A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window.
CVE-2022-0352
Cross-site Scripting (XSS) – Reflected in Pypi calibreweb prior to 0.6.16.
CVE-2022-0351
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
CVE-2022-0350
Cross-site Scripting (XSS) – Stored in GitHub repository vanessa219/vditor prior to 3.8.13.
CVE-2022-0349
The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection
CVE-2022-0348
Cross-site Scripting (XSS) – Stored in Packagist pimcore/pimcore prior to 10.2.