yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-4729: A vulnerability was found in Graphite Web and classified as problematic. This issue affects some unknown processing of the component Template Name Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-216743.
Key phrases: cross site scripting
CVE-2022-4730: A vulnerability was found in Graphite Web. It has been classified as problematic. Affected is an unknown function of the component Absolute Time Range Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 2f178f490e10efc03cd1d27c72f64ecab224eb23. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-216744.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-4731: A vulnerability, which was classified as problematic, was found in myapnea up to 29.0.x. Affected is an unknown function of the component Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 29.1.0 is able to address this issue. The name of the patch is 99934258530d761bd5d09809bfa6c14b598f8d18. It is recommended to upgrade the affected component. VDB-216750 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-47311: A proprietary protocol for iBoot devices is used for control and keepalive commands. The function compares the username and password; it also contains the configuration data for the user specified. If the user does not exist, then it sends a value for username and password, which allows successful authentication for a connection.
Key phrases: successful authentication for a connection
CVE-2022-47317: Out-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrary code by having a user to open a specially crafted project file.
Key phrases: execute arbitrary code, obtain the information, obtain the information and/or execute arbitrary code by, out-of-bounds write, out of bounds write
CVE-2022-47318: ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repository containing a specially crafted filename to the product. This vulnerability is different from CVE-2022-46648.
Key phrases: execute an arbitrary ruby code by having a, execute arbitrary
CVE-2022-4732: Unrestricted Upload of File with Dangerous Type in GitHub repository microweber/microweber prior to 1.3.2.
Key phrases: unrestricted upload
CVE-2022-47320: The iBoot devices basic discovery protocol assists in initial device configuration. The discovery protocol shows basic information about devices on the network and allows users to perform configuration changes.
Key phrases: perform configuration changes
CVE-2022-47322: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-47323: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-47324: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Key phrases: missing permission check, local information disclosure
CVE-2022-47325: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Key phrases: missing permission check, local information disclosure
CVE-2022-47326: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Key phrases: missing permission check, local information disclosure
CVE-2022-47327: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Key phrases: missing permission check, local information disclosure
CVE-2022-47328: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Key phrases: missing permission check, local information disclosure
CVE-2022-47329: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Key phrases: missing permission check, local information disclosure
CVE-2022-4733: Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.0.2.
Key phrases: cross-site scripting (xss)
CVE-2022-47330: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Key phrases: missing permission check, local information disclosure
CVE-2022-47331: In wlan driver, there is a race condition. This could lead to local denial of service in wlan services.
Key phrases: race condition, local denial of service
CVE-2022-47332: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Key phrases: missing permission check, local information disclosure
CVE-2022-47333: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Key phrases: missing permission check, local information disclosure
CVE-2022-47334: In phasecheck server, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2022-47335: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Key phrases: missing permission check, local denial of service
CVE-2022-47336: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Key phrases: missing permission check, local denial of service
CVE-2022-47337: In media service, there is a missing permission check. This could lead to local denial of service in media service.
Key phrases: missing permission check, local denial of service
CVE-2022-47338: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Key phrases: missing permission check, local denial of service
CVE-2022-47339: In cmd services, there is a OS command injection issue due to missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Key phrases: os command injection, local escalation of privilege, escalation privilege
CVE-2022-4734: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository usememos/memos prior to 0.9.1.
Key phrases: improper removal of sensitive information
CVE-2022-47340: In h265 codec firmware, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with no additional execution privileges.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47341: In engineermode services, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Key phrases: missing permission check, local escalation of privilege, escalation privilege
CVE-2022-47342: In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Key phrases: missing permission check, local denial of service
CVE-2022-47343: In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Key phrases: missing permission check, local denial of service
CVE-2022-47344: In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Key phrases: missing permission check, local denial of service
CVE-2022-47345: In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Key phrases: missing permission check, local denial of service
CVE-2022-47346: In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Key phrases: missing permission check, local denial of service
CVE-2022-47347: In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Key phrases: missing permission check, local denial of service
CVE-2022-47348: In engineermode services, there is a missing permission check. This could lead to local denial of service in engineermode services.
Key phrases: missing permission check, local denial of service
CVE-2022-4735: A vulnerability classified as problematic was found in asrashley dash-live. This vulnerability affects the function ready of the file static/js/media.js of the component DOM Node Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. The name of the patch is 24d01757a5319cc14c4aa1d8b53d1ab24d48e451. It is recommended to apply a patch to fix this issue. VDB-216766 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2022-47350: In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2022-47351: In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2022-47352: In camera driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2022-47353: In vdsp device, there is a possible system crash due to improper input validation.This could lead to local denial of service with System execution privileges needed
Key phrases: improper input validation, local denial of service, crash
CVE-2022-47354: In log service, there is a missing permission check. This could lead to local denial of service in log service.
Key phrases: missing permission check, local denial of service
CVE-2022-47355: In log service, there is a missing permission check. This could lead to local denial of service in log service.
Key phrases: missing permission check, local denial of service
CVE-2022-47356: In log service, there is a missing permission check. This could lead to local denial of service in log service.
Key phrases: missing permission check, local denial of service
CVE-2022-47357: In log service, there is a missing permission check. This could lead to local denial of service in log service.
Key phrases: missing permission check, local denial of service
CVE-2022-47358: In log service, there is a missing permission check. This could lead to local denial of service in log service.
Key phrases: missing permission check, local denial of service
CVE-2022-47359: In log service, there is a missing permission check. This could lead to local denial of service in log service.
Key phrases: missing permission check, local denial of service
CVE-2022-4736: A vulnerability was found in Venganzas del Pasado and classified as problematic. Affected by this issue is some unknown functionality. The manipulation of the argument the_title leads to cross site scripting. The attack may be launched remotely. The name of the patch is 62339b2ec445692c710b804bdf07aef4bd247ff7. It is recommended to apply a patch to fix this issue. VDB-216770 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2022-47360: In log service, there is a missing permission check. This could lead to local denial of service in log service.
Key phrases: missing permission check, local denial of service
CVE-2022-47361: In firewall service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Key phrases: local escalation of privilege, escalation privilege
CVE-2022-47362: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Key phrases: missing permission check, local denial of service
CVE-2022-47363: In wlan driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2022-47364: In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47365: In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47366: In wlan driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47367: In bluetooth driver, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: local information disclosure
CVE-2022-47368: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-47369: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-4737: A vulnerability was found in SourceCodester Blood Bank Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file login.php. The manipulation of the argument username/password leads to sql injection. The attack may be initiated remotely. The identifier VDB-216773 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-47370: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-47371: In bt driver, there is a thread competition leads to early release of resources to be accessed. This could lead to local denial of service in kernel.
Key phrases: thread competition, local denial of service
CVE-2022-47372: Stored cross-site scripting vulnerability in the Create event section in Pandora FMS Console v766 and lower. An attacker typically exploits this vulnerability by injecting XSS payloads on popular pages of a site or passing a link to a victim, tricking them into viewing the page that contains the stored XSS payload.
Key phrases: stored cross-site scripting
CVE-2022-47373: Reflected Cross Site Scripting in Search Functionality of Module Library in Pandora FMS Console v766 and lower. This vulnerability arises on the forget password functionality in which parameter username does not proper input validation/sanitization thus results in executing malicious JavaScript payload.
Key phrases: cross site scripting
CVE-2022-47374: A vulnerability has been identified in SIMATICPC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions). The affected products do not handle HTTP(S) requests to the web server correctly.This could allow an attacker to exhaust system resources and create a denial of service condition for the device.
Key phrases: exhaust system resources and create a denial of, denial of service condition
CVE-2022-47375: A vulnerability has been identified in SIMATICPC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 CPU 414-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 414F-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416-3 PN/DP V7 (All versions), SIMATIC S7-400 CPU 416F-3 PN/DP V7 (All versions), SINAMICS S120 (incl. SIPLUS variants) (All versions < V5.2 SP3 HF15), SIPLUS S7-400 CPU 414-3 PN/DP V7 (All versions), SIPLUS S7-400 CPU 416-3 PN/DP V7 (All versions). The affected products do not handle long file names correctly.This could allow an attacker to create a buffer overflow and create a denial of service condition for the device.
Key phrases: create a buffer overflow and create a denial, denial of service condition
CVE-2022-47376: The Alaris Infusion Central software, versions 1.1 to 1.3.2, may contain a recoverable password after the installation. No patient health data is stored in the database, although some site installations may choose to store personal data.
Key phrases: recoverable password
CVE-2022-47377: Password recovery vulnerability in SICK SIM2000ST Partnumber 2086502 with firmware version <1.13.4 allows an unprivileged remote attacker to gain access to the userlevel defined as RecoverableUserLevel by invocating the password recovery mechanism method. This leads to an increase in their privileges on the system and thereby affecting the confidentiality integrity and availability of the system. An attacker can expect repeatable success by exploiting the vulnerability. The recommended solution is to update the firmware to a version >= 1.13.4 as soon as possible (available in SICK Support Portal).
Key phrases: gain access, gain access to the userlevel defined as RecoverableUserLevel, password recovery, repeatable success, increased privileges, confidentiality, confidentiality and integrity, integrity and availability
CVE-2022-47378: Multiple CODESYS products in multiple versions are prone to a improper input validation vulnerability. An authenticated remote attacker may craft specific requests that use the vulnerability leading to a denial-of-service condition.
Key phrases: input validation, denial-of-service condition, improper input validation, denial of service
CVE-2022-47379: An authenticated, remote attacker may use a out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into memory which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-4738: A vulnerability classified as problematic has been found in SourceCodester Blood Bank Management System 1.0. Affected is an unknown function of the file index.php?page=users of the component User Registration Handler. The manipulation of the argument Name leads to cross site scripting. It is possible to launch the attack remotely. VDB-216774 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-47380: An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-47381: An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-47382: An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-47383: An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-47384: An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-47385: An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpAppForce Component of multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-47386: An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-47387: An authenticated remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-47388: An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-47389: An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-4739: A vulnerability classified as critical was found in SourceCodester School Dormitory Management System 1.0. Affected by this vulnerability is an unknown functionality of the component Admin Login. The manipulation leads to sql injection. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-216775.
Key phrases: sql injection
CVE-2022-47390: An authenticated, remote attacker may use a stack based out-of-bounds write vulnerability in the CmpTraceMgr Component of multiple CODESYS products in multiple versions to write data into the stack which can leadto a denial-of-service condition, memory overwriting, or remote code execution.
Key phrases: stack based out-of-bounds write, denial-of-service condition, memory overwriting, remote code execution, out of bounds write, denial of service, memory overwrite
CVE-2022-47391: In multiple CODESYS products in multiple versions an unauthorized, remote attacker may use a improper input validation vulnerability to read from invalid addresses leading to a denial of service.
Key phrases: improper input validation, denial of service
CVE-2022-47392: An authenticated, remote attacker may use a improper input validation vulnerability in the CmpApp/CmpAppBP/CmpAppForce Components of multiple CODESYS products in multiple versions to read from an invalid address which can leadto a denial-of-service condition.
Key phrases: improper input validation, denial-of-service condition, denial of service
CVE-2022-47393: An authenticated, remote attacker may use a Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in multiple versions of multiple CODESYS products to force a denial-of-service situation.
Key phrases: improper restriction of operations within the bounds of a memory buffer, denial-of-service situation, denial of service
CVE-2022-47395: Sewios Real-Time Location System (RTLS) Studio version 2.0.0 up to and including version 2.6.2 is vulnerable to cross-site request forgery in its monitor services. An attacker could take advantage of this vulnerability to execute arbitrary maintenance operations and cause a denial-of-service condition.
Key phrases: execute arbitrary maintenance operations, cross-site request forgery, denial-of-service condition, cross site request forgery, denial of service
CVE-2022-4740: A vulnerability, which was classified as problematic, has been found in kkFileView. Affected by this issue is the function setWatermarkAttribute of the file /picturesPreview. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-216776.
Key phrases: cross site scripting
CVE-2022-47406: An issue was discovered in the fe_change_pwd (aka Change password for frontend users) extension before 2.0.5, and 3.x before 3.0.3, for TYPO3. The extension fails to revoke existing sessions for the current user when the password has been changed.
CVE-2022-47407: An issue was discovered in the fp_masterquiz (aka Master-Quiz) extension before 2.2.1, and 3.x before 3.5.1, for TYPO3. An attacker can continue the quiz of a different user. In doing so, the attacker can view that user's answers and modify those answers.
CVE-2022-47408: An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. There is a CAPTCHA bypass that can lead to subscribing many people.
Key phrases: bypass that can lead to subscribing many people, CAPTCHA bypass, captcha bypass
CVE-2022-47409: An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Attackers can unsubscribe everyone via a series of modified subscription UIDs in deleteAction operations.
Key phrases: modified subscription uids
CVE-2022-4741: A vulnerability was found in docconv up to 1.2.0 and classified as problematic. This issue affects the function ConvertDocx/ConvertODT/ConvertPages/ConvertXML/XMLToText. The manipulation leads to uncontrolled memory allocation. The attack may be initiated remotely. Upgrading to version 1.2.1 is able to address this issue. The name of the patch is 42bcff666855ab978e67a9041d0cdea552f20301. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-216779.
CVE-2022-47410: An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via createAction operations.
CVE-2022-47411: An issue was discovered in the fp_newsletter (aka Newsletter subscriber management) extension before 1.1.1, 1.2.0, 2.x before 2.1.2, 2.2.1 through 2.4.0, and 3.x before 3.2.6 for TYPO3. Data about subscribers may be obtained via unsubscribeAction operations.
CVE-2022-47412: Given a malicious document provided by an attacker, the ONLYOFFICE Workspace DMS is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition.
CVE-2022-47413: Given a malicious document provided by an attacker, the OpenKM DMS is vulnerable to a stored (persistent, or "Type II") XSS condition.
Key phrases: xss condition
CVE-2022-47414: If an attacker has access to the console for OpenKM (and is authenticated), a stored XSS vulnerability is reachable in the document "note" functionality.
Key phrases: stored xss
CVE-2022-47415: LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app messaging system (both subject and message bodies).
CVE-2022-47416: LogicalDOC Enterprise is vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the in-app chat system.
CVE-2022-47417: LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document file name.
CVE-2022-47418: LogicalDOC Enterprise and Community Edition (CE) are vulnerable to a stored (persistent, or "Type II") cross-site scripting (XSS) condition in the document version comments.
CVE-2022-47419: An XSS vulnerability was discovered in the Mayan EDMS DMS. Successful XSS exploitation was observed in the in-product tagging system.
Key phrases: xss
CVE-2022-4742: A vulnerability, which was classified as critical, has been found in json-pointer. Affected by this issue is the function set of the file index.js. The manipulation leads to improperly controlled modification of object prototype attributes ('prototype pollution'). The attack may be launched remotely. The name of the patch is 859c9984b6c407fc2d5a0a7e47c7274daa681941. It is recommended to apply a patch to fix this issue. VDB-216794 is the identifier assigned to this vulnerability.
CVE-2022-47420: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Online ADA Accessibility Suite by Online ADA allows SQL Injection.This issue affects Accessibility Suite by Online ADA: from n/a through 4.11.
Key phrases: SQL Injection, sql injection
CVE-2022-47421: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Repute InfoSystems ARMember (free), Repute InfoSystems ARMember (premium) plugins.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47422: Cross-Site Request Forgery (CSRF) vulnerability in HM Plugin Accept Stripe Donation  AidWP plugin<= 3.1.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47423: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Ulf Benjaminsson WP-dTree plugin <=4.4.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47426: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Neshan Maps Platform Neshan Maps neshan-maps allows SQL Injection.This issue affects Neshan Maps: from n/a through 1.1.4.
Key phrases: SQL Injection, sql command, sql injection
CVE-2022-47427: Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Calendar plugin <=3.3.24.1 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47428: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WpDevArt Booking calendar, Appointment Booking System allows SQL Injection.This issue affects Booking calendar, Appointment Booking System: from n/a through 3.2.7.
Key phrases: SQL Injection, sql command, sql injection
CVE-2022-4743: A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.
Key phrases: cause a denial of service attack, memory leak
CVE-2022-47430: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Weblizar The School Management  Education & Learning Management allows SQL Injection.This issue affects The School Management  Education & Learning Management: from n/a through 4.1.
Key phrases: SQL Injection, sql command, sql injection
CVE-2022-47431: Reflected Cross-Site Scripting (XSS) vulnerability in Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin <=2.0.14 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-47432: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Kemal YAZICI - PluginPress Shortcode IMDB allows SQL Injection.This issue affects Shortcode IMDB: from n/a through 6.0.8.
Key phrases: SQL Injection, sql command, sql injection
CVE-2022-47433: Unauth. Reflected Cross-Site Scripting vulnerability in Daniel Powney Multi Rating plugin<= 5.0.5 versions.
Key phrases: reflected cross-site scripting
CVE-2022-47434: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in PB SEO Friendly Images plugin <=4.0.5 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47435: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Olive Design WP-OliveCart plugin <=1.1.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47436: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in MantraBrain Yatra plugin <=2.1.14 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47437: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Branko Borilovic WSB Brands plugin <=1.1.8 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47438: Auth. (editor+) Stored Cross-Site Scripting (XSS) vulnerability in WpDevArt Booking calendar, Appointment Booking System plugin <=3.2.3 versions.
Key phrases: stored cross-site scripting (xss)
CVE-2022-47439: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Rocket Apps Open Graphite plugin <=1.6.0 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-4744: A double-free flaw was found in the Linux kernels TUN/TAP device driver functionality in how a user registers the device when the register_netdevice function fails (NETDEV_REGISTER notifier). This flaw allows a local user to crash or potentially escalate their privileges on the system.
Key phrases: crash or potentially escalate their privileges on the, double-free flaw, double free, escalate privilege
CVE-2022-47440: Cross-Site Request Forgery (CSRF) vulnerability in Joseph C Dolson My Tickets plugin<= 1.9.10 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47441: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Charitable Donations & Fundraising Team Donation Forms by Charitable plugin <=1.7.0.10 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-47442: Improper Neutralization of Formula Elements in a CSV File vulnerability in AyeCode Ltd UsersWP.This issue affects UsersWP: from n/a through 1.2.3.9.
Key phrases: improper neutralization of formula elements
CVE-2022-47443: Cross-Site Request Forgery (CSRF) vulnerability in Daniel Powney Multi Rating plugin <=5.0.5 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47444: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ProfilePress Membership Team Paid Membership Plugin, Ecommerce, Registration Form, Login Form, User Profile & Restrict Content  ProfilePress plugin <=4.5.3 versions.
Key phrases: cross-site scripting (xss)
CVE-2022-47445: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Web-X Be POPIA Compliant be-popia-compliant allows SQL Injection.This issue affects Be POPIA Compliant: from n/a through 1.2.0.
Key phrases: SQL Injection, sql injection
CVE-2022-47446: Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps  LotsOfLocales plugin <=3.98.7 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47447: Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <=3.3.8 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47448: Cross-Site Request Forgery (CSRF) vulnerability in dev.Xiligroup.Com - MS plugin <=1.12.03 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-47449: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in RexTheme Cart Lift  Abandoned Cart Recovery for WooCommerce and EDD plugin <=3.1.5 versions.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-4745: The WP Customer Area WordPress plugin before 8.1.4 does not have CSRF checks when performing some actions such as chmod, mkdir and copy, which could allow attackers to make a logged-in admin perform them and create arbitrary folders, copy file for example.
Key phrases: create arbitrary folders, make a logged-in admin perform them, csrf checks
CVE-2022-47450: In wlan driver, there is a possible missing permission check. This could lead to local information disclosure.
Key phrases: missing permission check, local information disclosure
CVE-2022-47451: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-47452: In gnss driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in wlan services.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47453: In wcn service, there is a possible missing params check. This could lead to local denial of service in wcn service.
Key phrases: missing params check, local denial of service
CVE-2022-47454: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-47455: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-47456: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-47457: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-47458: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-47459: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-4746: The FluentAuth WordPress plugin before 1.0.2 prioritizes getting a visitor's IP address from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass the IP-based blocks set by the plugin.
Key phrases: bypass the IP-based blocks set by
CVE-2022-47460: In gpu device, there is a memory corruption due to a use after free. This could lead to local denial of service in kernel.
Key phrases: memory corruption, use after free, local denial of service
CVE-2022-47461: In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Key phrases: missing permission check, local escalation of privilege, escalation privilege
CVE-2022-47462: In telephone service, there is a missing permission check. This could lead to local escalation of privilege with system execution privileges needed.
Key phrases: missing permission check, local escalation of privilege, escalation privilege
CVE-2022-47463: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Key phrases: missing permission check, local denial of service
CVE-2022-47464: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Key phrases: missing permission check, local denial of service
CVE-2022-47465: In vdsp service, there is a missing permission check. This could lead to local denial of service in vdsp service.
Key phrases: missing permission check, local denial of service
CVE-2022-47466: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Key phrases: missing permission check, local denial of service
CVE-2022-47467: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Key phrases: missing permission check, local denial of service
CVE-2022-47468: In telecom service, there is a missing permission check. This could lead to local denial of service in telecom service.
Key phrases: missing permission check, local denial of service
CVE-2022-47469: In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could local denial of service with System execution privileges needed.
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2022-4747: The Post Category Image With Grid and Slider WordPress plugin before 1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Key phrases: perform Stored Cross-Site Scripting attacks which, stored cross-site scripting
CVE-2022-47470: In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could local denial of service with System execution privileges needed.
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2022-47471: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-47472: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-47473: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-47474: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-47475: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-47476: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-47477: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-47478: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-47479: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-4748: A vulnerability was found in FlatPress. It has been classified as critical. This affects the function doItemActions of the file fp-plugins/mediamanager/panels/panel.mediamanager.file.php of the component File Delete Handler. The manipulation of the argument deletefile leads to path traversal. The name of the patch is 5d5c7f6d8f072d14926fc2c3a97cdd763802f170. It is recommended to apply a patch to fix this issue. The identifier VDB-216861 was assigned to this vulnerability.
Key phrases: path traversal
CVE-2022-47480: In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-47481: In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-47482: In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-47483: In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-47484: In telephony service, there is a missing permission check. This could lead to local denial of service in telephone service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-47485: In modem control device, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-47486: In ext4fsfilter driver, there is a possible out of bounds read due to a missing bounds check. This could lead to local denial of service with System execution privileges needed.
Key phrases: out of bounds read, missing bounds check, local denial of service
CVE-2022-47487: In thermal service, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service local denial of service with no additional execution privileges.
Key phrases: out of bounds write, missing bounds check, local denial of service, execution privileges