yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-34488: Improper buffer restrictions in the firmware for some Intel(R) NUC Laptop Kits before version BC0076 may allow a privileged user to potentially enable escalation of privilege via local access.
Key phrases: potentially enable escalation of privilege via local access, improper buffer restrictions, escalation privilege
CVE-2022-3449: Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
Key phrases: use after free, heap corruption, convince
CVE-2022-34494: rpmsg_virtio_add_ctrl_dev in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
Key phrases: double free
CVE-2022-34495: rpmsg_probe in drivers/rpmsg/virtio_rpmsg_bus.c in the Linux kernel before 5.18.4 has a double free.
Key phrases: double free
CVE-2022-34496: Hiby R3 PRO firmware v1.5 to v1.7 was discovered to contain a file upload vulnerability via the file upload feature.
Key phrases: file upload
CVE-2022-3450: Use after free in Peer Connection in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Key phrases: use after free, heap corruption
CVE-2022-34500: The bin-collect package in PyPI before v0.1 included a code execution backdoor inserted by a third party.
Key phrases: code execution backdoor
CVE-2022-34501: The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party.
Key phrases: code execution backdoor
CVE-2022-34502: Radare2 v5.7.0 was discovered to contain a heap buffer overflow via the function consume_encoded_name_new at format/wasm/wasm.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2022-34503: QPDF v8.4.2 was discovered to contain a heap buffer overflow via the function QPDF::processXRefStream. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2022-34509: The wikifaces package in PyPI v1.0 included a code execution backdoor inserted by a third party.
Key phrases: code execution backdoor
CVE-2022-3451: The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options
Key phrases: update arbitrary options, call them, csrf checks
CVE-2022-3452: A vulnerability was found in SourceCodester Book Store Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /category.php. The manipulation of the argument category_name leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-210436.
Key phrases: cross site scripting
CVE-2022-34520: Radare2 v5.7.2 was discovered to contain a NULL pointer dereference via the function r_bin_file_xtr_load_buffer at bin/bfile.c. This vulnerability allows attackers to cause a Denial of Service (DOS) via a crafted binary file.
Key phrases: Denial of Service (DOS), cause a Denial of Service (DOS), null pointer dereference, denial of service (dos)
CVE-2022-34526: A stack overflow was discovered in the _TIFFVGetField function of Tiffsplit v4.4.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted TIFF file parsed by the "tiffsplit" or "tiffcrop" utilities.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2022-34527: D-Link DSL-3782 v1.03 and below was discovered to contain a command injection vulnerability via the function byte_4C0160.
Key phrases: command injection
CVE-2022-34528: D-Link DSL-3782 v1.03 and below was discovered to contain a stack overflow via the function getAttrValue.
Key phrases: stack overflow
CVE-2022-34529: WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill.
Key phrases: segmentation fault
CVE-2022-3453: A vulnerability was found in SourceCodester Book Store Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /transcation.php. The manipulation of the argument buyer_name leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-210437 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2022-34530: An issue in the login and reset password functionality of Backdrop CMS v1.22.0 allows attackers to enumerate usernames via password reset requests and distinct responses returned based on usernames.
Key phrases: enumerate usernames via password reset requests and distinct
CVE-2022-34531: DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php.
Key phrases: remote code execution (rce)
CVE-2022-34534: Digital Watchdog DW Spectrum Server 4.2.0.32842 allows attackers to access sensitive infromation via a crafted API call.
Key phrases: access sensitive infromation via a crafted API call
CVE-2022-34535: Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows unauthenticated attackers to view internal paths and scripts via web files.
Key phrases: view internal paths and scripts via web files
CVE-2022-34536: Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 allows attackers to access the core log file and perform session hijacking via a crafted session token.
Key phrases: access the core log file and perform session, session hijacking
CVE-2022-34537: Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a cross-site scripting (XSS) vulnerability via the component bia_oneshot.cgi.
Key phrases: cross-site scripting (xss)
CVE-2022-34538: Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/vca/bia/addacph.cgi. This vulnerability is exploitable via a crafted POST request.
Key phrases: command injection
CVE-2022-34539: Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/curltest.cgi. This vulnerability is exploitable via a crafted POST request.
Key phrases: command injection
CVE-2022-34540: Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/vca/license/license_tok.cgi. This vulnerability is exploitable via a crafted POST request.
Key phrases: command injection
CVE-2022-34549: Sims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /uploadServlet. This vulnerability allows attackers to escalate privileges and execute arbitrary commands via a crafted file.
Key phrases: execute arbitrary commands, escalate privileges and execute arbitrary commands via a, arbitrary file upload
CVE-2022-34550: Sims v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /addNotifyServlet. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notifyInfo parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-34551: Sims v1.0 was discovered to allow path traversal when downloading attachments.
Key phrases: path traversal when downloading attachments
CVE-2022-34555: TP-LINK TL-R473G 2.0.1 Build 220529 Rel.65574n was discovered to contain a remote code execution vulnerability which is exploited via a crafted packet.
Key phrases: remote code execution
CVE-2022-34556: PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c.
Key phrases: null pointer dereference
CVE-2022-34557: Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /pages/permit/permit.php.
Key phrases: sql injection
CVE-2022-34558: WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted dbs-
CVE-2022-3456: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0.
Key phrases: allocation of resources
CVE-2022-34567: An issue in \\\\Roaming\\\\Mango\\\\Plugins of University of Texas Multi-image Analysis GUI (Mango) 4.1 allows attackers to escalate privileges via crafted plugins.
Key phrases: escalate privileges via crafted plugins
CVE-2022-34568: SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c.
Key phrases: use-after-free, use after free
CVE-2022-3457: Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5.
Key phrases: origin validation error
CVE-2022-34570: WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.
Key phrases: obtain the key information, obtain the key information via accessing the messages.txt, information leak
CVE-2022-34571: An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary commands via accessing the page syslog.shtml.
Key phrases: execute arbitrary commands, obtain the system key information, obtain the system key information and execute arbitrary, access control issue
CVE-2022-34572: An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt.
Key phrases: obtain the telnet password, obtain the telnet password via accessing the page, access control issue
CVE-2022-34573: An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings via accessing the page mb_wifibasic.shtml.
Key phrases: arbitrarily configure device settings via accessing the page, access control issue
CVE-2022-34574: An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tftpd32.ini.
Key phrases: obtain the key information, obtain the key information of the device via, access control issue
CVE-2022-34575: An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fctest.shtml.
Key phrases: obtain the key information, obtain the key information of the device via, access control issue
CVE-2022-34576: A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted POST request, cgi-bin exportallsettings.sh
CVE-2022-34577: A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted POST request, adm.cgi
CVE-2022-34578: Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Branding Settings page.
Key phrases: arbitrary file upload
CVE-2022-3458: A vulnerability has been found in SourceCodester Human Resource Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /employeeview.php of the component Image File Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-210559.
Key phrases: unrestricted upload
CVE-2022-34580: Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the address parameter at ip/school/index.php.
Key phrases: cross-site scripting (xss)
CVE-2022-34586: itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via the grade parameter at /school/view/student_grade_wise.php.
Key phrases: sql injection
CVE-2022-34588: itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via the grade parameter at /school/view/timetable_insert_form.php.
Key phrases: sql injection
CVE-2022-34590: Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/admin.php.
Key phrases: sql injection
CVE-2022-34592: Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted POST request, command injection
CVE-2022-34593: DPTech VPN v8.1.28.0 was discovered to contain an arbitrary file read vulnerability.
Key phrases: arbitrary file read
CVE-2022-34594: Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moudel/update_subject.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Subject text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-34595: Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function setipv6status.
Key phrases: command injection
CVE-2022-34596: Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function WanParameterSetting.
Key phrases: command injection
CVE-2022-34597: Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability via the function WanParameterSetting.
Key phrases: command injection
CVE-2022-34598: The udpserver in H3C Magic R100 V200R004 and V100R005 has the 9034 port opened, allowing attackers to execute arbitrary commands.
Key phrases: execute arbitrary commands, port
CVE-2022-34599: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-3460: In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview.
Key phrases: sensitive variables, unmasked
CVE-2022-34600: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-34601: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-34602: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-34603: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm.
Key phrases: stack overflow
CVE-2022-34604: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /dotrace.asp.
Key phrases: stack overflow
CVE-2022-34605: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /dotrace.asp.
Key phrases: stack overflow
CVE-2022-34606: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditvsList parameter at /dotrace.asp.
Key phrases: stack overflow
CVE-2022-34607: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /doping.asp.
Key phrases: stack overflow
CVE-2022-34608: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ajaxmsg parameter at /AJAX/ajaxget.
Key phrases: stack overflow
CVE-2022-34609: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /doping.asp.
Key phrases: stack overflow
CVE-2022-3461: In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could lead to a heap buffer overflow and a read access violation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities.
Key phrases: heap buffer overflow, read access violation, availability, integrity, confidentiality
CVE-2022-34610: H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the URL /ihomers/app.
Key phrases: stack overflow
CVE-2022-34611: A cross-site scripting (XSS) vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "Contac #" text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-34612: Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get_long_object(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), integer overflow, denial of service (dos)
CVE-2022-34613: Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted file, arbitrary file upload
CVE-2022-34615: Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks.
Key phrases: gain unauthorized access, potentially gain unauthorized access to the application via, weak password requirements, brute-force
CVE-2022-34618: A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the recipe description text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-34619: A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Shopping Lists item names text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-3462: The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-34621: Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user passwords and other attributes via modification of the user_id parameter.
Key phrases: modify user passwords and other attributes via modification, insecure direct object reference (idor)
CVE-2022-34623: Mealie1.0.0beta3 is vulnerable to user enumeration via timing response discrepancy between users and non-users when an invalid password message is displayed during an authentication attempt.
Key phrases: user enumeration, timing response discrepancy, invalid password message
CVE-2022-34624: Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.
Key phrases: perform a man-in-the-, download tokens, man-in-the-middle, man in the middle
CVE-2022-34625: Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja2 template.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted Jinja2 template, server-side template injection
CVE-2022-3463: The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection
Key phrases: csv injection
CVE-2022-34632: Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/RocketCore.scala.
Key phrases: insufficient cryptography
CVE-2022-34633: CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted sfence.vma instructions rather create an exception.
Key phrases: exception
CVE-2022-34634: CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted det instructions rather create an exception.
Key phrases: exception
CVE-2022-34635: The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty.
CVE-2022-34636: CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type when a PMA violation occurs during address translation.
Key phrases: pma violation
CVE-2022-34637: CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a implements an incorrect exception type when an illegal virtual address is loaded.
Key phrases: illegal virtual address
CVE-2022-34639: CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which can affect the function of the application.
Key phrases: non-standard fence instructions, affect the function of the application
CVE-2022-3464: A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-210699.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-34640: The *tval of ecall/ebreak in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a was discovered to be incorrect.
Key phrases: ecall ebreak
CVE-2022-34641: CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type when a PMP violation occurs during address translation.
Key phrases: pmp violation
CVE-2022-34642: The component mcontrol.action in RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 contains the incorrect mask which can cause a Denial of Service (DoS).
Key phrases: Denial of Service (DoS), incorrect mask, denial of service (dos)
CVE-2022-34643: RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 implements the incorrect exception priotrity when accessing memory.
CVE-2022-34648: Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
Key phrases: stored cross-site scripting (xss)
CVE-2022-3465: A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210700.
Key phrases: improper authentication
CVE-2022-34650: Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.
Key phrases: stored cross-site scripting (xss)
CVE-2022-34651: In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: undisclosed requests
CVE-2022-34652: A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the description parameter.
Key phrases: inject SQL by manipulating the description parameter, sql injection
CVE-2022-34654: Cross-Site Request Forgery (CSRF) in Virgial Berveling'sManage Notification E-mails plugin <=1.8.2on WordPress.
Key phrases: cross-site request forgery (csrf)
CVE-2022-34655: In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Key phrases: undisclosed traffic
CVE-2022-34656: Authenticated (admin+) Cross-Site Scripting (XSS) vulnerability in wpdevart Poll, Survey, Questionnaire and Voting system plugin <= 1.7.4 at WordPress.
Key phrases: cross-site scripting (xss)
CVE-2022-34657: Improper input validation in firmware for some Intel(R) PCSD BIOS before version 02.01.0013 may allow a privileged user to potentially enable information disclosure via local access.
Key phrases: potentially enable information disclosure via local access, improper input validation
CVE-2022-34658: Multiple Authenticated (contributor+) Persistent Cross-Site Scripting (XSS) vulnerabilities in W3 Eden Download Manager plugin <= 3.2.48 at WordPress.
Key phrases: persistent cross-site scripting (xss)
CVE-2022-34659: A vulnerability has been identified in Simcenter STAR-CCM+ (All versions only if the Power-on-Demand public license server is used). Affected applications expose user, host and display name of users, when the public license server is used. This could allow an attacker to retrieve this information.
Key phrases: retrieve this information
CVE-2022-3466: The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details, see https://access.redhat.com/security/cve/CVE-2022-27652.
Key phrases: programs with inheritable file capabilities to elevate those
CVE-2022-34660: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.5), Teamcenter V14.0 (All versions < V14.0.0.2). File Server Cache service in Teamcenter consist of a functionality that is vulnerable to command injection. This could potentially allow an attacker to perform remote code execution.
Key phrases: perform remote code execution, command injection
CVE-2022-34661: A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3.0.5), Teamcenter V14.0 (All versions < V14.0.0.2). File Server Cache service in Teamcenter is vulnerable to denial of service by entering infinite loops and using up CPU cycles. This could allow an attacker to cause denial of service condition.
Key phrases: cause denial of service condition, infinite loop
CVE-2022-34662: When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users. You could upgrade to version 3.0.0 or higher
Key phrases: path traversal issues
CVE-2022-34665: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.
Key phrases: null-pointer dereference, denial of service, null pointer, null pointer dereference
CVE-2022-34666: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a local user with basic capabilities can cause a null-pointer dereference, which may lead to denial of service.
Key phrases: null-pointer dereference, denial of service, null pointer, null pointer dereference
CVE-2022-34667: NVIDIA CUDA Toolkit SDK contains a stack-based buffer overflow vulnerability in cuobjdump, where an unprivileged remote attacker could exploit this buffer overflow condition by persuading a local user to download a specially crafted corrupted file and execute cuobjdump against it locally, which may lead to a limited denial of service and some loss of data integrity for the local user.
Key phrases: stack-based buffer overflow, denial of service, loss of data integrity, stack based buffer overflow
CVE-2022-34668: NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.
Key phrases: cause Remote Code Execution, nvflare, denial of service
CVE-2022-34669: NVIDIA GPU Display Driver for Windows contains a vulnerability in the user mode layer, where an unprivileged regular user can access or modify system files or other files that are critical to the application, which may lead to code execution, denial of service, escalation of privileges, information disclosure, or data tampering.
Key phrases: code execution, denial of service, escalation of privileges, information disclosure, data tampering, escalation privilege
CVE-2022-3467: A vulnerability classified as critical was found in Jiusi OA. Affected by this vulnerability is an unknown functionality of the file /jsoa/hntdCustomDesktopActionContent. The manipulation of the argument inforid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-210709 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-34670: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause truncation errors when casting a primitive to a primitive of smaller size causes data to be lost in the conversion, which may lead to denial of service or information disclosure.
Key phrases: truncation errors, denial of service, information disclosure
CVE-2022-34671: NVIDIA GPU Display Driver for Windows contains a vulnerability in the user-mode layer, where an unprivileged user can cause an out-of-bounds write, which may lead to code execution, information disclosure, and denial of service.
Key phrases: out-of-bounds write, code execution, information disclosure, denial of service, out of bounds write
CVE-2022-34672: NVIDIA Control Panel for Windows contains a vulnerability where an unauthorized user or an unprivileged regular user can compromise the security of the software by gaining privileges, reading sensitive information, or executing commands.
Key phrases: executing commands, gain privileges, sensitive information, execute commands
CVE-2022-34673: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an out-of-bounds array access may lead to denial of service, information disclosure, or data tampering.
Key phrases: out-of-bounds array access, denial of service, information disclosure, data tampering
CVE-2022-34674: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where a helper function maps more physical pages than were requested, which may lead to undefined behavior or an information leak.
Key phrases: undefined behavior, information leak
CVE-2022-34675: NVIDIA Display Driver for Linux contains a vulnerability in the Virtual GPU Manager, where it does not check the return value from a null-pointer dereference, which may lead to denial of service.
Key phrases: null-pointer dereference, denial of service, null pointer, null pointer dereference
CVE-2022-34676: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an out-of-bounds read may lead to denial of service, information disclosure, or data tampering.
Key phrases: out-of-bounds read, denial of service, information disclosure, data tampering, out of bounds read
CVE-2022-34677: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unprivileged regular user can cause an integer to be truncated, which may lead to denial of service or data tampering.
Key phrases: kernel mode layer handler, denial of service, data tampering
CVE-2022-34678: NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an unprivileged user can cause a null-pointer dereference, which may lead to denial of service.
Key phrases: null-pointer dereference, denial of service, null pointer, null pointer dereference
CVE-2022-34679: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an unhandled return value can lead to a null-pointer dereference, which may lead to denial of service.
Key phrases: null-pointer dereference, denial of service, null pointer, null pointer dereference
CVE-2022-34680: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer handler, where an integer truncation can lead to an out-of-bounds read, which may lead to denial of service.
Key phrases: integer truncation, out-of-bounds read, denial of service, out of bounds read
CVE-2022-34681: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler, where improper input validation of a display-related data structure may lead to denial of service.
Key phrases: denial of service, improper input validation
CVE-2022-34682: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer, where an unprivileged regular user can cause a null-pointer dereference, which may lead to denial of service.
Key phrases: null-pointer dereference, denial of service, null pointer, null pointer dereference
CVE-2022-34683: NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape, where a null-pointer dereference occurs, which may lead to denial of service.
Key phrases: null-pointer dereference, denial of service, null pointer, null pointer dereference
CVE-2022-34684: NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer (nvidia.ko), where an off-by-one error may lead to data tampering or information disclosure.
Key phrases: off-by-one error, data tampering, information disclosure
CVE-2022-34685: Azure RTOS GUIX Studio Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-34686: Azure RTOS GUIX Studio Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-34687: Azure RTOS GUIX Studio Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34689: Windows CryptoAPI Spoofing Vulnerability
Key phrases: windows cryptoapi spoofing
CVE-2022-3469: The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting
CVE-2022-34690: Windows Fax Service Elevation of Privilege Vulnerability
Key phrases: windows fax service elevation of privilege
CVE-2022-34691: Active Directory Domain Services Elevation of Privilege Vulnerability
Key phrases: active directory domain services elevation of privilege
CVE-2022-34692: Microsoft Exchange Server Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-34696: Windows Hyper-V Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34699: Windows Win32k Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-3470: A vulnerability was found in SourceCodester Human Resource Management System. It has been classified as critical. Affected is an unknown function of the file getstatecity.php. The manipulation of the argument sc leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-210714 is the identifier assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-34700: Microsoft Dynamics CRM (on-premises) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34701: Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-34702: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34703: Windows Partition Management Driver Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-34704: Windows Defender Credential Guard Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-34705: Windows Defender Credential Guard Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-34706: Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-34707: Windows Kernel Elevation of Privilege Vulnerability
Key phrases: windows kernel elevation of privilege
CVE-2022-34708: Windows Kernel Information Disclosure Vulnerability
Key phrases: windows kernel information disclosure
CVE-2022-34709: Windows Defender Credential Guard Security Feature Bypass Vulnerability
Key phrases: Security Feature Bypass, security feature bypass
CVE-2022-3471: A vulnerability was found in SourceCodester Human Resource Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file city.php. The manipulation of the argument searccity leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-210715.
Key phrases: sql injection
CVE-2022-34710: Windows Defender Credential Guard Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-34711: Windows Defender Credential Guard Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-34712: Windows Defender Credential Guard Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-34713: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34714: Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34715: Windows Network File System Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34716: .NET Spoofing Vulnerability
Key phrases: net spoofing
CVE-2022-34717: Microsoft Office Remote Code Execution Vulnerability
Key phrases: microsoft office remote code execution
CVE-2022-34718: Windows TCP/IP Remote Code Execution Vulnerability
Key phrases: windows tcp ip remote code execution
CVE-2022-34719: Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
Key phrases: elevation of privilege
CVE-2022-3472: A vulnerability was found in SourceCodester Human Resource Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file city.php. The manipulation of the argument cityedit leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210716.
Key phrases: sql injection
CVE-2022-34720: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Key phrases: windows internet key exchange (ike) extension denial of service
CVE-2022-34721: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34722: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34723: Windows DPAPI (Data Protection Application Programming Interface) Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-34724: Windows DNS Server Denial of Service Vulnerability
Key phrases: denial of service
CVE-2022-34725: Windows ALPC Elevation of Privilege Vulnerability
Key phrases: windows alpc elevation of privilege
CVE-2022-34726: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34727: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34728: Windows Graphics Component Information Disclosure Vulnerability
Key phrases: information disclosure
CVE-2022-34729: Windows GDI Elevation of Privilege Vulnerability
Key phrases: windows gdi elevation of privilege
CVE-2022-3473: A vulnerability classified as critical has been found in SourceCodester Human Resource Management System. This affects an unknown part of the file getstatecity.php. The manipulation of the argument ci leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-210717 was assigned to this vulnerability.
Key phrases: sql injection
CVE-2022-34730: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34731: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34732: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34733: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34734: Microsoft ODBC Driver Remote Code Execution Vulnerability
Key phrases: remote code execution
CVE-2022-34735: The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
Key phrases: null pointer dereference, kernel availability
CVE-2022-34736: The frame scheduling module has a null pointer dereference vulnerability. Successful exploitation of this vulnerability will affect the kernel availability.
Key phrases: null pointer dereference, kernel availability
CVE-2022-34737: The application security module has a vulnerability in permission assignment. Successful exploitation of this vulnerability may affect data integrity and confidentiality.
Key phrases: permission assignment, data integrity, confidentiality
CVE-2022-34738: The SystemUI module has a vulnerability in permission control. If this vulnerability is successfully exploited, users are unaware of the service running in the background.
Key phrases: permission control
CVE-2022-34739: The fingerprint module has a vulnerability of overflow in arithmetic addition. Successful exploitation of this vulnerability may result in the acquisition of data from unknown addresses in address mappings.
Key phrases: overflow in arithmetic addition
CVE-2022-3474: A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3.
Key phrases: credential handling
CVE-2022-34740: The NFC module has a buffer overflow vulnerability. Successful exploitation of this vulnerability may cause exceptions in NFC card registration, deletion, and activation.
Key phrases: buffer overflow, exceptions
CVE-2022-34741: The NFC module has a buffer overflow vulnerability. Successful exploitation of this vulnerability may cause exceptions in NFC card registration, deletion, and activation.
Key phrases: buffer overflow, exceptions
CVE-2022-34742: The system module has a read/write vulnerability. Successful exploitation of this vulnerability may affect data confidentiality.
Key phrases: read write, data confidentiality
CVE-2022-34743: The AT commands of the USB port have an out-of-bounds read vulnerability. Successful exploitation of this vulnerability may affect system availability.
Key phrases: out-of-bounds read, system availability, out of bounds read
CVE-2022-34746: An insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was found in Zyxel GS1900 series firmware versions prior to V2.70. This vulnerability could allow an unauthenticated attacker to retrieve a private key by factoring the RSA modulus N in the certificate of the web administration interface.
Key phrases: retrieve a private key by factoring the RSA, insufficient entropy
CVE-2022-34747: A format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized remote code execution via a crafted UDP packet.
Key phrases: achieve unauthorized remote code execution via a crafted, format string
CVE-2022-34748: A vulnerability has been identified in Simcenter Femap (All versions < V2022.2). The affected application contains an out of bounds write past the end of an allocated structure while parsing specially crafted X_T files. This could allow an attacker to execute code in the context of the current process. (ZDI-CAN-17293)
Key phrases: execute code in the context of the current, out of bounds write
CVE-2022-34749: In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtracking on certain edge cases. This behavior is commonly named catastrophic backtracking.
CVE-2022-34750: An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty.
Key phrases: be created, denial-of-service attack vectors, denial of service
CVE-2022-34753: A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised. Affected Products: SpaceLogic C-Bus Home Controller (5200WHC2), formerly known as C-Bus Wiser Homer Controller MK2 (V1.31.460 and prior)
Key phrases: cwe-78, os command injection