yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-21750: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06521283; Issue ID: ALPS06521283.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21751: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06511132; Issue ID: ALPS06511132.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21752: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06493873; Issue ID: ALPS06493873.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21753: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06493873; Issue ID: ALPS06493899.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21754: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06535953; Issue ID: ALPS06535953.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21755: In WLAN driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06545464; Issue ID: ALPS06545464.
Key phrases: out of bounds read, incorrect bounds check, local information disclosure
CVE-2022-21756: In WLAN driver, there is a possible out of bounds read due to an incorrect bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06535950; Issue ID: ALPS06535950.
Key phrases: out of bounds read, incorrect bounds check, local information disclosure
CVE-2022-21757: In WIFI Firmware, there is a possible system crash due to a missing count check. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06468894; Issue ID: ALPS06468894.
Key phrases: missing count check, remote denial of service, crash
CVE-2022-21758: In ccu, there is a possible memory corruption due to a double free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06439600; Issue ID: ALPS06439600.
Key phrases: memory corruption, double free, local escalation of privilege, escalation privilege
CVE-2022-21759: In power service, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06419106; Issue ID: ALPS06419077.
Key phrases: out of bounds write, missing bounds check, escalation privilege
CVE-2022-21760: In apusys driver, there is a possible system crash due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479562; Issue ID: ALPS06479562.
Key phrases: integer overflow, local denial of service, crash
CVE-2022-21761: In apusys driver, there is a possible system crash due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479532; Issue ID: ALPS06479532.
Key phrases: integer overflow, local denial of service, crash
CVE-2022-21762: In apusys driver, there is a possible system crash due to an integer overflow. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06477946; Issue ID: ALPS06477946.
Key phrases: integer overflow, local denial of service, crash
CVE-2022-21763: In telecom service, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07044717; Issue ID: ALPS07044708.
Key phrases: information disclosure
CVE-2022-21764: In telecom service, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07044717; Issue ID: ALPS07044717.
Key phrases: information disclosure
CVE-2022-21765: In CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06641673; Issue ID: ALPS06641673.
Key phrases: out of bounds write, missing bounds check, escalation privilege
CVE-2022-21766: In CCCI, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06641673; Issue ID: ALPS06641653.
Key phrases: out of bounds write, missing bounds check, escalation privilege
CVE-2022-21767: In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784430; Issue ID: ALPS06784430.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21768: In Bluetooth, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06784351; Issue ID: ALPS06784351.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21769: In CCCI, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06641673; Issue ID: ALPS06641687.
Key phrases: out of bounds read, missing bounds check, local information disclosure
CVE-2022-2177: Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2.
CVE-2022-21770: In sound driver, there is a possible information disclosure due to symlink following. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558663; Issue ID: ALPS06558663.
Key phrases: information disclosure
CVE-2022-21771: In GED driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06641585; Issue ID: ALPS06641585.
Key phrases: use after free, race condition, local escalation of privilege, escalation privilege
CVE-2022-21772: In TEEI driver, there is a possible type confusion due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06493842; Issue ID: ALPS06493842.
Key phrases: type confusion, race condition, local escalation of privilege, escalation privilege
CVE-2022-21773: In TEEI driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06641388; Issue ID: ALPS06641388.
Key phrases: use after free, race condition, local escalation of privilege, escalation privilege
CVE-2022-21774: In TEEI driver, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06641447; Issue ID: ALPS06641447.
Key phrases: use after free, race condition, local escalation of privilege, escalation privilege
CVE-2022-21775: In sched driver, there is a possible use after free due to improper locking. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479032; Issue ID: ALPS06479032.
Key phrases: use after free, improper locking, local escalation of privilege, escalation privilege
CVE-2022-21776: In MDP, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06545450; Issue ID: ALPS06545450.
Key phrases: use after free, race condition, local escalation of privilege, escalation privilege
CVE-2022-21777: In Autoboot, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06713894; Issue ID: ALPS06713894.
Key phrases: bypass due to a missing permission, permission bypass, local escalation of privilege, escalation privilege
CVE-2022-21778: In vpu, there is a possible information disclosure due to an incorrect bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06382421; Issue ID: ALPS06382421.
Key phrases: information disclosure, local escalation of privilege, escalation privilege
CVE-2022-21779: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06704526; Issue ID: ALPS06704393.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-2178: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saysis Computer Starcities allows Cross-Site Scripting (XSS).This issue affects Starcities: before 1.1.
Key phrases: Cross-Site Scripting (XSS).This issue affects, improper neutralization of input during web page generation, cross-site scripting
CVE-2022-21780: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06704526; Issue ID: ALPS06704526.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21781: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06704526; Issue ID: ALPS06704433.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21782: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06704526; Issue ID: ALPS06704508.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21783: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06704526; Issue ID: ALPS06704482.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21784: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06704526; Issue ID: ALPS06704462.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21785: In WLAN driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06807363; Issue ID: ALPS06807363.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21786: In audio DSP, there is a possible memory corruption due to improper casting. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558822; Issue ID: ALPS06558822.
Key phrases: memory corruption, local escalation of privilege, escalation privilege
CVE-2022-21787: In audio DSP, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06558844; Issue ID: ALPS06558844.
Key phrases: out of bounds write, missing bounds check, escalation privilege
CVE-2022-21788: In scp, there is a possible undefined behavior due to incorrect error handling. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06988728; Issue ID: ALPS06988728.
Key phrases: undefined behavior, local escalation of privilege, escalation privilege
CVE-2022-21789: In audio ipi, there is a possible memory corruption due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478101; Issue ID: ALPS06478101.
Key phrases: memory corruption, race condition, local escalation of privilege, escalation privilege
CVE-2022-2179: The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks.
Key phrases: clickjacking attacks
CVE-2022-21790: In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06479306; Issue ID: ALPS06479306.
Key phrases: out of bounds read, missing bounds check, local information disclosure
CVE-2022-21791: In camera isp, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS06478059; Issue ID: ALPS06478059.
Key phrases: out of bounds read, missing bounds check, local information disclosure
CVE-2022-21792: In camera isp, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07085410; Issue ID: ALPS07085410.
Key phrases: out of bounds write, missing bounds check, local escalation of privilege, escalation privilege
CVE-2022-21793: Insufficient control flow management in the Intel(R) Ethernet 500 Series Controller drivers for VMWare before version 1.11.4.0 and in the Intel(R) Ethernet 700 Series Controller drivers for VMWare before version 2.1.5.0 may allow an authenticated user to potentially enable a denial of service via local access.
Key phrases: potentially enable a denial of service via local, insufficient control flow management, local access
CVE-2022-21794: Improper authentication in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Business, Intel(R) NUC Enthusiast, Intel(R) NUC Kits before version HN0067 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper authentication, escalation privilege
CVE-2022-21796: A memory corruption vulnerability exists in the netserver parse_command_list functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted HTTP request can lead to an out-of-bounds write. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: memory corruption, out-of-bounds write, out of bounds write
CVE-2022-21797: The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary Code Execution via the pre_dispatch flag in Parallel() class due to the eval() statement.
Key phrases: arbitrary code execution
CVE-2022-21798: The affected product is vulnerable due to cleartext transmission of credentials seen in the CIMPLICITY network, which can be easily spoofed and used to log in to make operational changes to the system.
Key phrases: cleartext transmission of credentials, operational changes, spoofing
CVE-2022-21799: Cross-site scripting vulnerability in ELECOM LAN router WRC-300FEBK-R firmware v1.13 and earlier allows an attacker on the adjacent network to inject an arbitrary script via unspecified vectors.
Key phrases: inject an arbitrary script via unspecified vectors, cross-site scripting
CVE-2022-2180: The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE).
Key phrases: upload arbitrary files, upload arbitrary files including php source files, remote code execution (rce)
CVE-2022-21800: MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed passwords.
Key phrases: crack
CVE-2022-21801: A denial of service vulnerability exists in the netserver recv_command functionality of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted network request can lead to a reboot. An attacker can send a malicious packet to trigger this vulnerability.
Key phrases: denial of service, reboot, malicious packet
CVE-2022-21802: The package grapesjs before 0.19.5 are vulnerable to Cross-site Scripting (XSS) due to an improper sanitization of the class name in Selector Manager.
Key phrases: cross-site scripting (xss)
CVE-2022-21803: This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Key phrases: prototype pollution
CVE-2022-21804: Out-of-bounds write in software for the Intel QAT Driver for Windows before version 1.9.0-0008 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, out-of-bounds write in software, out of bounds write, escalation privilege
CVE-2022-21805: Reflected cross-site scripting vulnerability in the attached file name of php_mailform versions prior to Version 1.40 allows a remote unauthenticated attacker to inject an arbitrary script via unspecified vectors.
Key phrases: inject an arbitrary script via unspecified vectors, reflected cross-site scripting
CVE-2022-21806: A use-after-free vulnerability exists in the mips_collector appsrv_server functionality of Anker Eufy Homebase 2 2.1.8.5h. A specially-crafted set of network packets can lead to remote code execution. The device is exposed to attacks from the network.
Key phrases: use-after-free, remote code execution, use after free
CVE-2022-21807: Uncontrolled search path elements in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, uncontrolled search path elements, escalation privilege
CVE-2022-21808: Path traversal vulnerability exists in CAMS for HIS Server contained in the following Yokogawa Electric products: CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00.
Key phrases: path traversal
CVE-2022-21809: A file write vulnerability exists in the httpd upload.cgi functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary file upload. An attacker can upload a malicious file to trigger this vulnerability.
Key phrases: file write, arbitrary file, arbitrary file upload
CVE-2022-2181: The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting
Key phrases: reflected cross-site scripting
CVE-2022-21810: All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.
Key phrases: command injection
CVE-2022-21812: Improper access control in the Intel(R) HAXM software before version 7.7.1 may allow an authenticated user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper access control, escalation privilege
CVE-2022-21813: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.
Key phrases: protected memory, denial of service
CVE-2022-21814: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel driver package, where improper handling of insufficient permissions or privileges may allow an unprivileged local user limited write access to protected memory, which can lead to denial of service.
Key phrases: protected memory, denial of service
CVE-2022-21815: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for private IOCTLs where a NULL pointer dereference in the kernel, created within user mode code, may lead to a denial of service in the form of a system crash.
Key phrases: null pointer dereference, denial of service, system crash
CVE-2022-21816: NVIDIA vGPU software contains a vulnerability in the Virtual GPU Manager (nvidia.ko), where a user in the guest OS can cause a GPU interrupt storm on the hypervisor host, leading to a denial of service.
Key phrases: denial of service
CVE-2022-21817: NVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing (CORS) vulnerability which can allow an unprivileged remote attacker, if they can get user to browse malicious site, to acquire access tokens allowing them to access resources in other security domains, which may lead to code execution, escalation of privileges, and impact to confidentiality and integrity.
Key phrases: browse malicious site, access resources in other security domains, cross-origin resource sharing (cors), confidentiality and integrity, code execution, escalation privilege
CVE-2022-21818: NVIDIA License System contains a vulnerability in the installation scripts for the DLS virtual appliance, where a user on a network after signing in to the portal can access other users credentials, allowing them to gain escalated privileges, resulting in limited impact to both confidentiality and integrity.
Key phrases: gain escalated privileges, limited impact, escalate privilege, confidentiality, confidentiality and integrity
CVE-2022-21819: NVIDIA distributions of Jetson Linux contain a vulnerability where an error in the IOMMU configuration may allow an unprivileged attacker with physical access to the board direct read/write access to the entire system address space through the PCI bus. Such an attack could result in denial of service, code execution, escalation of privileges, and impact to data integrity and confidentiality. The scope impact may extend to other components.
Key phrases: the board direct read/write access to, iommu configuration, denial of service, escalation of privileges, scope impact, code execution, escalation privilege, integrity, confidentiality
CVE-2022-2182: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Key phrases: heap-based buffer overflow
CVE-2022-21820: NVIDIA DCGM contains a vulnerability in nvhostengine, where a network user can cause detection of error conditions without action, which may lead to limited code execution, some denial of service, escalation of privileges, and limited impacts to both data confidentiality and integrity.
Key phrases: denial of service, escalation of privileges, code execution, escalation privilege, confidentiality, confidentiality and integrity
CVE-2022-21821: NVIDIA CUDA Toolkit SDK contains an integer overflow vulnerability in cuobjdump.To exploit this vulnerability, a remote attacker would require a local user to download a specially crafted, corrupted file and locally execute cuobjdump against the file. Such an attack may lead to remote code execution that causes complete denial of service and an impact on data confidentiality and integrity.
Key phrases: integer overflow, denial of service, data confidentiality and integrity, remote code execution
CVE-2022-21822: NVIDIA FLARE contains a vulnerability in the admin interface, where an un-authorized attacker can cause Allocation of Resources Without Limits or Throttling, which may lead to cause system unavailable.
Key phrases: nvidia flare, system unavailable
CVE-2022-21823: A insecure storage of sensitive information vulnerability exists in Ivanti Workspace Control <2021.2 (10.7.30.0) that could allow an attacker with locally authenticated low privileges to obtain key information due to an unspecified attack vector.
Key phrases: obtain key information, obtain key information due to an unspecified attack, insecure storage of sensitive information, attack vector
CVE-2022-21824: Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which could be "__proto__". The prototype pollution has very limited control, in that it only allows an empty string to be assigned to numerical keys of the object prototype.Node.js >= 12.22.9, >= 14.18.3, >= 16.13.2, and >= 17.3.1 use a null protoype for the object these properties are being assigned to.
Key phrases: be passed to the "properties" parameter, be assigned to numerical keys of the object, prototype pollution
CVE-2022-21825: An Improper Access Control vulnerability exists in Citrix Workspace App for Linux 2012 - 2111 with App Protection installed that can allow an attacker to perform local privilege escalation.
Key phrases: perform local privilege escalation, improper access control
CVE-2022-21826: Pulse Secure version 9.115 and below may be susceptible to client-side http request smuggling, When the application receives a POST request, it ignores the request's Content-Length header and leaves the POST body on the TCP/TLS socket. This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS.
Key phrases: client-side http request smuggling, xss
CVE-2022-21827: An improper privilege vulnerability has been discovered in Citrix Gateway Plug-in for Windows (Citrix Secure Access for Windows) <21.9.1.2 what could allow an attacker who has gained local access to a computer with Citrix Gateway Plug-in installed, to corrupt or delete files as SYSTEM.
Key phrases: a computer with Citrix Gateway Plug-in, improper privilege, corrupt, delete files
CVE-2022-21828: A user with high privilege access to the Incapptic Connect web console can remotely execute code on the Incapptic Connect server using a unspecified attack vector in Incapptic Connect version 1.40.0, 1.39.1, 1.39.0, 1.38.1, 1.38.0, 1.37.1, 1.37.0, 1.36.0, 1.35.5, 1.35.4 and 1.35.3.
Key phrases: unspecified attack vector, execute code
CVE-2022-21829: Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing concrete_secure instead of concrete. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.
Key phrases: rce, execute code
CVE-2022-2183: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.
Key phrases: out-of-bounds read
CVE-2022-21830: A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in their chat instance.
Key phrases: trick a victim pasting malicious code in their, blind self xss
CVE-2022-21831: A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.
Key phrases: execute code via image_processing arguments, code injection
CVE-2022-21833: Virtual Machine IDE Drive Elevation of Privilege Vulnerability
Key phrases: virtual machine ide drive elevation of privilege
CVE-2022-21834: Windows User-mode Driver Framework Reflector Driver Elevation of Privilege Vulnerability
Key phrases: windows user-mode driver framework reflector driver elevation of privilege
CVE-2022-21835: Microsoft Cryptographic Services Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21836: Windows Certificate Spoofing Vulnerability
Key phrases: windows certificate spoofing
CVE-2022-21837: Microsoft SharePoint Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21838: Windows Cleanup Manager Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21839: Windows Event Tracing Discretionary Access Control List Denial of Service Vulnerability
Key phrases: discretionary access control list, denial of service
CVE-2022-2184: The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server.
Key phrases: run arbitrary code, sensitive require_once call, cross-site request forgery
CVE-2022-21840: Microsoft Office Remote Code Execution Vulnerability
Key phrases: microsoft office remote code execution
CVE-2022-21841: Microsoft Excel Remote Code Execution Vulnerability
Key phrases: microsoft excel remote code execution
CVE-2022-21842: Microsoft Word Remote Code Execution Vulnerability
Key phrases: microsoft word remote code execution
CVE-2022-21843: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21844: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21845: Windows Kernel Information Disclosure Vulnerability
Key phrases: windows kernel information disclosure
CVE-2022-21846: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21847: Windows Hyper-V Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-21848: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Key phrases: windows internet key exchange (ike) extension denial of service
CVE-2022-21849: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-2185: A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution.
Key phrases: critical issue, remote code execution
CVE-2022-21850: Remote Desktop Client Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21851: Remote Desktop Client Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21852: Windows DWM Core Library Elevation of Privilege Vulnerability
Key phrases: windows dwm core library elevation of privilege
CVE-2022-21855: Microsoft Exchange Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21857: Active Directory Domain Services Elevation of Privilege Vulnerability
Key phrases: active directory domain services elevation of privilege
CVE-2022-21858: Windows Bind Filter Driver Elevation of Privilege Vulnerability
Key phrases: windows bind filter driver elevation of privilege
CVE-2022-21859: Windows Accounts Control Elevation of Privilege Vulnerability
Key phrases: windows accounts control elevation of privilege
CVE-2022-2186: The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Key phrases: perform cross-Site Scripting attacks even when, cross-site scripting, unfiltered_html capability
CVE-2022-21860: Windows AppContracts API Server Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21861: Task Flow Data Engine Elevation of Privilege Vulnerability
Key phrases: task flow data engine elevation of privilege
CVE-2022-21862: Windows Application Model Core API Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21863: Windows StateRepository API Server file Elevation of Privilege Vulnerability
Key phrases: file elevation of privilege
CVE-2022-21864: Windows UI Immersive Server API Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21865: Connected Devices Platform Service Elevation of Privilege Vulnerability
Key phrases: connected devices platform service elevation of privilege
CVE-2022-21866: Windows System Launcher Elevation of Privilege Vulnerability
Key phrases: windows system launcher elevation of privilege
CVE-2022-21867: Windows Push Notifications Apps Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21868: Windows Devices Human Interface Elevation of Privilege Vulnerability
Key phrases: human interface elevation of privilege
CVE-2022-21869: Clipboard User Service Elevation of Privilege Vulnerability
Key phrases: clipboard user service elevation of privilege
CVE-2022-2187: The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Key phrases: reflected cross-site scripting
CVE-2022-21870: Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability
Key phrases: tablet windows user interface application core elevation of privilege
CVE-2022-21871: Microsoft Diagnostics Hub Standard Collector Runtime Elevation of Privilege Vulnerability
Key phrases: runtime elevation of privilege
CVE-2022-21872: Windows Event Tracing Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21873: Tile Data Repository Elevation of Privilege Vulnerability
Key phrases: tile data repository elevation of privilege
CVE-2022-21874: Windows Security Center API Remote Code Execution Vulnerability
Key phrases: windows security center api remote code execution
CVE-2022-21875: Windows Storage Elevation of Privilege Vulnerability
Key phrases: windows storage elevation of privilege
CVE-2022-21876: Win32k Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-21877: Storage Spaces Controller Information Disclosure Vulnerability
Key phrases: controller information disclosure
CVE-2022-21878: Windows Geolocation Service Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21879: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-2188: Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory controls in the logs directory. This can lead to a denial-of-service attack on the DXL Broker.
Key phrases: gain elevated privileges, gain elevated privileges by exploiting weak directory controls, privilege escalation, denial-of-service, denial of service
CVE-2022-21880: Windows GDI+ Information Disclosure Vulnerability
Key phrases: windows gdi+ information disclosure
CVE-2022-21881: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-21882: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21883: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Key phrases: windows internet key exchange (ike) extension denial of service
CVE-2022-21884: Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
Key phrases: local security authority subsystem service elevation of privilege
CVE-2022-21885: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Key phrases: windows remote access connection manager elevation of privilege
CVE-2022-21887: Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21888: Windows Modern Execution Server Remote Code Execution Vulnerability
Key phrases: windows modern execution server remote code execution
CVE-2022-21889: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Key phrases: windows internet key exchange (ike) extension denial of service
CVE-2022-2189: The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Key phrases: reflected cross-site scripting
CVE-2022-21890: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Key phrases: windows internet key exchange (ike) extension denial of service
CVE-2022-21891: Microsoft Dynamics 365 (on-premises) Spoofing Vulnerability
Key phrases: spoofing
CVE-2022-21892: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21893: Remote Desktop Protocol Remote Code Execution Vulnerability
Key phrases: remote desktop protocol remote code execution
CVE-2022-21894: Secure Boot Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, secure boot security feature bypass
CVE-2022-21895: Windows User Profile Service Elevation of Privilege Vulnerability
Key phrases: windows user profile service elevation of privilege
CVE-2022-21896: Windows DWM Core Library Elevation of Privilege Vulnerability
Key phrases: windows dwm core library elevation of privilege
CVE-2022-21897: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2022-21898: DirectX Graphics Kernel Remote Code Execution Vulnerability
Key phrases: directx graphics kernel remote code execution
CVE-2022-21899: Windows Extensible Firmware Interface Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows extensible firmware interface security feature bypass
CVE-2022-2190: The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers
Key phrases: reflected cross-site scripting
CVE-2022-21900: Windows Hyper-V Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows hyper-v security feature bypass
CVE-2022-21901: Windows Hyper-V Elevation of Privilege Vulnerability
Key phrases: windows hyper-v elevation of privilege
CVE-2022-21902: Windows DWM Core Library Elevation of Privilege Vulnerability
Key phrases: windows dwm core library elevation of privilege
CVE-2022-21903: Windows GDI Elevation of Privilege Vulnerability
Key phrases: windows gdi elevation of privilege
CVE-2022-21904: Windows GDI Information Disclosure Vulnerability
Key phrases: windows gdi information disclosure
CVE-2022-21905: Windows Hyper-V Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, windows hyper-v security feature bypass
CVE-2022-21906: Windows Defender Application Control Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, bypass
CVE-2022-21907: HTTP Protocol Stack Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21908: Windows Installer Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-2191: In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
CVE-2022-21910: Microsoft Cluster Port Driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-21911: .NET Framework Denial of Service Vulnerability
Key phrases: .net framework denial of service
CVE-2022-21912: DirectX Graphics Kernel Remote Code Execution Vulnerability
Key phrases: directx graphics kernel remote code execution
CVE-2022-21913: Local Security Authority (Domain Policy) Remote Protocol Security Feature Bypass
Key phrases: Security Feature Bypass, remote protocol security feature bypass
CVE-2022-21914: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Key phrases: windows remote access connection manager elevation of privilege
CVE-2022-21915: Windows GDI+ Information Disclosure Vulnerability
Key phrases: windows gdi+ information disclosure
CVE-2022-21916: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Key phrases: windows common log file system driver elevation of privilege
CVE-2022-21917: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21918: DirectX Graphics Kernel File Denial of Service Vulnerability
Key phrases: directx graphics kernel file denial of service
CVE-2022-21919: Windows User Profile Service Elevation of Privilege Vulnerability
Key phrases: windows user profile service elevation of privilege
CVE-2022-2192: Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path tampering in the Magic Link page. This issue affects: HYPR Server versions later than 6.10; version 6.15.1 and prior versions.
Key phrases: elevate privileges via path tampering in the Magic, forced browsing
CVE-2022-21920: Windows Kerberos Elevation of Privilege Vulnerability
Key phrases: windows kerberos elevation of privilege
CVE-2022-21921: Windows Defender Credential Guard Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2022-21922: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21924: Workstation Service Remote Protocol Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, remote protocol security feature bypass
CVE-2022-21925: Windows BackupKey Remote Protocol Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, remote protocol security feature bypass
CVE-2022-21926: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21927: HEVC Video Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21928: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21929: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-2193: Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering in the Device Manager page. This issue affects: HYPR Server versions prior to 6.14.1.
Key phrases: add a FIDO2 authenticator to arbitrary accounts via, insecure direct object reference
CVE-2022-21930: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21931: Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-21932: Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability
Key phrases: customer engagement cross-site scripting
CVE-2022-21933: ASUS VivoMini/Mini PC device has an improper input validation vulnerability. A local attacker with system privilege can use system management interrupt (SMI) to modify memory, resulting in arbitrary code execution for controlling the system or disrupting service.
Key phrases: input validation, disrupting service, improper input validation, arbitrary code, arbitrary code execution
CVE-2022-21934: Under certain circumstances an authenticated user could lock other users out of the system or take over their accounts in Metasys ADS/ADX/OAS server 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS server 11 versions prior to 11.0.2.
CVE-2022-21935: A vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 allows unverified password change.
Key phrases: unverified password change
CVE-2022-21936: On Metasys ADX Server version 12.0 running MVE, an Active Directory user could execute validated actions without providing a valid password when using MVE SMP UI.
CVE-2022-21937: Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the web interface.
Key phrases: inject malicious code into the web interface
CVE-2022-21938: Under certain circumstances, a vulnerability in Metasys ADS/ADX/OAS 10 versions prior to 10.1.5 and Metasys ADS/ADX/OAS 11 versions prior to 11.0.2 could allow a user to inject malicious code into the MUI Graphics web interface.
Key phrases: inject malicious code into the MUI Graphics web