yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-38534: TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setdiagnosicfg function.
Key phrases: remote code execution (rce)
CVE-2022-38535: TOTOLINK-720R v4.1.5cu.374 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg function.
Key phrases: remote code execution (rce)
CVE-2022-38537: Archery v1.4.5 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_file, end_file, start_time, and stop_time parameters in the binlog2sql interface.
Key phrases: sql injection
CVE-2022-38538: Archery v1.7.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the checksum parameter in the report module.
Key phrases: sql injection
CVE-2022-38539: Archery v1.7.5 to v1.8.5 was discovered to contain a SQL injection vulnerability via the where parameter at /archive/apply.
Key phrases: sql injection
CVE-2022-3854: A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service.
Key phrases: denial of service, crash
CVE-2022-38540: Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the create_kill_session interface.
Key phrases: sql injection
CVE-2022-38541: Archery v1.8.3 to v1.8.5 was discovered to contain multiple SQL injection vulnerabilities via the start_time and stop_time parameters in the my2sql interface.
Key phrases: sql injection
CVE-2022-38542: Archery v1.4.0 to v1.8.5 was discovered to contain a SQL injection vulnerability via the ThreadIDs parameter in the kill_session interface. The project has released an update, please upgrade to v1.9.0 and above.
Key phrases: sql injection
CVE-2022-38545: Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted POST request, remote code execution (rce)
CVE-2022-38546: A DNS misconfiguration was found in Zyxel NBG7510 firmware versions prior to V1.00(ABZY.3)C0, which could allow an unauthenticated attacker to access the DNS server when the device is switched to the AP mode.
Key phrases: access the DNS server when the device is, dns misconfiguration
CVE-2022-38547: A post-authentication command injection vulnerability in the CLI command of Zyxel ZyWALL/USG series firmware versions 4.20 through 4.72, VPN series firmware versions 4.30 through 5.32, USG FLEX series firmware versions 4.50 through 5.32, and ATP series firmware versions 4.32 through 5.32, which could allow an authenticated attacker with administrator privileges to execute OS commands.
Key phrases: execute OS commands, post-authentication command injection
CVE-2022-3855: The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-38550: A stored cross-site scripting (XSS) vulnerability in the /weibo/list component of Jeesns v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-38553: Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-38555: Linksys E1200 v1.0.04 is vulnerable to Buffer Overflow via ej_get_web_page_name.
Key phrases: buffer overflow
CVE-2022-38556: Trendnet TEW733GR v1.03B01 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
Key phrases: static default credential
CVE-2022-38557: D-Link DIR845L v1.00-v1.03 contains a Static Default Credential vulnerability in /etc/init0.d/S80telnetd.sh.
Key phrases: static default credential
CVE-2022-3856: The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
Key phrases: sql injection
CVE-2022-38562: Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to cause a Denial of Service (DoS) via the lan parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2022-38563: Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to cause a Denial of Service (DoS) via the MACAddr parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2022-38564: Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow vulnerability in the function formSetPicListItem. This vulnerability allows attackers to cause a Denial of Service (DoS) via the adItemUID parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), buffer overflow, denial of service (dos)
CVE-2022-38565: Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to cause a Denial of Service (DoS) via the mailpwd parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2022-38566: Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formEmailTest. This vulnerability allows attackers to cause a Denial of Service (DoS) via the mailname parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2022-38567: Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow vulnerability in the function formSetAdConfigInfo. This vulnerability allows attackers to cause a Denial of Service (DoS) via the authIPs parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2022-38568: Tenda M3 V1.0.0.12(4856) was discovered to contain a heap buffer overflow vulnerability in the function formSetFixTools. This vulnerability allows attackers to cause a Denial of Service (DoS) via the hostname parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2022-38569: Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelAd.
Key phrases: stack overflow
CVE-2022-3857: A flaw was found in libpng 1.6.38. A crafted PNG image can lead to a segmentation fault and denial of service in png_setup_paeth_row() function.
Key phrases: denial of service, segmentation fault
CVE-2022-38570: Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow in the function formDelPushedAd. This vulnerability allows attackers to cause a Denial of Service (DoS) via the adPushUID parameter.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2022-38571: Tenda M3 V1.0.0.12(4856) was discovered to contain a buffer overflow in the function formSetGuideListItem.
Key phrases: buffer overflow
CVE-2022-38573: 10-Strike Network Inventory Explorer v9.3 was discovered to contain a buffer overflow via the Add Computers function.
Key phrases: buffer overflow
CVE-2022-38576: Interview Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /interview/delete.php?action=deletecand&id=.
Key phrases: sql injection
CVE-2022-38577: ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators.
Key phrases: escalate normal users to Administrators, insecure permissions
CVE-2022-3858: The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin.
Key phrases: sql injection
CVE-2022-38580: Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF).
Key phrases: server-side request forgery (ssrf)
CVE-2022-38582: Incorrect access control in the anti-virus driver wsdkd.sys of Watchdog Antivirus v1.4.158 allows attackers to write arbitrary files.
Key phrases: write arbitrary files, incorrect access control
CVE-2022-38583: On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sage 300 server to view and/or modify the credentials associated with Sage 300 users and SQL accounts to impersonate users and/or access the SQL database as a system administrator. With system administrator-level access to the Sage 300 MS SQL database it would be possible to create, update, and delete all records associated with the program and, depending on the configuration, execute code on the underlying database server.
Key phrases: impersonate, execute code
CVE-2022-3859: An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8.  This allows an attacker with admin access, which is required to place the DLL in the restricted Windows System folder, to elevate their privileges to System by placing a malicious DLL there.
Key phrases: place the DLL in the restricted Windows System, search path, elevate privileges
CVE-2022-38594: Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_visitor.php.
Key phrases: sql injection
CVE-2022-38595: Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_user.php.
Key phrases: sql injection
CVE-2022-38599: Teleport v3.2.2, Teleport v3.5.6-rc6, and Teleport v3.6.3-b2 was discovered to contain an information leak via the /user/get-role-list web interface.
Key phrases: information leak
CVE-2022-3860: The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author.
Key phrases: sql injection
CVE-2022-38600: Mplayer SVN-r38374-13.0.1 is vulnerable to Memory Leak via vf.c and vf_vo.c.
Key phrases: memory leak
CVE-2022-38604: Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability.
Key phrases: arbitrary file deletion
CVE-2022-38605: Church Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/edit_event.php.
Key phrases: sql injection
CVE-2022-38606: Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editcategory.php.
Key phrases: sql injection
CVE-2022-3861: The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_builder_import, mfn_builder_import_page, importdata, importsinglepage, and importfromclipboard functions.  This makes it possible for authenticated attackers, with contributor level permissions and above to inject a PHP Object. The additional presence of a POP chain would make it possible for attackers to execute code, retrieve sensitive data, delete files, etc..
Key phrases: php object injection, pop chain, delete files, execute code
CVE-2022-38610: Garage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /garage/editclient.php.
Key phrases: sql injection
CVE-2022-38611: Incorrect access control in Watchdog Anti-Virus v1.4.158 allows attackers to perform a DLL hijacking attack and execute arbitrary code via a crafted binary.
Key phrases: execute arbitrary code, perform a DLL hijacking attack and execute arbitrary, incorrect access control
CVE-2022-38613: A Path Traversal vulnerability in SmartVista Cardgen v3.28.0 allows authenticated attackers to read arbitrary files in the system.
Key phrases: read arbitrary files, read arbitrary files in the system, path traversal
CVE-2022-38614: An issue in the IGB Files and OutfileService features of SmartVista Cardgen v3.28.0 allows attackers to list and download arbitrary files via modifying the PATH parameter.
Key phrases: download arbitrary files, list and download arbitrary files via modifying the, igb files
CVE-2022-38615: SmartVista SVFE2 v2.2.22 was discovered to contain multiple SQL injection vulnerabilities via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/service_group.jsf.
Key phrases: sql injection
CVE-2022-38616: SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /feegroups/tgrt_group.jsf.
Key phrases: sql injection
CVE-2022-38617: SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the voiceAudit:j_id97 parameter at /SVFE2/pages/audit/voiceaudit.jsf.
Key phrases: sql injection
CVE-2022-38618: SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id88, UserForm:j_id90, and UserForm:j_id92 parameters at /SVFE2/pages/feegroups/country_group.jsf.
Key phrases: sql injection
CVE-2022-38619: SmartVista SVFE2 v2.2.22 was discovered to contain a SQL injection vulnerability via the UserForm:j_id90 parameter at /SVFE2/pages/feegroups/mcc_group.jsf.
Key phrases: sql injection
CVE-2022-3862: The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-38621: Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, remote code execution (rce)
CVE-2022-38625: Patlite NH-FB v1.46 and below was discovered to contain insufficient firmware validation during the upgrade firmware file upload process. This vulnerability allows authenticated attackers to create and upload their own custom-built firmware and inject malicious code. NOTE: the vendor's position is that this is a design choice, not a vulnerability
Key phrases: create and upload their own custom-built, insufficient firmware validation, file upload
CVE-2022-38627: Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL injection vulnerability via the idt parameter.
Key phrases: sql injection
CVE-2022-38628: Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a cross-site scripting (XSS) vulnerability which is chained with a local session fixation. This vulnerability allows attackers to escalate privileges via unspecified vectors.
Key phrases: escalate privileges via unspecified vectors, cross-site scripting (xss), local session fixation
CVE-2022-3863: Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrome security severity: High)
Key phrases: use after free, heap corruption
CVE-2022-38633: Genymotion Desktop v3.2.1 was discovered to contain a DLL hijacking vulnerability which allows attackers to escalate privileges and execute arbitrary code via a crafted binary.
Key phrases: execute arbitrary code, escalate privileges and execute arbitrary code via a, dll hijacking
CVE-2022-38637: Hospital Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the Username and Password parameters on the Login page.
Key phrases: sql injection
CVE-2022-38638: Casdoor v1.97.3 was discovered to contain an arbitrary file write vulnerability via the fullFilePath parameter at /api/upload-resource.
Key phrases: arbitrary file write
CVE-2022-38639: A cross-site scripting (XSS) vulnerability in Markdown-Nice v1.8.22 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Community Posting field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-3864: A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After restart the device is back to normal operation.An attacker could exploit the vulnerability by first gaining access tothe system with security privileges and attempt to update the IEDwith a malicious update package. Successful exploitation of thisvulnerability will cause the IED to restart, causing a temporary Denial of Service.
Key phrases: relion update package signature validation, temporary denial of service
CVE-2022-38648: Server-Side Request Forgery (SSRF) vulnerability in Batik of Apache XML Graphics allows an attacker to fetch external resources. This issue affects Apache XML Graphics Batik 1.14.
Key phrases: fetch external resources, server-side request forgery (ssrf)
CVE-2022-38649: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airflow Pinot Provider versions prior to 4.0.0. It also impacts any Apache Airflow versions prior to 2.3.0 in case Apache Airflow Pinot Provider is installed (Apache Airflow Pinot Provider 4.0.0 can only be installed for Airflow 2.3.0+). Note that you need to manually install the Pinot Provider version 4.0.0 in order to get rid of the vulnerability on top of Airflow 2.3.0+ version.
Key phrases: control commands executed in the task execution context, os command injection
CVE-2022-3865: The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin
Key phrases: sql injection
CVE-2022-38650: A remote unauthenticated insecure deserialization vulnerability exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to run arbitrary code or malware within Hyperic Server and the host operating system with the privileges of the Hyperic server process. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: run arbitrary code or malware, remote unauthenticated insecure deserialization
CVE-2022-38651: A security filter misconfiguration exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to bypass some authentication requirements when issuing requests to Hyperic Server. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: bypass some authentication, security filter misconfiguration, affects products, bypass authentication
CVE-2022-38652: A remote insecure deserialization vulnerability exixsts in VMWare Hyperic Agent 5.8.6. Exploitation of this vulnerability enables a malicious authenticated user to run arbitrary code or malware within a Hyperic Agent instance and its host operating system with the privileges of the Hyperic Agent process (often SYSTEM on Windows platforms). NOTE: prior exploitation of CVE-2022-38650 results in the disclosure of the authentication material required to exploit this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
Key phrases: run arbitrary code or malware, remote insecure deserialization, disclosure
CVE-2022-38653: In HCL Digital Experience, customized XSS payload can be constructed such that it is served in the application unencoded.
Key phrases: xss payload
CVE-2022-38654: HCL Domino is susceptible to an information disclosure vulnerability.  In some scenarios, local calls made on the server to search the Domino directory will ignore xACL read restrictions.  An authenticated attacker could leverage this vulnerability to access attributes from a user's person record.
Key phrases: information disclosure
CVE-2022-38655: BigFix WebUI non-master operators are missing controls that prevent them from being able to modify the relevance of fixlets or to deploy fixlets from the BES Support external site. 
Key phrases: missing controls
CVE-2022-38656: HCL Commerce, when using Elasticsearch, can allow a remote attacker to cause a denial of service attack on the site and make administrative changes.
Key phrases: cause a denial of service attack on the, administrative changes
CVE-2022-38657: An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page.
Key phrases: open redirect
CVE-2022-38658: BigFix deployments that have installed the Notification Service on Windows are susceptible to disclosing SMTP BigFix operator's sensitive data in clear text. Operators who use Notification Service related content from BES Support are at risk of leaving their SMTP sensitive data exposed.
CVE-2022-38659: In specific scenarios, on Windows the operator credentials may be encrypted in a manner that is not completely machine-dependent.
Key phrases: machine-dependent
CVE-2022-3866: HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2.
CVE-2022-38660: HCL XPages applications are susceptible to a Cross Site Request Forgery (CSRF) vulnerability.  An unauthenticated attacker could exploit this vulnerability to perform actions in the application on behalf of the logged in user. 
Key phrases: cross site request forgery (csrf)
CVE-2022-38661: HCL Workload Automation could allow a local user to overwrite key system files which would cause the system to crash.
Key phrases: overwrite key system files which would cause the, hcl workload automation, system to crash
CVE-2022-38662: In HCL Digital Experience, URLs can be constructed to redirect users to untrusted sites.
Key phrases: urls
CVE-2022-38663: Jenkins Git Plugin 4.11.4 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log provided by the Git Username and Password (`gitUsernamePassword`) credentials binding.
CVE-2022-38664: Jenkins Job Configuration History Plugin 1165.v8cc9fd1f4597 and earlier does not escape the job name on the System Configuration History page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to configure job names.
Key phrases: stored cross-site scripting (xss)
CVE-2022-38665: Jenkins CollabNet Plugins Plugin 2.0.8 and earlier stores a RabbitMQ password unencrypted in its global configuration file on the Jenkins controller where it can be viewed by users with access to the Jenkins controller file system.
Key phrases: unencrypted
CVE-2022-38666: Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.146 and earlier unconditionally disables SSL/TLS certificate and hostname validation for several features.
CVE-2022-38667: HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser supports HTTP pipelining, but the asynchronous Connection layer is unaware of HTTP pipelining. Specifically, the Connection layer is unaware that it has begun processing a later request before it has finished processing an earlier request.
Key phrases: a Use-After-Free and code, use-after-free, code execution
CVE-2022-38668: HTTP applications (servers) based on Crow through 1.0+4 may reveal potentially sensitive uninitialized data from stack memory when fulfilling a request for a static file smaller than 16 KB.
Key phrases: uninitialized data
CVE-2022-38669: In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
Key phrases: permission check, elevation of privilege, elevation privilege
CVE-2022-3867: HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2.
Key phrases: token garbage
CVE-2022-38670: In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
Key phrases: permission check, elevation of privilege, elevation privilege
CVE-2022-38671: In camera driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-38672: In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-38673: In face detect driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-38674: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-38675: In  gpu driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-38676: In gpu driver, there is a possible out of bounds write due to a missing bounds check. This could lead to local denial of service in kernel.
Key phrases: out of bounds write, missing bounds check, local denial of service
CVE-2022-38677: In cell service, there is a missing permission check. This could lead to local denial of service in cell service with no additional execution privileges needed.
Key phrases: missing permission check, local denial of service
CVE-2022-38678: In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-38679: In music service, there is a missing permission check. This could lead to local denial of service in music service with no additional execution privileges needed.
Key phrases: missing permission check, local denial of service
CVE-2022-3868: A vulnerability classified as critical has been found in SourceCodester Sanitization Management System. Affected is an unknown function of the file /php-sms/classes/Master.php?f=save_quote. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213012.
Key phrases: sql injection
CVE-2022-38680: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-38681: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-38682: In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-38683: In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-38684: In contacts service, there is a missing permission check. This could lead to local denial of service in contacts service with no additional execution privileges needed.
Key phrases: permission check, local denial of service
CVE-2022-38685: In bluetooth service, there is a possible missing permission check. This could lead to local denial of service in bluetooth service with no additional execution privileges needed.
Key phrases: missing permission check, local denial of service
CVE-2022-38686: In wlan driver, there is a possible missing params check. This could lead to local denial of service in wlan services.
Key phrases: missing params check, local denial of service
CVE-2022-38687: In messaging service, there is a missing permission check. This could lead to local denial of service in messaging service with no additional execution privileges needed.
Key phrases: missing permission check, local denial of service
CVE-2022-38688: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-38689: In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
Key phrases: missing permission check, local information disclosure
CVE-2022-3869: Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.
Key phrases: code injection
CVE-2022-38690: In camera driver, there is a possible memory corruption due to improper locking. This could lead to local denial of service in kernel.
Key phrases: memory corruption, improper locking, local denial of service
CVE-2022-38697: In messaging service, there is a missing permission check. This could lead to access unexpected provider in contacts service with no additional execution privileges needed.
Key phrases: permission check
CVE-2022-38698: In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
Key phrases: permission check, elevation of privilege, elevation privilege
CVE-2022-38699: Armoury Crate Services logging function has insufficient validation to check if the log file is a symbolic link. A physical attacker with general user privilege can modify the log file property to a symbolic link that points to arbitrary system file, causing the logging function to overwrite the system file and disrupt the system.
Key phrases: insufficient validation, symbolic link, disrupt the system
CVE-2022-3870: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility.
Key phrases: download user avatars using the victim's user, public level visibility
CVE-2022-38700: OpenHarmony-v3.1.1 and prior versions have a permission bypass vulnerability. LAN attackers can bypass permission control and get control of camera service.
Key phrases: bypass permission, permission bypass
CVE-2022-38701: OpenHarmony-v3.1.2 and prior versions have a heap overflow vulnerability. Local attackers can trigger a heap overflow and get network sensitive information.
Key phrases: heap overflow, network sensitive information
CVE-2022-38702: Improper Neutralization of Formula Elements in a CSV File vulnerability in Nakashima Masahiro WP CSV Exporter.This issue affects WP CSV Exporter: from n/a through 2.0.
Key phrases: improper neutralization of formula elements
CVE-2022-38703: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Max Foundry Button Plugin MaxButtons plugin <= 9.2 at WordPress
Key phrases: stored cross-site scripting (xss)
CVE-2022-38704: Cross-Site Request Forgery (CSRF) vulnerability in SEO Redirection plugin <= 8.9 at WordPress, leading to deletion of 404 errors and redirection history.
Key phrases: cross-site request forgery (csrf), deletion of errors, redirection history
CVE-2022-38705: IBM CICS TX 11.1 Standard and Advanced could allow a remote attacker to bypass security restrictions, caused by a reverse tabnabbing flaw. An attacker could exploit this vulnerability and redirect a victim to a phishing site. IBM X-Force ID: 234172.
Key phrases: bypass security restrictions, reverse tabnabbing flaw
CVE-2022-38707: IBM Cognos Command Center 10.2.4.1 could allow a local attacker to obtain sensitive information due to insufficient session expiration.  IBM X-Force ID:  234179.
Key phrases: obtain sensitive information, obtain sensitive information due to insufficient session expiration
CVE-2022-38708: IBM Cognos Analytics 11.1.7 11.2.0, and 11.2.1 could be vulnerable to a Server-Side Request Forgery Attack (SSRF) attack by constructing URLs from user-controlled data. This could enable attackers to make arbitrary requests to the internal network or to the local file system. IBM X-Force ID: 234180.
Key phrases: make arbitrary requests, server-side request forgery attack (ssrf)
CVE-2022-38709: IBM Robotic Process Automation 21.0.1, 21.0.2, and 21.0.3 for Cloud Pak is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 234291.
Key phrases: embed arbitrary JavaScript code, embed arbitrary JavaScript code in the Web UI, cross-site scripting, credentials disclosure
CVE-2022-38710: "IBM Robotic Process Automation 21.0.1 and 21.0.2 could disclose sensitive version information that could aid in further attacks against the system. IBM X-Force ID: 234292."
Key phrases: sensitive version information
CVE-2022-38712: "IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 Web services could allow a man-in-the-middle attacker to conduct SOAPAction spoofing to execute unwanted or unauthorized operations. IBM X-Force ID: 234762."
Key phrases: conduct SOAPAction spoofing to execute unwanted or unauthorized, soapaction spoofing, unwanted or unauthorized operations, man in the middle
CVE-2022-38715: A leftover debug code vulnerability exists in the httpd shell.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability.
Key phrases: leftover debug code, remote code execution
CVE-2022-38716: Cross-Site Request Forgery (CSRF) vulnerability in StylemixThemes Motors  Car Dealer, Classifieds & Listing plugin <=1.4.4 versions.
Key phrases: cross-site request forgery (csrf)
CVE-2022-3872: An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Key phrases: denial of service condition, crash
CVE-2022-38723: Gravitee API Management before 3.15.13 allows path traversal through HTML injection.
Key phrases: path traversal through HTML injection, html injection
CVE-2022-38724: Silverstripe silverstripe/framework through 4.11.0, silverstripe/assets through 1.11.0, and silverstripe/asset-admin through 1.11.0 allow XSS.
Key phrases: XSS, xss
CVE-2022-38725: An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service via crafted syslog input that is mishandled by the tcp or network function. syslog-ng Premium Edition 7.0.30 and syslog-ng Store Box 6.10.0 are also affected.
Key phrases: cause a Denial of Service via crafted syslog, integer overflow, denial of service
CVE-2022-3873: Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2.
Key phrases: cross-site scripting (xss)
CVE-2022-38730: Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by controlling the data-root field inside the DaemonJSON field in the WindowsContainerStartRequest class. This allows exploiting a symlink vulnerability in ..\\\\dataRoot\\\\network\\\\files\\\\local-kv.db because of a TOCTOU race condition.
Key phrases: overwrite any file through the windowscontainers/start, exploiting a symlink vulnerability in ..\\\\dataRoot\\\\network\\\\files\\\\local-, toctou race condition
CVE-2022-38731: Qaelum DOSE 18.08 through 21.1 before 21.2 allows Directory Traversal via the loadimages name parameter. It allows a user to specify an arbitrary location on the server's filesystem from which to load an image. (Only images are displayed to the attacker. All other files are loaded but not displayed.) The Content-Type response header reflects the actual content type of the file being requested. This allows an attacker to enumerate files on the local system. Additionally, remote resources can be requested via a UNC path, allowing an attacker to coerce authentication out from the server to the attackers machine.
Key phrases: specify an arbitrary location on the server's, enumerate files on the local system, coerce authentication out from the server to the, directory traversal
CVE-2022-38732: SnapCenter versions prior to 4.7 shipped without Content Security Policy (CSP) implemented which could allow certain types of attacks that otherwise would be prevented.
Key phrases: certain types of attacks that otherwise would be
CVE-2022-38733: OnCommand Insight versions 7.3.1 through 7.3.14 are susceptible to an authentication bypass vulnerability in the Data Warehouse component.
Key phrases: authentication bypass
CVE-2022-38734: StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. A successful exploit could lead to to a crash of the Local Distribution Router (LDR) service.
Key phrases: Denial of Service (DoS), denial of service (dos), crash
CVE-2022-3874: A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system.
Key phrases: transpile commands through CoreOS and Fedora CoreOS configurations, command injection flaw, arbitrary command execution, arbitrary commands
CVE-2022-38742: Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is vulnerable to a heap-based buffer overflow. An attacker could send a specifically crafted TFTP or HTTPS request, causing a heap-based buffer overflow that crashes the ThinServer process. If successfully exploited, this could expose the server to arbitrary remote code execution.
Key phrases: heap-based buffer overflow, arbitrary remote code execution, heap based buffer overflow, crash
CVE-2022-38743: Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. If successfully exploited, this could allow the attacker to execute arbitrary code and gain access to restricted data.
Key phrases: execute arbitrary code, gain access, execute SQL statements in the back-end, execute arbitrary code and gain access to restricted, access control, improper access control
CVE-2022-38744: An unauthenticated attacker with network access to a victim's Rockwell Automation FactoryTalk Alarm and Events service could open a connection, causing the service to fault and become unavailable. The affected port could be used as a server ping port and uses messages structured with XML.
Key phrases: network access, unavailable
CVE-2022-38745: Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the current directory.
Key phrases: run arbitrary Java code, empty entry
CVE-2022-38749: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Key phrases: denial of service attacks (dos), crash, stackoverflow
CVE-2022-3875: A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component API. The manipulation leads to authentication bypass by assumed-immutable data. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216244.
Key phrases: bypass by assumed-immutable data. The attack, authentication bypass
CVE-2022-38750: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Key phrases: denial of service attacks (dos), crash, stackoverflow
CVE-2022-38751: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stackoverflow.
Key phrases: denial of service attacks (dos), crash, stackoverflow
CVE-2022-38752: Using snakeYAML to parse untrusted YAML files may be vulnerable to Denial of Service attacks (DOS). If the parser is running on user supplied input, an attacker may supply content that causes the parser to crash by stack-overflow.
Key phrases: crash, stack-overflow, stack overflow
CVE-2022-38753: This update resolves a multi-factor authentication bypass attack
Key phrases: bypass attack, authentication bypass, multi-factor authentication bypass
CVE-2022-38754: A potential vulnerability has been identified in Micro Focus Operations Bridge - Containerized. The vulnerability could be exploited by a malicious authenticated OBM (Operations Bridge Manager) user to run Java Scripts in the browser context of another OBM user. Please note: The vulnerability is only applicable if the Operations Bridge Manager capability is deployed. A potential vulnerability has been identified in Micro Focus Operations Bridge Manager (OBM). The vulnerability could be exploited by a malicious authenticated OBM user to run Java Scripts in the browser context of another OBM user. This issue affects: Micro Focus Micro Focus Operations Bridge Manager versions prior to 2022.11. Micro Focus Micro Focus Operations Bridge- Containerized versions prior to 2022.11.
CVE-2022-38755: A vulnerability has been identified in Micro Focus Filr in versions prior to 4.3.1.1. The vulnerability could be exploited to allow a remote unauthenticated attacker to enumerate valid users of the system. Remote unauthenticated user enumeration. This issue affects: Micro Focus Filr versions prior to 4.3.1.1.
Key phrases: enumerate valid users of the system
CVE-2022-38756: A vulnerability has been identified in Micro Focus GroupWise Web in versions prior to 18.4.2. The GW Web component makes a request to the Post Office Agent that contains sensitive information in the query parameters that could be logged by any intervening HTTP proxies.
Key phrases: sensitive information
CVE-2022-38757: A vulnerability has been identified in Micro Focus ZENworks 2020 Update 3a and prior versions. This vulnerability allows administrators with rights to perform actions (e.g., install a bundle) on a set of managed devices, to be able to exercise these rights on managed devices in the ZENworks zone but which are outside the scope of the administrator. This vulnerability does not result in the administrators gaining additional rights on the managed devices, either in the scope or outside the scope of the administrator.
Key phrases: perform actions (e.g.
CVE-2022-38758: Cross-site Scripting (XSS) vulnerability in NetIQ iManager prior to version 3.2.6 allows attacker to execute malicious scripts on the user's browser. This issue affects: Micro Focus NetIQ iManager NetIQ iManager versions prior to 3.2.6 on ALL.
Key phrases: execute malicious scripts on the user's browser, cross-site scripting (xss), all
CVE-2022-3876: A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affects some unknown processing of the file /api/browserextension/UpdatePassword/ of the component API. The manipulation of the argument PasswordID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216245 was assigned to this vulnerability.
Key phrases: authorization bypass
CVE-2022-38764: A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly permissive folder om the product installer.
Key phrases: escalate privlieges due to an overly permissive folder
CVE-2022-38765: Canon Medical Informatics Vitrea Vision 7.7.76.1 does not adequately enforce access controls. An authenticated user is able to gain unauthorized access to imaging records by tampering with the vitrea-view/studies/search patientId parameter.
Key phrases: gain unauthorized access
CVE-2022-38766: The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open request, which allows for a replay attack.
Key phrases: for a replay attack
CVE-2022-38767: An issue was discovered in Wind River VxWorks 6.9 and 7, that allows a specifically crafted packet sent by a Radius server, may cause Denial of Service during the IP Radius access procedure.
Key phrases: a specifically crafted packet sent by a Radius, denial of service
CVE-2022-38768: The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to bypass authorization.
Key phrases: bypass authorization
CVE-2022-38769: The mobile application in Transtek Mojodat FAM (Fixed Asset Management) 2.4.6 allows remote attackers to fetch cleartext passwords upon a successful login request.
Key phrases: fetch cleartext passwords upon a successful login request