key phrases: memory corruption, use after free
CVE-2022-22091: Improper authorization of a replayed LTE security mode command can lead to a denial of service in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon Wearables
Key phrases: improper authorization, denial of service
CVE-2022-22092: Memory corruption in kernel due to use after free issue in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Key phrases: memory corruption, use after free issue
CVE-2022-22093: Memory corruption or temporary denial of service due to improper handling of concurrent hypervisor operations to attach or detach IRQs from virtual interrupt sources in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Key phrases: memory corruption, temporary denial of service
CVE-2022-22094: memory corruption in Kernel due to race condition while getting mapping reference in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Key phrases: memory corruption, race condition
CVE-2022-22095: Memory corruption in synx driver due to use-after-free condition in the synx driver due to accessing object handles without acquiring lock in Snapdragon Compute, Snapdragon Connectivity, Snapdragon Industrial IOT, Snapdragon Mobile
Key phrases: memory corruption, use-after-free condition, use after free
CVE-2022-22096: Memory corruption in Bluetooth HOST due to stack-based buffer overflow when when extracting data using command length parameter in Snapdragon Connectivity, Snapdragon Mobile
Key phrases: memory corruption, stack-based buffer overflow, stack based buffer overflow
CVE-2022-22097: Memory corruption in graphic driver due to use after free while calling multiple threads application to driver. in Snapdragon Consumer IOT
Key phrases: memory corruption, use after free
CVE-2022-22098: Memory corruption in multimedia driver due to untrusted pointer dereference while reading data from socket in Snapdragon Auto
Key phrases: memory corruption, untrusted pointer dereference
CVE-2022-22099: Memory corruption in multimedia due to improper validation of array index in Snapdragon Auto
Key phrases: memory corruption
CVE-2022-2210: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.
Key phrases: out-of-bounds write
CVE-2022-22100: Memory corruption in multimedia due to improper check on received export descriptors in Snapdragon Auto
Key phrases: memory corruption
CVE-2022-22101: Denial of service in multimedia due to uncontrolled resource consumption while parsing an incoming HAB message in Snapdragon Auto
Key phrases: denial of service, uncontrolled resource consumption
CVE-2022-22102: Memory corruption in multimedia due to incorrect type conversion while adding data in Snapdragon Auto
Key phrases: memory corruption
CVE-2022-22103: Memory corruption in multimedia driver due to double free while processing data from user in Snapdragon Auto
Key phrases: memory corruption, double free
CVE-2022-22104: Memory corruption in multimedia due to improper check on the messages received. in Snapdragon Auto
Key phrases: memory corruption
CVE-2022-22105: Memory corruption in bluetooth due to integer overflow while processing HFP-UNIT profile in Snapdragon Auto, Snapdragon Consumer IOT, Snapdragon Mobile, Snapdragon Voice & Music
Key phrases: memory corruption, integer overflow
CVE-2022-22106: Memory corruption in multimedia due to improper length check while copying the data in Snapdragon Auto
Key phrases: memory corruption
CVE-2022-22107: In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the appointments of all users in the system including administrators. However, this type of user is not authorized to view the calendar at all.
Key phrases: missing authorization
CVE-2022-22108: In Daybyday CRM, versions 2.0.0 through 2.2.0 are vulnerable to Missing Authorization. An attacker that has the lowest privileges account (employee type user), can view the absences of all users in the system including administrators. This type of user is not authorized to view this kind of information.
Key phrases: missing authorization
CVE-2022-22109: In Daybyday CRM, version 2.2.0 is vulnerable to Stored Cross-Site Scripting (XSS) vulnerability that allows low privileged application users to store malicious scripts in the title field of new tasks. These scripts are executed in a victims browser when they open the /tasks page to view all the tasks.
Key phrases: store malicious scripts in the title field of, stored cross-site scripting (xss)
CVE-2022-2211: A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or malicious actor.
Key phrases: denial of service
CVE-2022-22110: In Daybyday CRM, versions 1.1 through 2.2.0 enforce weak password requirements in the user update functionality. A user with privileges to update his password could change it to a weak password, such as those with a length of a single character. This may allow an attacker to brute-force users passwords with minimal to no computational effort.
Key phrases: brute-force users passwords with minimal to, weak password
CVE-2022-22111: In DayByDay CRM, version 2.2.0 is vulnerable to missing authorization. Any application user in the application who has update user permission enabled is able to change the password of other users, including the administrators. This allows the attacker to gain access to the highest privileged user in the application.
Key phrases: gain access, gain access to the highest privileged user in, missing authorization
CVE-2022-22112: In DayByDay CRM, versions 1.1 through 2.2.1 (latest) suffer from an application-wide Client-Side Template Injection (CSTI). A low privileged attacker can input template injection payloads in the application at various locations to execute JavaScript on the client browser.
Key phrases: client-side template injection (csti)
CVE-2022-22113: In DayByDay CRM, versions 2.2.0 through 2.2.1 (latest) are vulnerable to Insufficient Session Expiration. When a password has been changed by the user or by an administrator, a user that was already logged in, will still have access to the application even after the password was changed.
Key phrases: insufficient session expiration
CVE-2022-22114: In Teedy, versions v1.5 through v1.9 are vulnerable to Reflected Cross-Site Scripting (XSS). The search term" search functionality is not sufficiently sanitized while displaying the results of the search, which can be leveraged to inject arbitrary scripts. These scripts are executed in a victims browser when they enter the crafted URL. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, by an unauthenticated attacker.
Key phrases: inject arbitrary scripts, reflected cross-site scripting (xss), account takeover
CVE-2022-22115: In Teedy, versions v1.5 through v1.9 are vulnerable to Stored Cross-Site Scripting (XSS) in the name of a created Tag. Since the Tag name is not being sanitized properly in the edit tag page, a low privileged attacker can store malicious scripts in the name of the Tag. In the worst case, the victim who inadvertently triggers the attack is a highly privileged administrator. The injected scripts can extract the Session ID, which can lead to full Account Takeover of the administrator, and privileges escalation.
Key phrases: stored cross-site scripting (xss), account takeover, privileges escalation, privilege escalation
CVE-2022-22116: In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victims browser when they open the image URL.
Key phrases: inject arbitrary javascript code, stored cross-site scripting (xss), file upload
CVE-2022-22117: In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered.
Key phrases: Cross-Site Scripting vulnerability, cross-site scripting, xss payload, unrestricted file upload
CVE-2022-2212: A vulnerability was found in SourceCodester Library Management System 1.0. It has been classified as critical. Affected is an unknown function of the component /card/index.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Key phrases: unrestricted upload
CVE-2022-22120: In NocoDB, versions 0.9 to 0.83.8 are vulnerable to Observable Discrepancy in the password-reset feature. When requesting a password reset for a given email address, the application displays an error message when the email isn't registered within the system. This allows attackers to enumerate the registered users' email addresses.
Key phrases: enumerate the registered users' email addresses, observable discrepancy
CVE-2022-22121: In NocoDB, versions 0.81.0 through 0.83.8 are affected by CSV Injection vulnerability (Formula Injection). A low privileged attacker can create a new table to inject payloads in the table rows. When an administrator accesses the User Management endpoint and exports the data as a CSV file and opens it, the payload gets executed.
Key phrases: csv injection, formula injection
CVE-2022-22123: In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arbitrary javascript code that will execute on a victims server.
Key phrases: inject arbitrary javascript code, stored cross-site scripting (xss), victims server
CVE-2022-22124: In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a carefully crafted SVG file that will trigger arbitrary javascript to run on a victims browser.
Key phrases: trigger arbitrary javascript, stored cross-site scripting (xss)
CVE-2022-22125: In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article tag. An authenticated admin attacker can inject arbitrary javascript code that will execute on a victims server.
Key phrases: inject arbitrary javascript code, stored cross-site scripting (xss), victims server
CVE-2022-22126: Openmct versions 1.3.0 to 1.7.7 are vulnerable against stored XSS via the Web Page element, that allows the injection of malicious JavaScript into the URL field. This issue affects: nasa openmct 1.7.7 version and prior versions; 1.3.0 version and later versions.
Key phrases: the injection of malicious JavaScript into the URL, xss
CVE-2022-22127: Tableau is aware of a broken access control vulnerability present in Tableau Server affecting Tableau Server customers using Local Identity Store for managing users. The vulnerability allows a malicious site administrator to change passwords for users in different sites hosted on the same Tableau Server, resulting in the potential for unauthorized access to data.Tableau Server versions affected are:2020.4.16, 2021.1.13, 2021.2.10, 2021.3.9, 2021.4.4 and earlierNote: All future releases of Tableau Server will address this security issue. Versions that are no longer supported are not tested and may be vulnerable.
Key phrases: change passwords for users in different sites hosted, broken access control, unauthorized access
CVE-2022-22128: Tableau discovered a path traversal vulnerability affecting Tableau Server Administration Agents internal file transfer service that could allow remote code execution.Tableau only supports product versions for 24 months after release. Older versions have reached their End of Life and are no longer supported. They are also not assessed for potential security issues and do not receive security updates.
Key phrases: remote code execution, path traversal
CVE-2022-2213: A vulnerability was found in SourceCodester Library Management System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/edit_admin_details.php?id=admin. The manipulation of the argument Name leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
CVE-2022-22137: A memory corruption vulnerability exists in the ioca_mys_rgb_allocate functionality of Accusoft ImageGear 19.10. A specially-crafted malformed file can lead to an arbitrary free. An attacker can provide a malicious file to trigger this vulnerability.
Key phrases: memory corruption, malicious file
CVE-2022-22138: All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. One can cause the V8 to attempt reading from non-permitted locations and cause a segmentation fault due to the violation.
Key phrases: Denial of Service (DoS), denial of service (dos), segmentation fault
CVE-2022-22139: Uncontrolled search path in the Intel(R) XTU software before version 7.3.0.33 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path, escalation privilege
CVE-2022-2214: A vulnerability was found in SourceCodester Library Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /librarian/bookdetails.php. The manipulation of the argument id with the input ' AND (SELECT 9198 FROM (SELECT(SLEEP(5)))iqZA)-- PbtB leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Key phrases: sql injection
CVE-2022-22140: An os command injection vulnerability exists in the confsrv ucloud_add_node functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a malicious packet to trigger this vulnerability.
Key phrases: os command injection, arbitrary command execution, malicious packet, arbitrary commands
CVE-2022-22141: 'Long-term Data Archive Package' service implemented in the following Yokogawa Electric products creates some named pipe with imporper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
Key phrases: long-term data archive package
CVE-2022-22142: Reflected cross-site scripting vulnerability in the checkbox of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
Key phrases: inject an arbitrary script via unspecified vectors, reflected cross-site scripting
CVE-2022-22143: The package convict before 6.2.2 are vulnerable to Prototype Pollution via the convict function due to missing validation of parentKey. **Note:** This vulnerability derives from an incomplete fix of another [vulnerability](https://security.snyk.io/vuln/SNYK-JS-CONVICT-1062508)
Key phrases: prototype pollution
CVE-2022-22144: A hard-coded password vulnerability exists in the libcommonprod.so prod_change_root_passwd functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_14. During system startup this functionality is always called, leading to a known root password. An attacker does not have to do anything to trigger this vulnerability.
Key phrases: hard-coded password, hard coded password
CVE-2022-22145: CAMS for HIS Log Server contained in the following Yokogawa Electric products is vulnerable to uncontrolled resource consumption. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
Key phrases: uncontrolled resource consumption
CVE-2022-22146: Cross-site scripting vulnerability in TransmitMail 2.5.0 to 2.6.1 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
Key phrases: inject an arbitrary script via unspecified vectors, cross-site scripting
CVE-2022-22148: 'Root Service' service implemented in the following Yokogawa Electric products creates some named pipe with improper ACL configuration. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
Key phrases: root service
CVE-2022-22149: A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. A specially-crafted HTTP request can cause SQL injection. An attacker can make an authenticated HTTP request to trigger this vulnerability.
Key phrases: sql injection
CVE-2022-2215: The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks when, stored cross-site scripting, unfiltered_html capability
CVE-2022-22150: A memory corruption vulnerability exists in the JavaScript engine of Foxit Softwares PDF Reader, version 11.1.0.52543. A specially-crafted PDF document can trigger an exception which is improperly handled, leaving the engine in an invalid state, which can lead to memory corruption and arbitrary code execution. An attacker needs to trick the user to open the malicious file to trigger this vulnerability. Exploitation is also possible if a user visits a specially-crafted, malicious site if the browser plugin extension is enabled.
Key phrases: memory corruption, arbitrary code execution
CVE-2022-22151: CAMS for HIS Log Server contained in the following Yokogawa Electric products fails to properly neutralize log outputs: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, and Exaopc versions from R3.72.00 to R3.79.00.
CVE-2022-22152: A Protection Mechanism Failure vulnerability in the REST API of Juniper Networks Contrail Service Orchestration allows one tenant on the system to view confidential configuration details of another tenant on the same system. By utilizing the REST API, one tenant is able to obtain information on another tenant's firewall configuration and access control policies, as well as other sensitive information, exposing the tenant to reduced defense against malicious attacks or exploitation via additional undetermined vulnerabilities. This issue affects Juniper Networks Contrail Service Orchestration versions prior to 6.1.0 Patch 3.
Key phrases: obtain information, view confidential configuration details of another tenant on, protection mechanism failure, reduced defense, undetermined, sensitive information