yahoo-inc/cve-impacts huggingface dataset:
CVE-2022-42972: A CWE-732: Incorrect Permission Assignment for Critical Resource vulnerability exists that could cause local privilege escalation when a local attacker modifies the webroot directory. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
Key phrases: cwe-732, local privilege escalation
CVE-2022-42973: A CWE-798: Use of Hard-coded Credentials vulnerability exists that could cause local privilege escalation when local attacker connects to the database. Affected Products: APC Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GA), APC Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GA-01-22261), Schneider Electric Easy UPS Online Monitoring Software (Windows 7, 10, 11 & Windows Server 2016, 2019, 2022 - Versions prior to V2.5-GS), Schneider Electric Easy UPS Online Monitoring Software (Windows 11, Windows Server 2019, 2022 - Versions prior to V2.5-GS-01-22261)
Key phrases: cwe-798, local privilege escalation
CVE-2022-42975: socket/transport.ex in Phoenix before 1.6.14 mishandles check_origin wildcarding. NOTE: LiveView applications are unaffected by default because of the presence of a LiveView CSRF token.
CVE-2022-42977: The Netic User Export add-on before 1.3.5 for Atlassian Confluence has the functionality to generate a list of users in the application, and export it. During export, the HTTP request has a fileName parameter that accepts any file on the system (e.g., an SSH private key) to be downloaded.
CVE-2022-42978: In the Netic User Export add-on before 1.3.5 for Atlassian Confluence, authorization is mishandled. An unauthenticated attacker could access files on the remote system.
CVE-2022-42979: Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take over an account via a deep link.
Key phrases: take over an account via a deep link, information disclosure, insecure hostname validation
CVE-2022-4298: The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server.
Key phrases: download arbitrary file, download arbitrary file from the server, authorisation check
CVE-2022-42980: go-admin (aka GO Admin) 2.0.12 uses the string go-admin as a production JWT key.
CVE-2022-42982: BKG Professional NtripCaster 2.0.39 allows querying information over the UDP protocol without authentication. The NTRIP sourcetable is typically quite long (tens of kBs) and can be requested with a packet of only 30 bytes. This presents a vector that can be used for UDP amplification attacks. Normally, only authenticated streaming data will be provided over UDP and not the sourcetable.
Key phrases: querying information over the UDP protocol without authentication, udp amplification
CVE-2022-42983: anji-plus AJ-Report 0.9.8.6 allows remote attackers to bypass login authentication by spoofing JWT Tokens.
Key phrases: bypass login authentication, bypass login authentication by spoofing JWT Tokens, spoofing jwt tokens
CVE-2022-42984: WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients.
Key phrases: sql injection
CVE-2022-42985: The ScratchLogin extension through 1.1 for MediaWiki does not escape verification failure messages, which allows users with administrator privileges to perform cross-site scripting (XSS).
Key phrases: perform cross-site scripting (XSS), verification failure messages, cross-site scripting (xss)
CVE-2022-42989: ERP Sankhya before v4.11b81 was discovered to contain a cross-site scripting (XSS) vulnerability via the component Caixa de Entrada.
Key phrases: cross-site scripting (xss)
CVE-2022-4299: The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
Key phrases: perform Stored Cross-Site Scripting attacks even, stored cross-site scripting, unfiltered_html capability
CVE-2022-42990: Food Ordering Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /foms/all-orders.php?status=Cancelled%20by%20Customer.
Key phrases: sql injection
CVE-2022-42991: A stored cross-site scripting (XSS) vulnerability in Simple Online Public Access Catalog v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Account Full Name field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-42992: Multiple stored cross-site scripting (XSS) vulnerabilities in Train Scheduler App v1.0 allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Train Code, Train Name, and Destination text fields.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-42993: Password Storage Application v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Setup page.
Key phrases: cross-site scripting (xss)
CVE-2022-42998: D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd.
Key phrases: stack overflow
CVE-2022-42999: D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /goform/setSysAdm.
Key phrases: command injection
CVE-2022-4300: A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214901 was assigned to this vulnerability.
CVE-2022-43000: D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4_pskpwd parameter at /goform/form2WizardStep4.
Key phrases: stack overflow
CVE-2022-43001: D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function.
Key phrases: stack overflow
CVE-2022-43002: D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep54_pskpwd parameter at /goform/form2WizardStep54.
Key phrases: stack overflow
CVE-2022-43003: D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setRepeaterSecurity function.
Key phrases: stack overflow
CVE-2022-4301: The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
Key phrases: reflected cross-site scripting
CVE-2022-43014: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the joborderID parameter.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-43015: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the entriesPerPage parameter.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-43016: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callback component.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-43017: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the indexFile component.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-43018: OpenCATS v0.9.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the email parameter in the Check Email function.
Key phrases: reflected cross-site scripting (xss)
CVE-2022-43019: OpenCATS v0.9.6 was discovered to contain a remote code execution (RCE) vulnerability via the getDataGridPager's ajax functionality.
Key phrases: remote code execution (rce)
CVE-2022-4302: The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
Key phrases: perform PHP Object Injection when a suitable gadget, php object injection
CVE-2022-43020: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag update function.
Key phrases: sql injection
CVE-2022-43021: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the entriesPerPage variable.
Key phrases: sql injection
CVE-2022-43022: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the tag_id variable in the Tag deletion function.
Key phrases: sql injection
CVE-2022-43023: OpenCATS v0.9.6 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
Key phrases: sql injection
CVE-2022-43024: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg.
Key phrases: stack overflow
CVE-2022-43025: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the startIp parameter at /goform/SetPptpServerCfg.
Key phrases: stack overflow
CVE-2022-43026: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the endIp parameter at /goform/SetPptpServerCfg.
Key phrases: stack overflow
CVE-2022-43027: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the firewallEn parameter at /goform/SetFirewallCfg.
Key phrases: stack overflow
CVE-2022-43028: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the timeZone parameter at /goform/SetSysTimeCfg.
Key phrases: stack overflow
CVE-2022-43029: Tenda TX3 US_TX3V1.0br_V16.03.13.11_multi_TDE01 was discovered to contain a stack overflow via the time parameter at /goform/SetSysTimeCfg.
Key phrases: stack overflow
CVE-2022-4303: The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms.
Key phrases: bypass IP-based restrictions
CVE-2022-43030: Siyucms v6.1.7 was discovered to contain a remote code execution (RCE) vulnerability in the background. SIYUCMS is a content management system based on ThinkPaP5 AdminLTE. SIYUCMS has a background command execution vulnerability, which can be used by attackers to gain server privileges
Key phrases: gain server privileges, remote code execution (rce), background command execution
CVE-2022-43031: DedeCMS v6.1.9 was discovered to contain a Cross-Site Request Forgery (CSRF) which allows attackers to arbitrarily add Administrator accounts and modify Admin passwords.
Key phrases: arbitrarily add Administrator accounts and modify Admin passwords, cross-site request forgery (csrf)
CVE-2022-43032: An issue was discovered in Bento4 v1.6.0-639. There is a memory leak in AP4_DescriptorFactory::CreateDescriptorFromStream in Core/Ap4DescriptorFactory.cpp, as demonstrated by mp42aac.
Key phrases: memory leak
CVE-2022-43033: An issue was discovered in Bento4 1.6.0-639. There is a bad free in the component AP4_HdlrAtom::~AP4_HdlrAtom() which allows attackers to cause a Denial of Service (DoS) via a crafted input.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), bad free, denial of service (dos)
CVE-2022-43034: An issue was discovered in Bento4 v1.6.0-639. There is a heap buffer overflow vulnerability in the AP4_BitReader::SkipBits(unsigned int) function in mp42ts.
Key phrases: heap buffer overflow
CVE-2022-43035: An issue was discovered in Bento4 v1.6.0-639. There is a heap-buffer-overflow in AP4_Dec3Atom::AP4_Dec3Atom at Ap4Dec3Atom.cpp, leading to a Denial of Service (DoS), as demonstrated by mp42aac.
Key phrases: Denial of Service (DoS), heap-buffer-overflow, denial of service (dos), heap buffer overflow
CVE-2022-43037: An issue was discovered in Bento4 1.6.0-639. There is a memory leak in the function AP4_File::ParseStream in /Core/Ap4File.cpp.
Key phrases: memory leak
CVE-2022-43038: Bento4 v1.6.0-639 was discovered to contain a heap overflow via the AP4_BitReader::ReadCache() function in mp42ts.
Key phrases: heap overflow
CVE-2022-43039: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_meta_restore_items_ref at /isomedia/meta.c.
Key phrases: segmentation violation
CVE-2022-4304: A timing based side channel exists in the OpenSSL RSA Decryption implementationwhich could be sufficient to recover a plaintext across a network in aBleichenbacher style attack. To achieve a successful decryption an attackerwould have to be able to send a very large number of trial messages fordecryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5,RSA-OEAP and RSASVE.For example, in a TLS connection, RSA is commonly used by a client to send anencrypted pre-master secret to the server. An attacker that had observed agenuine connection between a client and a server could use this flaw to sendtrial messages to the server and record the time taken to process them. After asufficiently large number of messages the attacker could recover the pre-mastersecret used for the original connection and thus be able to decrypt theapplication data sent over that connection.
Key phrases: timing based side channel
CVE-2022-43040: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function gf_isom_box_dump_start_ex at /isomedia/box_funcs.c.
Key phrases: heap buffer overflow
CVE-2022-43042: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a heap buffer overflow via the function FixSDTPInTRAF at isomedia/isom_intern.c.
Key phrases: heap buffer overflow
CVE-2022-43043: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function BD_CheckSFTimeOffset at /bifs/field_decode.c.
Key phrases: segmentation violation
CVE-2022-43044: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_isom_get_meta_item_info at /isomedia/meta.c.
Key phrases: segmentation violation
CVE-2022-43045: GPAC 2.1-DEV-rev368-gfd054169b-master was discovered to contain a segmentation violation via the function gf_dump_vrml_sffield at /scene_manager/scene_dump.c.
Key phrases: segmentation violation
CVE-2022-43046: Food Ordering Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /foms/place-order.php.
Key phrases: cross-site scripting (xss)
CVE-2022-43049: Canteen Management System Project v1.0 was discovered to contain a SQL injection vulnerability via the component /youthappam/add-food.php.
Key phrases: sql injection
CVE-2022-4305: The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session.
Key phrases: obtain a valid admin session., authorization checks
CVE-2022-43050: Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component update_profile.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-43051: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete_test.
Key phrases: sql injection
CVE-2022-43052: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Users.php?f=delete.
Key phrases: sql injection
CVE-2022-43058: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms//classes/Master.php?f=delete_activity.
Key phrases: sql injection
CVE-2022-4306: The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission.
Key phrases: reflected cross-site scripting
CVE-2022-43061: Online Tours & Travels Management System v1.0 was discovered to contain an arbitrary file upload vulnerability in the component /operations/travellers.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-43062: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_appointment.
Key phrases: sql injection
CVE-2022-43063: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Users.php?f=delete_client.
Key phrases: sql injection
CVE-2022-43066: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/classes/Master.php?f=delete_message.
Key phrases: sql injection
CVE-2022-43068: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete_reservation.
Key phrases: sql injection
CVE-2022-4307: The ?????? ?????? ?????? WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with XSS payloads, which will be triggered when a high privilege users such as admin visits a page from the plugin.
Key phrases: send a request with XSS payloads, xss payloads
CVE-2022-43071: A stack overflow in the Catalog::readPageLabelTree2(Object*) function of XPDF v4.04 allows attackers to cause a Denial of Service (DoS) via a crafted PDF file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack overflow, denial of service (dos)
CVE-2022-43074: AyaCMS v3.1.2 was discovered to contain an arbitrary file upload vulnerability via the component /admin/fst_upload.inc.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-43076: A cross-site scripting (XSS) vulnerability in /admin/edit-admin.php of Web-Based Student Clearance System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the txtemail parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-43078: A cross-site scripting (XSS) vulnerability in /admin/add-fee.php of Web-Based Student Clearance System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-43079: A cross-site scripting (XSS) vulnerability in /admin/add-fee.php of Train Scheduler App v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-4308: Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked.
Key phrases: Authentication abuse on SiteManager, plaintext storage, leaked
CVE-2022-43081: Fast Food Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the component /fastfood/purchase.php.
Key phrases: sql injection
CVE-2022-43082: A cross-site scripting (XSS) vulnerability in /fastfood/purchase.php of Fast Food Ordering System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the customer parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-43083: An arbitrary file upload vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-43084: A cross-site scripting (XSS) vulnerability in admin-add-vehicle.php of Vehicle Booking System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the v_name parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-43085: An arbitrary file upload vulnerability in add_product.php of Restaurant POS System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-43086: Restaurant POS System v1.0 was discovered to contain a SQL injection vulnerability via update_customer.php.
Key phrases: sql injection
CVE-2022-4309: The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack.
Key phrases: make a logged in admin delete arbitrary users, csrf check
CVE-2022-43096: Mediatrix 4102 before v48.5.2718 allows local attackers to gain root access via the UART port.
Key phrases: gain root access, gain root access via the UART port
CVE-2022-43097: Phpgurukul User Registration & User Management System v3.0 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the firstname and lastname parameters of the registration form & login pages.
Key phrases: stored cross-site scripting (xss)
CVE-2022-4310: The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged in admin viewing the logs
Key phrases: perform Stored Cross-Site Scripting attacks against, stored cross-site scripting
CVE-2022-43101: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.
Key phrases: stack overflow
CVE-2022-43102: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the timeZone parameter in the fromSetSysTime function.
Key phrases: stack overflow
CVE-2022-43103: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the list parameter in the formSetQosBand function.
Key phrases: stack overflow
CVE-2022-43104: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the wpapsk_crypto parameter in the fromSetWirelessRepeat function.
Key phrases: stack overflow
CVE-2022-43105: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the shareSpeed parameter in the fromSetWifiGusetBasic function.
Key phrases: stack overflow
CVE-2022-43106: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the schedStartTime parameter in the setSchedWifi function.
Key phrases: stack overflow
CVE-2022-43107: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the time parameter in the setSmartPowerManagement function.
Key phrases: stack overflow
CVE-2022-43108: Tenda AC23 V16.03.07.45_cn was discovered to contain a stack overflow via the firewallEn parameter in the formSetFirewallCfg function.
Key phrases: stack overflow
CVE-2022-43109: D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via a crafted packet.
Key phrases: execute arbitrary commands, execute arbitrary commands via a crafted packet, command injection
CVE-2022-4311: An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. Thiscould allow a user with access to the log files to discover connection strings of data sources configured for theDbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other usersunauthorized access to the underlying data sources.
Key phrases: the log files to discover connection strings of, the underlying data sources, sensitive information, sensitive information log file
CVE-2022-43117: Sourcecodester Password Storage Application in PHP/OOP and MySQL 1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via the Name, Username, Description and Site Feature parameters.
Key phrases: cross-site scripting (xss)
CVE-2022-43118: A cross-site scripting (XSS) vulnerability in flatCore-CMS v2.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-43119: A cross-site scripting (XSS) vulnerability in Clansphere CMS v2011.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Username parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-4312: A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This couldallow an unauthorized user with access the email and short messaging service (SMS) accounts configuration filesto discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code.Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying emailaccount and SIM card.
Key phrases: the underlying emailaccount and SIM card, cleartext storage of sensitive information
CVE-2022-43120: A cross-site scripting (XSS) vulnerability in the /panel/fields/add component of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Field default value text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-43121: A cross-site scripting (XSS) vulnerability in the CMS Field Add page of Intelliants Subrion CMS v4.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the tooltip text field.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-43124: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=user/manage_user.
Key phrases: sql injection
CVE-2022-43125: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /appointments/manage_appointment.php.
Key phrases: sql injection
CVE-2022-43126: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/tests/manage_test.php.
Key phrases: sql injection
CVE-2022-43127: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /appointments/update_status.php.
Key phrases: sql injection
CVE-2022-4313: A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets.
Key phrases: execute arbitrary commands
CVE-2022-43135: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /diagnostic/login.php.
Key phrases: sql injection
CVE-2022-43138: Dolibarr Open Source ERP & CRM for Business before v14.0.1 allows attackers to escalate privileges via a crafted API.
Key phrases: escalate privileges via a crafted API
CVE-2022-4314: Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2.
Key phrases: improper privilege management
CVE-2022-43140: kkFileView v4.1.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component cn.keking.web.controller.OnlinePreviewController#getCorsFile. This vulnerability allows attackers to force the application to make arbitrary requests via injection of crafted URLs into the url parameter.
Key phrases: make arbitrary requests, force the application to make arbitrary requests via, server-side request forgery (ssrf)
CVE-2022-43142: A cross-site scripting (XSS) vulnerability in the add-fee.php component of Password Storage Application v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the cmddept parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-43143: A cross-site scripting (XSS) vulnerability in Beekeeper Studio v3.6.6 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the error modal container.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-43144: A cross-site scripting (XSS) vulnerability in Canteen Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, cross-site scripting (xss)
CVE-2022-43146: An arbitrary file upload vulnerability in the image upload function of Canteen Management System v1.0 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-43148: rtf2html v0.2.0 was discovered to contain a heap overflow in the component /rtf2html/./rtf_tools.h.
Key phrases: heap overflow
CVE-2022-4315: An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page.
Key phrases: custom request headers
CVE-2022-43151: timg v1.4.4 was discovered to contain a memory leak via the function timg::QueryBackgroundColor() at /timg/src/term-query.cc.
Key phrases: memory leak
CVE-2022-43152: tsMuxer v2.6.16 was discovered to contain a heap overflow via the function BitStreamWriter::flushBits() at /tsMuxer/bitStream.h.
Key phrases: heap overflow
CVE-2022-43162: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /tests/view_test.php.
Key phrases: sql injection
CVE-2022-43163: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /clients/view_client.php.
Key phrases: sql injection
CVE-2022-43164: A stored cross-site scripting (XSS) vulnerability in the Global Lists feature (/index.php?module=global_lists/lists) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add".
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-43165: A stored cross-site scripting (XSS) vulnerability in the Global Variables feature (/index.php?module=global_vars/vars) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Value parameter after clicking "Create".
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-43166: A stored cross-site scripting (XSS) vulnerability in the Global Entities feature (/index.php?module=entities/entities) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Entity".
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-43167: A stored cross-site scripting (XSS) vulnerability in the Users Alerts feature (/index.php?module=users_alerts/users_alerts) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add".
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-43168: Rukovoditel v3.2.1 was discovered to contain a SQL injection vulnerability via the reports_id parameter.
Key phrases: sql injection
CVE-2022-43169: A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/users_groups) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter after clicking "Add New Group".
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-4317: An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects.
Key phrases: custom request headers
CVE-2022-43170: A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_configure/index) of Rukovoditel v3.2.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter after clicking "Add info block".
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-43171: A heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind function of LIEF v0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted MachO file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap buffer overflow, denial of service (dos)
CVE-2022-43179: Online Leave Management System v1.0 was discovered to contain a SQL injection vulnerability via the component /admin/?page=user/manage_user&id=.
Key phrases: sql injection
CVE-2022-4318: A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable.
Key phrases: the addition of arbitrary lines into /etc/
CVE-2022-43183: XXL-Job before v2.3.1 contains a Server-Side Request Forgery (SSRF) via the component /admin/controller/JobLogController.java.
Key phrases: server-side request forgery (ssrf)
CVE-2022-43184: D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.
Key phrases: command injection
CVE-2022-43185: A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name parameter.
Key phrases: execute arbitrary web scripts or HTML, execute arbitrary web scripts or HTML via a, stored cross-site scripting (xss)
CVE-2022-43192: An arbitrary file upload vulnerability in the component /dede/file_manage_control.php of Dedecms v5.7.101 allows attackers to execute arbitrary code via a crafted PHP file. This vulnerability is related to an incomplete fix for CVE-2022-40886.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-43196: dedecmdv6 v6.1.9 is vulnerable to Arbitrary file deletion via file_manage_control.php.
Key phrases: arbitrary file deletion
CVE-2022-4320: The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin).
Key phrases: reflected cross-site scripting
CVE-2022-4321: The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin
Key phrases: reflected cross-site scripting
CVE-2022-43212: Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at fetchOrderData.php.
Key phrases: sql injection
CVE-2022-43213: Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at editorder.php.
Key phrases: sql injection
CVE-2022-43214: Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the orderId parameter at printOrder.php.
Key phrases: sql injection
CVE-2022-43215: Billing System Project v1.0 was discovered to contain a SQL injection vulnerability via the endDate parameter at getOrderReport.php.
Key phrases: sql injection
CVE-2022-4322: A vulnerability, which was classified as critical, was found in maku-boot up to 2.2.0. This affects the function doExecute of the file AbstractScheduleJob.java of the component Scheduled Task Handler. The manipulation leads to injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 446eb7294332efca2bfd791bc37281cedac0d0ff. It is recommended to apply a patch to fix this issue. The identifier VDB-215013 was assigned to this vulnerability.
Key phrases: injection
CVE-2022-43221: open5gs v2.4.11 was discovered to contain a memory leak in the component src/upf/pfcp-path.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PFCP packet.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), memory leak, denial of service (dos)
CVE-2022-43222: open5gs v2.4.11 was discovered to contain a memory leak in the component src/smf/pfcp-path.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted PFCP packet.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), memory leak, denial of service (dos)
CVE-2022-43223: open5gs v2.4.11 was discovered to contain a memory leak in the component ngap-handler.c. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted UE attachment.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), memory leak, denial of service (dos)
CVE-2022-43226: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/?page=appointments/view_appointment.
Key phrases: sql injection
CVE-2022-43227: Online Diagnostic Lab Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /odlms/admin/?page=appointments/view_appointment.
Key phrases: sql injection
CVE-2022-43228: Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /clearance/clearance.php.
Key phrases: sql injection
CVE-2022-43229: Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /bookings/update_status.php.
Key phrases: sql injection
CVE-2022-4323: The Analyticator WordPress plugin before 6.5.6 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present
Key phrases: perform PHP Object Injection when a suitable gadget, php object injection
CVE-2022-43230: Simple Cold Storage Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/?page=bookings/view_details.
Key phrases: sql injection
CVE-2022-43231: Canteen Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /youthappam/manage_website.php. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-43232: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php_action/fetchOrderData.php.
Key phrases: sql injection
CVE-2022-43233: Canteen Management System v1.0 was discovered to contain a SQL injection vulnerability via the userid parameter at /php_action/fetchSelectedUser.php.
Key phrases: sql injection
CVE-2022-43234: An arbitrary file upload vulnerability in the /attachments component of Hoosk v1.8 allows attackers to execute arbitrary code via a crafted PHP file.
Key phrases: execute arbitrary code, execute arbitrary code via a crafted PHP file, arbitrary file upload
CVE-2022-43235: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_epel_pixels_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap-buffer-overflow, denial of service (dos), heap buffer overflow
CVE-2022-43236: Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack-buffer-overflow, denial of service (dos), stack buffer overflow
CVE-2022-43237: Libde265 v1.0.8 was discovered to contain a stack-buffer-overflow vulnerability via void put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), stack-buffer-overflow, denial of service (dos), stack buffer overflow
CVE-2022-43238: Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_h_3_v_3_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), unknown crash, denial of service (dos)
CVE-2022-43239: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_chroma<unsigned short> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap-buffer-overflow, denial of service (dos), heap buffer overflow
CVE-2022-4324: The Custom Field Template WordPress plugin before 2.5.8 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog.
Key phrases: php object injections issues, gadget chain
CVE-2022-43240: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_hevc_qpel_h_2_v_1_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap-buffer-overflow, denial of service (dos), heap buffer overflow
CVE-2022-43241: Libde265 v1.0.8 was discovered to contain an unknown crash via ff_hevc_put_hevc_qpel_v_3_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), unknown crash, denial of service (dos)
CVE-2022-43242: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via mc_luma<unsigned char> in motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap-buffer-overflow, denial of service (dos), heap buffer overflow
CVE-2022-43243: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via ff_hevc_put_weighted_pred_avg_8_sse in sse-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap-buffer-overflow, denial of service (dos), heap buffer overflow
CVE-2022-43244: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap-buffer-overflow, denial of service (dos), heap buffer overflow
CVE-2022-43245: Libde265 v1.0.8 was discovered to contain a segmentation violation via apply_sao_internal<unsigned short> in sao.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), segmentation violation, denial of service (dos)
CVE-2022-43248: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_weighted_pred_avg_16_fallback in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap-buffer-overflow, denial of service (dos), heap buffer overflow
CVE-2022-43249: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_epel_hv_fallback<unsigned short> in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap-buffer-overflow, denial of service (dos), heap buffer overflow
CVE-2022-4325: The Post Status Notifier Lite WordPress plugin before 1.10.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high privilege users such as admin.
Key phrases: reflected cross-site scripting
CVE-2022-43250: Libde265 v1.0.8 was discovered to contain a heap-buffer-overflow vulnerability via put_qpel_0_0_fallback_16 in fallback-motion.cc. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted video file.
Key phrases: Denial of Service (DoS), cause a Denial of Service (DoS), heap-buffer-overflow, denial of service (dos), heap buffer overflow