yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-3488: Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure.'Broken' in this context is anything that would cause the resolver to reject the query response, such as a mismatch between query and answer name.This issue affects BIND 9 versions 9.11.4-S1 through 9.11.37-S1 and 9.16.8-S1 through 9.16.36-S1.
CVE-2022-34881: Generation of Error Message Containing Sensitive Information vulnerability in Hitachi JP1/Automatic Operation allows local users to gain sensitive information.This issue affects JP1/Automatic Operation: from 10-00 through 10-54-03, from 11-00 before 11-51-09, from 12-00 before 12-60-01.
Key phrases: gain sensitive information
CVE-2022-34882: Information Exposure Through an Error Message vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to gain sensitive information. This issue affects: Hitachi RAID Manager Storage Replication Adapter 02.01.04 versions prior to 02.03.02 on Windows; 02.05.00 versions prior to 02.05.01 on Windows and Docker.
Key phrases: gain sensitive information, information exposure, error message
CVE-2022-34883: OS Command Injection vulnerability in Hitachi RAID Manager Storage Replication Adapter allows remote authenticated users to execute arbitrary OS commands. This issue affects: Hitachi RAID Manager Storage Replication Adapter 02.01.04 versions prior to 02.03.02 on Windows; 02.05.00 versions prior to 02.05.01 on Windows and Docker.
Key phrases: execute arbitrary OS commands, os command injection, arbitrary os command
CVE-2022-34884: A buffer overflow exists in the Remote Presence subsystem which can potentially allow valid, authenticated users to cause a recoverable subsystem denial of service.
Key phrases: cause a recoverable subsystem denial of service, buffer overflow
CVE-2022-34885: An improper input sanitization vulnerability in the Motorola MR2600 router could allow a local user with elevated permissions to execute arbitrary code.
Key phrases: execute arbitrary code, input sanitization
CVE-2022-34886: A remote code execution vulnerability was found in the firmware used in some Lenovo printers, which can be caused by a remote user pushing an illegal string to the server-side interface via a script, resulting in a stack overflow.
Key phrases: remote code execution, stack overflow
CVE-2022-34887: Standard users can directly operate and set printer configuration information , such as IP, in some Lenovo Printers without having to authenticate with the administrator password.
CVE-2022-34888: The Remote Mount feature can potentially be abused by valid, authenticated users to make connections to internal services that may not normally be accessible to users. Internal service access controls, as applicable, remain in effect.
CVE-2022-34889: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop 17.1.1 (51537). An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the ACPI virtual device. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the hypervisor. Was ZDI-CAN-16554.
Key phrases: execute arbitrary code, obtain the ability to execute high-privileged, escalate privileges on affected installations of Parallels Desktop
CVE-2022-3489: The WP Hide WordPress plugin through 0.0.2 does not have authorisation and CSRF checks in place when updating the custom_wpadmin_slug settings, allowing unauthenticated attackers to update it with a crafted request
Key phrases: update it with a crafted request, csrf checks
CVE-2022-34890: This vulnerability allows local attackers to disclose sensitive information on affected installations of Parallels Desktop 17.1.1 (51537). An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the Parallels Tools component. The issue results from the lack of proper validation of a user-supplied value prior to dereferencing it as a pointer. An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the kernel. Was ZDI-CAN-16653.
Key phrases: execute arbitrary code, obtain the ability to execute low-privileged, disclose sensitive information on affected installations of Parallels, escalate privilege
CVE-2022-34891: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the update machanism. The product sets incorrect permissions on sensitive files. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-16395.
Key phrases: execute arbitrary code, obtain the ability to execute low-privileged, escalate privileges on affected installations of Parallels Desktop
CVE-2022-34892: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop Parallels Desktop 17.1.1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the update machanism. The issue results from the lack of proper locking when performing operations on an object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-16396.
Key phrases: execute arbitrary code, obtain the ability to execute low-privileged, escalate privileges on affected installations of Parallels Desktop
CVE-2022-34893: Trend Micro Security 2022 (consumer) has a link following vulnerability where an attacker with lower privileges could manipulate a mountpoint which could lead to escalation of privilege on an affected machine.
Key phrases: mountpoint, escalation of privilege, escalation privilege
CVE-2022-34894: In JetBrains Hub before 2022.2.14799, insufficient access control allowed the hijacking of untrusted services
Key phrases: insufficient access control, hijacking
CVE-2022-34899: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Parallels service. By creating a symbolic link, an attacker can abuse the service to execute a file. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-16134.
Key phrases: execute arbitrary code, obtain the ability to execute low-privileged, escalate privileges on affected installations of Parallels Access
CVE-2022-3490: The Checkout Field Editor (Checkout Manager) for WooCommerce WordPress plugin before 1.8.0 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Key phrases: perform PHP Object Injection when a suitable gadget, php object injection
CVE-2022-34900: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (39313) Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Dispatcher service. The service loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-15213.
Key phrases: execute arbitrary code, obtain the ability to execute low-privileged, escalate privileges on affected installations of Parallels Access
CVE-2022-34901: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Parallels Service. The service executes files from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-16137.
Key phrases: execute arbitrary code, obtain the ability to execute low-privileged, escalate privileges on affected installations of Parallels Access
CVE-2022-34902: This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Desktop Control Agent service. The service loads Qt plugins from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-15787.
Key phrases: execute arbitrary code, obtain the ability to execute low-privileged, escalate privileges on affected installations of Parallels Access
CVE-2022-34903: GnuPG through 2.3.6, in unusual situations where an attacker possesses any secret-key information from a victim's keyring and other constraints (e.g., use of GPGME) are met, allows signature forgery via injection into the status line.
Key phrases: signature forgery via injection into the status line
CVE-2022-34906: A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to decrypt sensitive information saved in FileWave, and even send crafted requests.
Key phrases: decrypt sensitive information saved in FileWave, exploitation, hard coded cryptographic key
CVE-2022-34907: An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. Exploitation could allow an unauthenticated actor to gain access to the system with the highest authority possible and gain full control over the FileWave platform.
Key phrases: authentication bypass, gain access, gain full control, gain access to the system with the highest
CVE-2022-34908: An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It possesses an authentication mechanism; however, some features do not require any token or cookie in a request. Therefore, an attacker may send a simple HTTP request to the right endpoint, and obtain authorization to retrieve application data.
Key phrases: obtain authorization to retrieve application data
CVE-2022-34909: An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It allows SQL Injection, by which an attacker can bypass authentication and retrieve data that is stored in the database.
Key phrases: bypass authentication, SQL Injection, sql injection
CVE-2022-3491: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0742.
Key phrases: heap-based buffer overflow
CVE-2022-34910: An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android. It uses a local database to store data and accounts. However, the password is stored in cleartext. Therefore, an attacker can retrieve the passwords of other users that used the same device.
Key phrases: cleartext
CVE-2022-34911: An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as second parameter, and OutputPage::setPageTitle() uses text().
Key phrases: "Welcome" followed by the username, xss
CVE-2022-34912: An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped.
CVE-2022-34913: md2roff 1.7 has a stack-based buffer overflow via a Markdown file containing a large number of consecutive characters to be processed. NOTE: the vendor's position is that the product is not intended for untrusted input
Key phrases: stack-based buffer overflow, stack based buffer overflow
CVE-2022-34914: Webswing before 22.1.3 allows X-Forwarded-For header injection. The client IP address is associated with a variable in the configuration page. The {clientIp} variable can be used as an application startup argument. The X-Forwarded-For header can be manipulated by a client to store an arbitrary value that is used to replace the clientIp variable (without sanitization). A client can thus inject multiple arguments into the session startup. Systems that do not use the clientIP variable in the configuration are not vulnerable. The vulnerability is fixed in these versions: 20.1.16, 20.2.19, 21.1.8, 21.2.12, and 22.1.3.
Key phrases: store an arbitrary value that is used to, x-forwarded-for header injection
CVE-2022-34916: Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI LDAP data source URI when an attacker has control of the target LDAP server. This issue is fixed by limiting JNDI to allow only the use of the java protocol or no protocol.
Key phrases: only the use of the java protocol or, remote code execution (rce)
CVE-2022-34917: A security vulnerability has been identified in Apache Kafka. It affects all releases since 2.8.0. The vulnerability allows malicious unauthenticated clients to allocate large amounts of memory on brokers. This can lead to brokers hitting OutOfMemoryException and causing denial of service. Example scenarios: - Kafka cluster without authentication: Any clients able to establish a network connection to a broker can trigger the issue. - Kafka cluster with SASL authentication: Any clients able to establish a network connection to a broker, without the need for valid SASL credentials, can trigger the issue. - Kafka cluster with TLS authentication: Only clients able to successfully authenticate via TLS can trigger the issue. We advise the users to upgrade the Kafka installations to one of the 3.2.3, 3.1.2, 3.0.2, 2.8.2 versions.
Key phrases: allocate large amounts of memory on brokers, denial of service
CVE-2022-34918: An issue was discovered in the Linux kernel through 5.18.9. A type confusion bug in nft_set_elem_init (leading to a buffer overflow) could be used by a local attacker to escalate privileges, a different vulnerability than CVE-2022-32250. (The attacker can obtain root access, but must start with an unprivileged user namespace to obtain CAP_NET_ADMIN access.) This can be fixed in nft_setelem_parse_data in net/netfilter/nf_tables_api.c.
Key phrases: obtain root access, obtain CAP_NET_ADMIN access, type confusion bug, buffer overflow, escalate privilege
CVE-2022-34919: The file upload wizard in Zengenti Contensis Classic before 15.2.1.79 does not correctly check that a user has authenticated. By uploading a crafted aspx file, it is possible to execute arbitrary commands.
Key phrases: execute arbitrary commands, file upload
CVE-2022-3492: A vulnerability classified as critical was found in SourceCodester Human Resource Management System 1.0. This vulnerability affects unknown code of the component Profile Photo Handler. The manipulation of the argument parameter leads to os command injection. The attack can be initiated remotely. The identifier of this vulnerability is VDB-210772.
Key phrases: os command injection
CVE-2022-34924: Lanling OA Landray Office Automation (OA) internal patch number #133383/#137780 contains an arbitrary file read vulnerability via the component /sys/ui/extend/varkind/custom.jsp.
Key phrases: arbitrary file read
CVE-2022-34927: MilkyTracker v1.03.00 was discovered to contain a stack overflow via the component LoaderXM::load. This vulnerability is triggered when the program is supplied a crafted XM module file.
Key phrases: stack overflow
CVE-2022-34928: JFinal CMS v5.1.0 was discovered to contain a SQL injection vulnerability via /system/user.
Key phrases: sql injection
CVE-2022-3493: A vulnerability, which was classified as problematic, has been found in SourceCodester Human Resource Management System 1.0. This issue affects some unknown processing of the component Add Employee Handler. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-210773 was assigned to this vulnerability.
Key phrases: cross site scripting
CVE-2022-34937: Yuba u5cms v8.3.5 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component savepage.php. This vulnerability allows attackers to execute arbitrary code.
Key phrases: execute arbitrary code, cross-site request forgery (csrf)
CVE-2022-3494: The Complianz WordPress plugin before 6.3.4, and Complianz Premium WordPress plugin before 6.3.6 allow a translators to inject arbitrary SQL through an unsanitized translation. SQL can be injected through an infected translation file, or by a user with a translator role through translation plugins such as Loco Translate or WPML.
Key phrases: inject arbitrary SQL, inject arbitrary SQL through an unsanitized translation, infected translation file
CVE-2022-34945: Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getproductreport.php.
Key phrases: sql injection
CVE-2022-34946: Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getexpproduct.php.
Key phrases: sql injection
CVE-2022-34947: Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editcategory.php.
Key phrases: sql injection
CVE-2022-34948: Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editbrand.php.
Key phrases: sql injection
CVE-2022-34949: Pharmacy Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the email or password parameter at login.php.
Key phrases: sql injection
CVE-2022-3495: A vulnerability has been found in SourceCodester Simple Online Public Access Catalog 1.0 and classified as critical. This vulnerability affects unknown code of the file /opac/Actions.php?a=login of the component Admin Login. The manipulation of the argument username/password leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210784.
Key phrases: sql injection
CVE-2022-34950: Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editproduct.php.
Key phrases: sql injection
CVE-2022-34951: Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getsalereport.php.
Key phrases: sql injection
CVE-2022-34952: Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edituser.php.
Key phrases: sql injection
CVE-2022-34953: Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the startDate parameter at getOrderReport.php.
Key phrases: sql injection
CVE-2022-34954: Pharmacy Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at invoiceprint.php.
Key phrases: sql injection
CVE-2022-34955: Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_topusers.php.
Key phrases: time-based sql injection
CVE-2022-34956: Pligg CMS v2.0.2 was discovered to contain a time-based SQL injection vulnerability via the page_size parameter at load_data_for_groups.php.
Key phrases: time-based sql injection
CVE-2022-3496: A vulnerability was found in SourceCodester Human Resource Management System 1.0 and classified as critical. This issue affects some unknown processing of the file employeeadd.php of the component Admin Panel. The manipulation leads to improper access controls. The attack may be initiated remotely. The identifier VDB-210785 was assigned to this vulnerability.
Key phrases: improper access control
CVE-2022-34960: The container package in MikroTik RouterOS 7.4beta4 allows an attacker to create mount points pointing to symbolic links, which resolve to locations on the host device. This allows the attacker to mount any arbitrary file to any location on the host.
Key phrases: create mount points pointing to symbolic links, mount any arbitrary file to any location on
CVE-2022-34961: OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Users Timeline module.
Key phrases: stored cross-site scripting (xss)
CVE-2022-34962: OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Group Timeline module.
Key phrases: stored cross-site scripting (xss)
CVE-2022-34963: OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the News Feed module.
Key phrases: stored cross-site scripting (xss)
CVE-2022-34964: OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain a stored cross-site scripting (XSS) vulnerability via the SitePages module.
Key phrases: stored cross-site scripting (xss)
CVE-2022-34965: OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an arbitrary file upload vulnerability via the component /ossn/administrator/com_installer. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-34966: OpenTeknik LLC OSSN OPEN SOURCE SOCIAL NETWORK v6.3 LTS was discovered to contain an HTML injection vulnerability via the location parameter at http://ip_address/:port/ossn/home.
Key phrases: html injection
CVE-2022-34967: The assertion `stmt->Dbc->FirstStmt' failed in MonetDB Database Server v11.43.13.
CVE-2022-34968: An issue in the fetch_step function in Percona Server for MySQL v8.0.28-19 allows attackers to cause a Denial of Service (DoS) via a SQL query.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), denial of service (dos)
CVE-2022-34969: PingCAP TiDB v6.1.0 was discovered to contain a NULL pointer dereference.
Key phrases: null pointer dereference
CVE-2022-3497: A vulnerability was found in SourceCodester Human Resource Management System 1.0. It has been classified as problematic. Affected is an unknown function of the component Master List. The manipulation of the argument city/state/country/position leads to cross site scripting. It is possible to launch the attack remotely. VDB-210786 is the identifier assigned to this vulnerability.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-34970: Crow before 1.0+4 has a heap-based buffer overflow via the function qs_parse in query_string.h. On successful exploitation this vulnerability allows attackers to remotely execute arbitrary code in the context of the vulnerable service.
Key phrases: execute arbitrary code, remotely execute arbitrary code in the context of, heap-based buffer overflow, heap based buffer overflow
CVE-2022-34971: An arbitrary file upload vulnerability in the Advertising Management module of Feehi CMS v2.1.1 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-34972: So Filter Shop v3.x was discovered to contain multiple blind SQL injection vulnerabilities via the att_value_id , manu_value_id , opt_value_id , and subcate_value_id parameters at /index.php?route=extension/module/so_filter_shop_by/filter_data.
Key phrases: sql injection
CVE-2022-34973: D-Link DIR820LA1_FW106B02 was discovered to contain a buffer overflow via the nextPage parameter at ping.ccp.
Key phrases: buffer overflow
CVE-2022-34974: D-Link DIR810LA1_FW102B22 was discovered to contain a command injection vulnerability via the Ping_addr function.
Key phrases: command injection
CVE-2022-34981: The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.
Key phrases: code execution backdoor
CVE-2022-34982: The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.
Key phrases: code execution backdoor
CVE-2022-34983: The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party.
Key phrases: code execution backdoor
CVE-2022-34988: Inout Blockchain AltExchanger v1.2.1 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/js.
Key phrases: cross-site scripting (xss)
CVE-2022-34989: Fruits Bazar v1.0 was discovered to contain a SQL injection vulnerability via the recover_email parameter at user_password_recover.php.
Key phrases: sql injection
CVE-2022-3499: An authenticated attacker could utilize the identical agent and cluster node linking keys to potentially allow for a scenario where unauthorized disclosure of agent logs and data is present.
Key phrases: for a scenario where unauthorized disclosure of agent
CVE-2022-34991: Paymoney v3.3 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the first_name and last_name parameters.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-34992: Luadec v0.9.9 was discovered to contain a heap-buffer overflow via the function UnsetPending.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-34993: Totolink A3600R_Firmware V4.1.2cu.5182_B20201102 contains a hard code password for root in /etc/shadow.sample.
Key phrases: hard code password, hard coded password
CVE-2022-34998: JPEGDEC commit be4843c was discovered to contain a global buffer overflow via JPEGDecodeMCU at /src/jpeg.inl.
Key phrases: global buffer overflow
CVE-2022-34999: JPEGDEC commit be4843c was discovered to contain a FPE via DecodeJPEG at /src/jpeg.inl.
Key phrases: fpe
CVE-2022-3500: A vulnerability was found in keylime. This security issue happens in some circumstances, due to some improperly handled exceptions, there exists the possibility that a rogue agent could create errors on the verifier that stopped attestation attempts for that host leaving it in an attested state but not verifying that anymore.
CVE-2022-35000: JPEGDEC commit be4843c was discovered to contain a segmentation fault via fseek at /libio/fseek.c.
Key phrases: segmentation fault
CVE-2022-35002: JPEGDEC commit be4843c was discovered to contain a segmentation fault via TIFFSHORT at /src/jpeg.inl.
Key phrases: segmentation fault, tiffshort
CVE-2022-35003: JPEGDEC commit be4843c was discovered to contain a global buffer overflow via ucDitherBuffer at /src/jpeg.inl.
Key phrases: global buffer overflow
CVE-2022-35004: JPEGDEC commit be4843c was discovered to contain a FPE via TIFFSHORT at /src/jpeg.inl.
Key phrases: fpe, tiffshort
CVE-2022-35007: PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via __interceptor_fwrite.part.57 at sanitizer_common_interceptors.inc.
Key phrases: heap buffer overflow
CVE-2022-35008: PNGDec commit 8abf6be was discovered to contain a stack overflow via /linux/main.cpp.
Key phrases: stack overflow
CVE-2022-35009: PNGDec commit 8abf6be was discovered to contain a memory allocation problem via asan_malloc_linux.cpp.
Key phrases: memory allocation problem
CVE-2022-3501: Article template contents with sensitive data could be accessed from agents without permissions.
Key phrases: agents without permissions
CVE-2022-35010: PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via asan_interceptors_memintrinsics.cpp.
Key phrases: heap buffer overflow
CVE-2022-35011: PNGDec commit 8abf6be was discovered to contain a global buffer overflow via inflate_fast at /src/inffast.c.
Key phrases: global buffer overflow
CVE-2022-35012: PNGDec commit 8abf6be was discovered to contain a heap buffer overflow via SaveBMP at /linux/main.cpp.
Key phrases: heap buffer overflow
CVE-2022-35013: PNGDec commit 8abf6be was discovered to contain a FPE via SaveBMP at /linux/main.cpp.
Key phrases: fpe
CVE-2022-35014: Advancecomp v2.3 contains a segmentation fault.
Key phrases: segmentation fault
CVE-2022-35015: Advancecomp v2.3 was discovered to contain a heap buffer overflow via le_uint32_read at /lib/endianrw.h.
Key phrases: heap buffer overflow
CVE-2022-35016: Advancecomp v2.3 was discovered to contain a heap buffer overflow.
Key phrases: heap buffer overflow
CVE-2022-35017: Advancecomp v2.3 was discovered to contain a heap buffer overflow.
Key phrases: heap buffer overflow
CVE-2022-35018: Advancecomp v2.3 was discovered to contain a segmentation fault.
Key phrases: segmentation fault
CVE-2022-35019: Advancecomp v2.3 was discovered to contain a segmentation fault.
Key phrases: segmentation fault
CVE-2022-3502: A vulnerability was found in Human Resource Management System 1.0. It has been classified as problematic. This affects an unknown part of the component Leave Handler. The manipulation of the argument Reason leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-210831.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-35020: Advancecomp v2.3 was discovered to contain a heap buffer overflow via the component __interceptor_memcpy at /sanitizer_common/sanitizer_common_interceptors.inc.
Key phrases: heap buffer overflow
CVE-2022-35021: OTFCC commit 617837b was discovered to contain a global buffer overflow via /release-x64/otfccdump+0x718693.
Key phrases: global buffer overflow
CVE-2022-35022: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6badae.
Key phrases: segmentation violation
CVE-2022-35023: OTFCC commit 617837b was discovered to contain a segmentation violation via /lib/x86_64-linux-gnu/libc.so.6+0xbb384.
Key phrases: segmentation violation
CVE-2022-35024: OTFCC commit 617837b was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S.
Key phrases: segmentation violation
CVE-2022-35025: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x5266a8.
Key phrases: segmentation violation
CVE-2022-35026: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbc0b.
Key phrases: segmentation violation
CVE-2022-35027: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe9a7.
Key phrases: segmentation violation
CVE-2022-35028: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fbbb6.
Key phrases: segmentation violation
CVE-2022-35029: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6babea.
Key phrases: segmentation violation
CVE-2022-3503: A vulnerability was found in SourceCodester Purchase Order Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Supplier Handler. The manipulation of the argument Supplier Name/Address/Contact person/Contact leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210832.
Key phrases: cross site scripting
CVE-2022-35030: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x4fe954.
Key phrases: segmentation violation
CVE-2022-35031: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x703969.
Key phrases: segmentation violation
CVE-2022-35032: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x6b6a8f.
Key phrases: segmentation violation
CVE-2022-35034: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e7e3d.
Key phrases: heap buffer overflow
CVE-2022-35035: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b559f.
Key phrases: heap buffer overflow
CVE-2022-35036: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e1fc8.
Key phrases: heap buffer overflow
CVE-2022-35037: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6adb1e.
Key phrases: heap buffer overflow
CVE-2022-35038: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b064d.
Key phrases: heap buffer overflow
CVE-2022-35039: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e20a0.
Key phrases: heap buffer overflow
CVE-2022-3504: A vulnerability was found in SourceCodester Sanitization Management System and classified as critical. This issue affects some unknown processing of the file /php-sms/?p=services/view_service. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-210839.
Key phrases: sql injection
CVE-2022-35040: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b5567.
Key phrases: heap buffer overflow
CVE-2022-35041: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b558f.
Key phrases: heap buffer overflow
CVE-2022-35042: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x4adb11.
Key phrases: heap buffer overflow
CVE-2022-35043: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c08a6.
Key phrases: heap buffer overflow
CVE-2022-35044: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x617087.
Key phrases: heap buffer overflow
CVE-2022-35045: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0d63.
Key phrases: heap buffer overflow
CVE-2022-35046: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0466.
Key phrases: heap buffer overflow
CVE-2022-35047: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b05aa.
Key phrases: heap buffer overflow
CVE-2022-35048: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0b2c.
Key phrases: heap buffer overflow
CVE-2022-35049: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b03b5.
Key phrases: heap buffer overflow
CVE-2022-3505: A vulnerability was found in SourceCodester Sanitization Management System. It has been classified as problematic. Affected is an unknown function of the file /php-sms/admin/. The manipulation of the argument page leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210840.
Key phrases: cross site scripting, cross-site scripting
CVE-2022-35050: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b04de.
Key phrases: heap buffer overflow
CVE-2022-35051: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b55af.
Key phrases: heap buffer overflow
CVE-2022-35052: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b84b1.
Key phrases: heap buffer overflow
CVE-2022-35053: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x61731f.
Key phrases: heap buffer overflow
CVE-2022-35054: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6171b2.
Key phrases: heap buffer overflow
CVE-2022-35055: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0473.
Key phrases: heap buffer overflow
CVE-2022-35056: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b0478.
Key phrases: heap buffer overflow
CVE-2022-35058: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b05ce.
Key phrases: heap buffer overflow
CVE-2022-35059: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0414.
Key phrases: heap buffer overflow
CVE-2022-3506: Cross-site Scripting (XSS) - Stored in GitHub repository barrykooij/related-posts-for-wp prior to 2.1.3.
Key phrases: cross-site scripting (xss)
CVE-2022-35060: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0a32.
Key phrases: heap buffer overflow
CVE-2022-35061: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e412a.
Key phrases: heap buffer overflow
CVE-2022-35062: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6c0bc3.
Key phrases: heap buffer overflow
CVE-2022-35063: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41a8.
Key phrases: heap buffer overflow
CVE-2022-35064: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x4adcdb in __asan_memset.
Key phrases: heap buffer overflow
CVE-2022-35065: OTFCC commit 617837b was discovered to contain a segmentation violation via /release-x64/otfccdump+0x65f724.
Key phrases: segmentation violation
CVE-2022-35066: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b8.
Key phrases: heap buffer overflow
CVE-2022-35067: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e41b0.
Key phrases: heap buffer overflow
CVE-2022-35068: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6e420d.
Key phrases: heap buffer overflow
CVE-2022-35069: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x6b544e.
Key phrases: heap buffer overflow
CVE-2022-35070: OTFCC commit 617837b was discovered to contain a heap buffer overflow via /release-x64/otfccdump+0x65fc97.
Key phrases: heap buffer overflow
CVE-2022-35080: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via png_load at /lib/png.c.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-35081: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via png_read_header at /src/png2swf.c.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-35085: SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c.
Key phrases: memory leak
CVE-2022-35086: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via /multiarch/memmove-vec-unaligned-erms.S.
Key phrases: segmentation violation
CVE-2022-35087: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via MovieAddFrame at /src/gif2swf.c.
Key phrases: segmentation violation
CVE-2022-35088: SWFTools commit 772e55a2 was discovered to contain a heap buffer-overflow via getGifDelayTime at /home/bupt/Desktop/swftools/src/src/gif2swf.c.
Key phrases: heap buffer-overflow, heap buffer overflow
CVE-2022-35089: SWFTools commit 772e55a2 was discovered to contain a heap-buffer-overflow via getTransparentColor at /home/bupt/Desktop/swftools/src/gif2swf.
Key phrases: heap-buffer-overflow, heap buffer overflow
CVE-2022-3509: A parsing issue similar to CVE-2022-3171, but with textformat in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Key phrases: garbage collection pauses, denial of service
CVE-2022-35090: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via __asan_memcpy at /asan/asan_interceptors_memintrinsics.cpp:.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-35091: SWFTools commit 772e55a2 was discovered to contain a floating point exception (FPE) via DCTStream::readMCURow() at /xpdf/Stream.cc.ow()
Key phrases: floating point exception (fpe)
CVE-2022-35092: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via convert_gfxline at /gfxpoly/convert.c.
Key phrases: segmentation violation
CVE-2022-35093: SWFTools commit 772e55a2 was discovered to contain a global buffer overflow via DCTStream::transformDataUnit at /xpdf/Stream.cc.
Key phrases: global buffer overflow
CVE-2022-35094: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via DCTStream::readHuffSym(DCTHuffTable*) at /xpdf/Stream.cc.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-35095: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via InfoOutputDev::type3D1 at /pdf/InfoOutputDev.cc.
Key phrases: segmentation violation
CVE-2022-35096: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via draw_stroke at /gfxpoly/stroke.c.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-35097: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via FoFiTrueType::writeTTF at /xpdf/FoFiTrueType.cc.
Key phrases: segmentation violation
CVE-2022-35098: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via GfxICCBasedColorSpace::getDefaultColor(GfxColor*) at /xpdf/GfxState.cc.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-35099: SWFTools commit 772e55a2 was discovered to contain a stack overflow via ImageStream::getPixel(unsigned char*) at /xpdf/Stream.cc.
Key phrases: stack overflow
CVE-2022-3510: A parsing issue similar to CVE-2022-3171, but with Message-Type Extensions in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above.
Key phrases: garbage collection pauses, denial of service
CVE-2022-35100: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via gfxline_getbbox at /lib/gfxtools.c.
Key phrases: segmentation violation
CVE-2022-35101: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via /multiarch/memset-vec-unaligned-erms.S.
Key phrases: segmentation violation
CVE-2022-35104: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via DCTStream::reset() at /xpdf/Stream.cc.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-35105: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via /bin/png2swf+0x552cea.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-35106: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via FoFiTrueType::computeTableChecksum(unsigned char*, int) at /xpdf/FoFiTrueType.cc.
Key phrases: segmentation violation
CVE-2022-35107: SWFTools commit 772e55a2 was discovered to contain a stack overflow via vfprintf at /stdio-common/vfprintf.c.
Key phrases: stack overflow
CVE-2022-35108: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via DCTStream::getChar() at /xpdf/Stream.cc.
Key phrases: segmentation violation
CVE-2022-35109: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via draw_stroke at /gfxpoly/stroke.c.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-3511: The Awesome Support WordPress plugin before 6.1.2 does not ensure that the exported tickets archive to be downloaded belongs to the user making the request, allowing a low privileged user, such as subscriber to download arbitrary exported tickets via an IDOR vector
Key phrases: download arbitrary exported tickets via an IDOR vector, idor vector
CVE-2022-35110: SWFTools commit 772e55a2 was discovered to contain a memory leak via /lib/mem.c.
Key phrases: memory leak
CVE-2022-35111: SWFTools commit 772e55a2 was discovered to contain a stack overflow via __sanitizer::StackDepotNode::hash(__sanitizer::StackTrace const&) at /sanitizer_common/sanitizer_stackdepot.cpp.
Key phrases: stack overflow
CVE-2022-35113: SWFTools commit 772e55a2 was discovered to contain a heap-buffer overflow via swf_DefineLosslessBitsTagToImage at /modules/swfbits.c.
Key phrases: heap-buffer overflow, heap buffer overflow
CVE-2022-35114: SWFTools commit 772e55a2 was discovered to contain a segmentation violation via extractFrame at /readers/swf.c.
Key phrases: segmentation violation
CVE-2022-35115: IceWarp WebClient DC2 - Update 2 Build 9 (13.0.2.9) was discovered to contain a SQL injection vulnerability via the search parameter at /webmail/server/webmail.php.
Key phrases: sql injection
CVE-2022-35117: Clinic's Patient Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via update_medicine_details.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Packing text box under the Update Medical Details module.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-35118: PyroCMS v3.9 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities.
Key phrases: cross-site scripting (xss)
CVE-2022-3512: Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint.
Key phrases: bypass the "Lock WARP switch" feature resulting
CVE-2022-35120: IXPdata EasyInstall 6.6.14725 contains an access control issue.
Key phrases: access control issue
CVE-2022-35121: Novel-Plus v3.6.1 was discovered to contain a SQL injection vulnerability via the keyword parameter at /service/impl/BookServiceImpl.java.
Key phrases: sql injection
CVE-2022-35122: An access control issue in Ecowitt GW1100 Series Weather Stations <=GW1100B_v2.1.5 allows unauthenticated attackers to access sensitive information including device and local WiFi passwords.
Key phrases: access sensitive information including device and local WiFi, access control issue