Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2022-0156
vim is vulnerable to Use After Free
Affected Products: vim/vim
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/47dded34-3767-4725-8c7c-9dcb68c70b36'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/vim/vim/commit/9f1a39a5d1cd7989ada2d1cb32f97d84360e050f'}, {'name': 'FEDORA-2022-20e66c6698', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HD5S2FC2HF22A7XQXK2XXIR46EARVWIM/'}, {'name': "[oss-security] 20220114 Re: 3 new CVE's in vim", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2022/01/15/1'}, {'name': 'FEDORA-2022-48b86d586f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT213183'}, {'name': '20220314 APPLE-SA-2022-03-14-4 macOS Monterey 12.3', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2022/Mar/29'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT213344'}, {'name': '20220721 APPLE-SA-2022-07-20-3 macOS Big Sur 11.6.8', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2022/Jul/13'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-32'}]
CVE State: PUBLISHED
Explain CVE-2022-0157
phoronix-test-suite is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products: phoronix-test-suite/phoronix-test-suite
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/2c0fe81b-0977-4e1e-b5d8-7646c9a7ebbd'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/phoronix-test-suite/phoronix-test-suite/commit/56fd0a3b69fb33c1c90a6017ed735889aaa59486'}, {'name': 'FEDORA-2022-8f968eea82', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57V2CSFU5MKWKL6RJUKMXSD4PCRFTMMQ/'}, {'name': 'FEDORA-2022-43f11039b2', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BU7E6OOZCXS3ZWHOQ2AR7MKM56IN2R6R/'}]
CVE State: PUBLISHED
Explain CVE-2022-0158
vim is vulnerable to Heap-based Buffer Overflow
Affected Products: vim/vim
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/ac5d7005-07c6-4a0a-b251-ba9cdbf6738b'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/vim/vim/commit/5f25c3855071bd7e26255c68bf458b1b5cf92f39'}, {'name': 'FEDORA-2022-20e66c6698', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HD5S2FC2HF22A7XQXK2XXIR46EARVWIM/'}, {'name': "[oss-security] 20220114 Re: 3 new CVE's in vim", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2022/01/15/1'}, {'name': 'FEDORA-2022-48b86d586f', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3FH2J57GDA2WMBS6J56F6QQRA6BXQQFZ/'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT213183'}, {'name': '20220314 APPLE-SA-2022-03-14-4 macOS Monterey 12.3', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2022/Mar/29'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT213344'}, {'name': '20220721 APPLE-SA-2022-07-20-3 macOS Big Sur 11.6.8', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2022/Jul/13'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-32'}]
CVE State: PUBLISHED
Explain CVE-2022-0159
orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products: orchardcms/orchardcore
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/00937280-e2ab-49fe-8d43-8235b3c3db4b'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/orchardcms/orchardcore/commit/4da927d39a49138527c30db09c962ff706f95202'}]
CVE State: PUBLISHED
Explain CVE-2022-0161
The ARI Fancy Lightbox WordPress plugin before 1.3.9 does not sanitise and escape the msg parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Affected Products: ARI Fancy Lightbox – WordPress Popup
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/6b37fa17-0dcb-47a7-b1eb-f9f6abb458c0'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2680993'}]
CVE State: PUBLISHED
Explain CVE-2022-0162
The vulnerability exists in TP-Link TL-WR841N V11 3.16.9 Build 160325 Rel.62500n wireless router due to transmission of authentication information in cleartextbase64 format. Successful exploitation of this vulnerability could allow a remote attacker to intercept credentials and subsequently perform administrative operations on the affected device through web-based management interface.
Affected Products: TL-WR841N
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES01&VLCODE=CIVN-2022-0068'}]
CVE State: PUBLISHED
Explain CVE-2022-0163
The Smart Forms WordPress plugin before 2.6.71 does not have authorisation in its rednao_smart_forms_entries_list AJAX action, allowing any authenticated users, such as subscriber, to download arbitrary form's data, which could include sensitive information such as PII depending on the form.
Affected Products: Smart Forms – when you need more than just a contact form
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/2b6b0731-4515-498a-82bd-d416f5885268'}]
CVE State: PUBLISHED
Explain CVE-2022-0164
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not have authorisation and CSRF checks in its coming_soon_send_mail AJAX action, allowing any authenticated users, with a role as low as subscriber to send arbitrary emails to all subscribed users
Affected Products: Coming soon and Maintenance mode
References: [{'url': 'https://wpscan.com/vulnerability/942535f9-73bf-4467-872a-20075f03bc51', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'https://plugins.trac.wordpress.org/changeset/2655973', 'tags': ['patch']}]
CVE State: PUBLISHED
Explain CVE-2022-0165
The Page Builder KingComposer WordPress plugin through 2.9.6 does not validate the id parameter before redirecting the user to it via the kc_get_thumbn AJAX action available to both unauthenticated and authenticated users
Affected Products: Page Builder: KingComposer – Free Drag and Drop page builder by King-Theme
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/906d0c31-370e-46b4-af1f-e52fbddd00cb'}]
CVE State: PUBLISHED
Explain CVE-2022-0166
A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR variable as a subdirectory within the installation directory. A low privilege user could have created subdirectories and executed arbitrary code with SYSTEM privileges by creating the appropriate pathway to the specifically created malicious openssl.cnf file.
Affected Products: McAfee Agent for Windows
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://kc.mcafee.com/corporate/index?page=content&id=SB10378'}, {'name': 'VU#287178', 'tags': ['third-party-advisory', 'x_refsource_CERT-VN'], 'url': 'https://www.kb.cert.org/vuls/id/287178'}]
CVE State: PUBLISHED
Explain CVE-2022-0167
An issue has been discovered in GitLab affecting all versions starting from 14.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not disabling the Autocomplete attribute of fields related to sensitive information making it possible to be retrieved under certain conditions.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/339146'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0167.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0168
A denial of service (DOS) issue was found in the Linux kernel’s smb2_ioctl_query_info function in the fs/cifs/smb2ops.c Common Internet File System (CIFS) due to an incorrect return from the memdup_user function. This flaw allows a local, privileged (CAP_SYS_ADMIN) attacker to crash the system.
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2037386'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-0168'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d6f5e358452479fa8a773b5c6ccc9e4ec5a20880'}]
CVE State: PUBLISHED
Explain CVE-2022-0169
The Photo Gallery by 10Web WordPress plugin before 1.6.0 does not validate and escape the bwg_tag_id_bwg_thumbnails_0 parameter before using it in a SQL statement via the bwg_frontend_data AJAX action (available to unauthenticated and authenticated users), leading to an unauthenticated SQL injection
Affected Products: Photo Gallery by 10Web – Mobile-Friendly Image Gallery
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/0b4d870f-eab8-4544-91f8-9c5f0538709c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2672822/photo-gallery#file9'}]
CVE State: PUBLISHED
Explain CVE-2022-0170
peertube is vulnerable to Improper Access Control
Affected Products: chocobozzz/peertube
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/f2a003fc-b911-43b6-81ec-f856cdfeaefc'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/chocobozzz/peertube/commit/84c8d9866890f479faf0168c29be5eb7816ccc8e'}]
CVE State: PUBLISHED
Explain CVE-2022-0171
A flaw was found in the Linux kernel. The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports Secure Encrypted Virtualization (SEV).
Affected Products: kernel
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2038940'}, {'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=683412ccf61294d727ead4a73d97397396e69a6b'}, {'url': 'https://access.redhat.com/security/cve/CVE-2022-0171'}, {'name': 'DSA-5257', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2022/dsa-5257'}, {'name': '[debian-lts-announce] 20221101 [SECURITY] [DLA 3173-1] linux-5.10 security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0172
An issue has been discovered in GitLab CE/EE affecting all versions starting with 12.3. Under certain conditions it was possible to bypass the IP restriction for public projects through GraphQL allowing unauthorised users to read titles of issues, merge requests and milestones.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/348411'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0172.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0173
radare2 is vulnerable to Out-of-bounds Read
Affected Products: radareorg/radare2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/727d8600-88bc-4dde-8dea-ee3d192600e5'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/radareorg/radare2/commit/37897226a1a31f982bfefdc4aeefc2e50355c73c'}, {'name': 'FEDORA-2022-ba3248e596', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKGIB52R4XPCPNEW6GF56EHW7ST24IJU/'}, {'name': 'FEDORA-2022-3fc85cd09c', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IQIRJ72UALGMSWH6MYPVJQQLXFGZ23RS/'}]
CVE State: PUBLISHED
Explain CVE-2022-0174
Improper Validation of Specified Quantity in Input vulnerability in dolibarr dolibarr/dolibarr.
Affected Products: dolibarr/dolibarr
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/ed3ed4ce-3968-433c-a350-351c8f8b60db'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/dolibarr/dolibarr/commit/d892160f4f130385a3ce520f66cb8cf2eb8c5c32'}]
CVE State: PUBLISHED
Explain CVE-2022-0175
A flaw was found in the VirGL virtual OpenGL renderer (virglrenderer). The virgl did not properly initialize memory when allocating a host-backed memory resource. A malicious guest could use this flaw to mmap from the guest kernel and read this uninitialized memory from the host, possibly leading to information disclosure.
Affected Products: virglrenderer
References: [{'url': 'https://gitlab.freedesktop.org/virgl/virglrenderer/-/merge_requests/654'}, {'url': 'https://gitlab.freedesktop.org/virgl/virglrenderer/-/commit/b05bb61f454eeb8a85164c8a31510aeb9d79129c'}, {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2039003'}, {'url': 'https://security-tracker.debian.org/tracker/CVE-2022-0175'}, {'url': 'https://access.redhat.com/security/cve/CVE-2022-0175'}, {'name': 'GLSA-202210-05', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-05'}]
CVE State: PUBLISHED
Explain CVE-2022-0176
The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Affected Products: PowerPack Lite for Beaver Builder
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/564a66d5-7fab-4de0-868a-e19466a507af'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2655379'}]
CVE State: PUBLISHED
Explain CVE-2022-0178
Missing Authorization vulnerability in snipe snipe/snipe-it.This issue affects snipe/snipe-i before 5.3.8.


Affected Products: snipe/snipe-it
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/81c6b974-d0b3-410b-a902-8324a55b1368'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/snipe/snipe-it/commit/0e5ef53c352754de2778ffa20c85da15fd6f7ae0'}]
CVE State: PUBLISHED
Explain CVE-2022-0179
snipe-it is vulnerable to Missing Authorization
Affected Products: snipe/snipe-it
References: [{'url': 'https://huntr.dev/bounties/efdf2ead-f9d1-4767-9f02-d11f762d15e7'}, {'url': 'https://github.com/snipe/snipe-it/commit/cf14a0222c67472086cd08b2155f045edaf75f2e'}]
CVE State: PUBLISHED
Explain CVE-2022-0180
Cross-site request forgery (CSRF) vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to hijack the authentication of administrators and conduct arbitrary operations via a specially crafted web page.
Affected Products: Quiz And Survey Master
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://quizandsurveymaster.com/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wordpress.org/plugins/quiz-master-next/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jvn.jp/en/jp/JVN72788165/index.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0181
Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors.
Affected Products: Quiz And Survey Master
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://quizandsurveymaster.com/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wordpress.org/plugins/quiz-master-next/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jvn.jp/en/jp/JVN72788165/index.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0182
Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master.
Affected Products: Quiz And Survey Master
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://quizandsurveymaster.com/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wordpress.org/plugins/quiz-master-next/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jvn.jp/en/jp/JVN72788165/index.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0183
Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows an attacker who can physically access the device to obtain the stored passwords.
Affected Products: MIRUPASS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.kingjim.co.jp/download/security/#mirupass'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jvn.jp/en/jp/JVN19826500/index.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0184
Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earlier allows an attacker on the adjacent network to obtain credentials for connecting to the Wi-Fi access point with the infrastructure mode.
Affected Products: TEPRA PRO
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.kingjim.co.jp/download/security/#sr01'}, {'tags': ['x_refsource_MISC'], 'url': 'https://jvn.jp/en/jp/JVN81479705/index.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0185
A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system.
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/Crusaders-of-Rust/CVE-2022-0185'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.openwall.com/lists/oss-security/2022/01/18/7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.willsroot.io/2022/01/cve-2022-0185.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20220225-0003/'}]
CVE State: PUBLISHED
Explain CVE-2022-0186
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard
Affected Products: Image Photo Gallery Final Tiles Grid
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/3a9c44c0-866e-4fdf-b53d-666db2e11720'}]
CVE State: PUBLISHED
Explain CVE-2022-0188
The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.
Affected Products: CMP
References: [{'url': 'https://wpscan.com/vulnerability/50b6f770-6f53-41ef-b2f3-2a58e9afd332', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'https://plugins.trac.wordpress.org/changeset/2657597/cmp-coming-soon-maintenance', 'tags': ['patch']}]
CVE State: PUBLISHED
Explain CVE-2022-0189
The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Affected Products: WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/52a71bf1-b8bc-479e-b741-eb8fb9685014'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2659298'}]
CVE State: PUBLISHED
Explain CVE-2022-0190
The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action.
Affected Products: Ad Invalid Click Protector (AICP)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/ae322f11-d8b4-4b69-9efa-0fb87475fa44'}]
CVE State: PUBLISHED
Explain CVE-2022-0191
The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attackers to make a logged in admin remove arbitrary bans
Affected Products: Ad Invalid Click Protector (AICP)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/d4c32a02-810f-43d8-946a-b7e18ac54f55'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2705068'}]
CVE State: PUBLISHED
Explain CVE-2022-0192
A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation.
Affected Products: PCManager
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://iknow.lenovo.com.cn/detail/dc_201470.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0193
The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Affected Products: Complianz – GDPR/CCPA Cookie Consent
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/30d1d328-9f19-4c4c-b90a-04937d617864'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2654225'}]
CVE State: PUBLISHED
Explain CVE-2022-0194
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ad_addcomment function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15876.
Affected Products: Netatalk
References: [{'url': 'https://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.html'}, {'url': 'https://www.zerodayinitiative.com/advisories/ZDI-22-530/'}, {'name': '[debian-lts-announce] 20230516 [SECURITY] [DLA 3426-1] netatalk security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00018.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0196
phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)
Affected Products: phoronix-test-suite/phoronix-test-suite
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/phoronix-test-suite/phoronix-test-suite/commit/4f18296a1862fe54a4c58701a1f5ec6bd62a4d94'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/3675eec7-bbce-4dfd-a2d3-d6862dce9ea6'}, {'name': 'FEDORA-2022-8f968eea82', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57V2CSFU5MKWKL6RJUKMXSD4PCRFTMMQ/'}, {'name': 'FEDORA-2022-43f11039b2', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BU7E6OOZCXS3ZWHOQ2AR7MKM56IN2R6R/'}]
CVE State: PUBLISHED
Explain CVE-2022-0197
phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)
Affected Products: phoronix-test-suite/phoronix-test-suite
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/5abb7915-32f4-4fb1-afa7-bb6d8c4c5ad2'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/phoronix-test-suite/phoronix-test-suite/commit/4f18296a1862fe54a4c58701a1f5ec6bd62a4d94'}, {'name': 'FEDORA-2022-8f968eea82', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57V2CSFU5MKWKL6RJUKMXSD4PCRFTMMQ/'}, {'name': 'FEDORA-2022-43f11039b2', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BU7E6OOZCXS3ZWHOQ2AR7MKM56IN2R6R/'}]
CVE State: PUBLISHED
Explain CVE-2022-0198
corenlp is vulnerable to Improper Restriction of XML External Entity Reference
Affected Products: stanfordnlp/corenlp
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/3d7e70fe-dddd-4b79-af62-8e058c4d5763'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/stanfordnlp/corenlp/commit/1f52136321cfca68b991bd7870563d06cf96624d'}]
CVE State: PUBLISHED
Explain CVE-2022-0199
The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack
Affected Products: Coming soon and Maintenance mode
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/1ab1748f-c939-4953-83fc-9df878da7714'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2659455'}]
CVE State: PUBLISHED
Explain CVE-2022-0200
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Affected Products: Themify Portfolio Post
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/bbc0b812-7b30-4ab4-bac8-27c706b3f146'}]
CVE State: PUBLISHED
Explain CVE-2022-0201
The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue
Affected Products: Permalink Manager Lite
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2656512'}]
CVE State: PUBLISHED
Explain CVE-2022-0203
Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2.
Affected Products: crater-invoice/crater
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/395fc553-2b90-4e69-ba07-a316e1c06406'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/crater-invoice/crater/commit/dd324c8bb6b17009f82afe8bc830caec7241e992'}]
CVE State: PUBLISHED
Explain CVE-2022-0204
A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service.
Affected Products: bluez
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2039807'}, {'url': 'https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2q'}, {'url': 'https://github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0'}, {'name': 'GLSA-202209-16', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202209-16'}, {'name': '[debian-lts-announce] 20221024 [SECURITY] [DLA 3157-1] bluez security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0205
The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue
Affected Products: YOP Poll
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/446de364-720e-41ec-b80e-7678c8f4ad80'}]
CVE State: PUBLISHED
Explain CVE-2022-0206
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
Affected Products: NewStatPress
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/ce12437a-d440-4c4a-9247-95a8f39d00b9'}]
CVE State: PUBLISHED
Explain CVE-2022-0207
A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear text.
Affected Products: vdsm
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2033697'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2039248'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gerrit.ovirt.org/c/vdsm/+/118025'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gerrit.ovirt.org/gitweb?p=vdsm.git%3Ba=commit%3Bh=53b0036fc72d3b8877d4e7f047d705e5a4c722e8'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-0207'}]
CVE State: PUBLISHED
Explain CVE-2022-0208
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting
Affected Products: MapPress Maps for WordPress
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/59a2abd0-4aee-47aa-ad3a-865f624fa0fc'}]
CVE State: PUBLISHED
Explain CVE-2022-0209
The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Affected Products: Mitsol Social Post Feed
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/1e4af9be-5c88-4a3e-89ff-dd2b1bc131fe'}]
CVE State: PUBLISHED
Explain CVE-2022-0210
The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the ~/include/models/model.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Affected Products: Random Banner
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0210'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/BigTiger2020/2022/blob/main/Random%20Banner%20Xss.md'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/browser/random-banner/tags/4.1.4/include/models/model.php#L132'}]
CVE State: PUBLISHED
Explain CVE-2022-0211
The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Affected Products: Shield Security – Scanners, Security Hardening, Brute Force Protection & Firewall
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/0d276cca-d6eb-4f4c-83dd-fbc03254c679'}]
CVE State: PUBLISHED
Explain CVE-2022-0212
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue.
Affected Products: SpiderCalendar
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47'}]
CVE State: PUBLISHED
Explain CVE-2022-0213
vim is vulnerable to Heap-based Buffer Overflow
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/f3afe1a5-e6f8-4579-b68a-6e5c7e39afed'}, {'url': 'https://github.com/vim/vim/commit/de05bb25733c3319e18dca44e9b59c6ee389eb26'}, {'name': "[oss-security] 20220114 Re: 3 new CVE's in vim", 'tags': ['mailing-list'], 'url': 'http://www.openwall.com/lists/oss-security/2022/01/15/1'}, {'name': '[debian-lts-announce] 20220311 [SECURITY] [DLA 2947-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0214
The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
Affected Products: Popup | Custom Popup Builder
References: [{'url': 'https://wpscan.com/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0215
The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax).
Affected Products: Login/Signup Popup
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/blog/2022/01/84000-wordpress-sites-affected-by-three-plugins-with-the-same-vulnerability/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wordfence.com/vulnerability-advisories/#CVE-2022-0215'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/tags/2.2/includes/xoo-framework/admin/class-xoo-admin-settings.php#L122'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.5.1/includes/xoo-framework/admin/class-xoo-admin-settings.php#L122'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/tags/2.1/includes/xoo-framework/admin/class-xoo-admin-settings.php?rev=2538194#L128'}]
CVE State: PUBLISHED
Explain CVE-2022-0216
A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.
Affected Products: QEMU
References: [{'url': 'https://starlabs.sg/advisories/22/22-0216/'}, {'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2036953'}, {'url': 'https://gitlab.com/qemu-project/qemu/-/issues/972'}, {'url': 'https://gitlab.com/qemu-project/qemu/-/commit/4367a20cc4'}, {'url': 'https://access.redhat.com/security/cve/CVE-2022-0216'}, {'name': 'FEDORA-2022-4387579e67', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTY7TVHX62OJWF6IOBCIGLR2N5K4QN3E/'}]
CVE State: PUBLISHED
Explain CVE-2022-0217
It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611).
Affected Products: prosody
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2040639'}, {'tags': ['x_refsource_MISC'], 'url': 'https://prosody.im/security/advisory_20220113/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://prosody.im/security/advisory_20220113/1.patch'}]
CVE State: PUBLISHED
Explain CVE-2022-0218
The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site.
Affected Products: WP HTML Mail
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/blog/2022/01/unauthenticated-xss-vulnerability-patched-in-html-email-template-designer-plugin/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/changeset/2656984/wp-html-mail/trunk/includes/class-template-designer.php'}]
CVE State: PUBLISHED
Explain CVE-2022-0219
Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.
Affected Products: skylot/jadx
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/0d093863-29e8-4dd7-a885-64f76d50bf5e'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/skylot/jadx/commit/d22db30166e7cb369d72be41382bb63ac8b81c52'}]
CVE State: PUBLISHED
Explain CVE-2022-0220
The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce)
Affected Products: WordPress GDPR
References: [{'url': 'https://wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0221
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior)
Affected Products: SCADAPack Workbench
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.se.com/ww/en/download/document/SEVD-2022-087-01/'}]
CVE State: PUBLISHED
Explain CVE-2022-0222
A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP. Affected products: Modicon M340 CPUs(BMXP34* versions prior to V3.40), Modicon M340 X80 Ethernet Communication modules:BMXNOE0100 (H), BMXNOE0110 (H), BMXNOR0200H RTU(BMXNOE* all versions)(BMXNOR* versions prior to v1.7 IR24)
Affected Products: Modicon M340 CPUs
References: [{'url': 'https://www.se.com/us/en/download/document/SEVD-2022-102-02/'}]
CVE State: PUBLISHED
Explain CVE-2022-0223
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause unauthenticated code execution. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22)
Affected Products: EcoStruxure Power Commission
References: [{'url': 'https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-05_EcoStruxure_Power_Commission_Security_Notification.pdf'}]
CVE State: PUBLISHED
Explain CVE-2022-0224
dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command
Affected Products: dolibarr/dolibarr
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/f1d1ce3e-ca92-4c7b-b1b8-934e28eaa486'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/dolibarr/dolibarr/commit/b9b45fb50618aa8053961f50bc8604b188d0ea79'}]
CVE State: PUBLISHED
Explain CVE-2022-0225
A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack.
Affected Products: keycloak
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2040268'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m'}]
CVE State: PUBLISHED
Explain CVE-2022-0226
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/635d0abf-7680-47f6-a277-d9a91471c73f'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/f59ffb02984c0ce2fbb19ac39365066507de9370'}]
CVE State: PUBLISHED
Explain CVE-2022-0228
The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection
Affected Products: Popup Builder – Create highly converting, mobile friendly marketing popups.
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2659117'}, {'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/22facac2-52f4-4e5f-be59-1d2934b260d9'}]
CVE State: PUBLISHED
Explain CVE-2022-0229
The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable.
Affected Products: miniOrange's Google Authenticator
References: [{'url': 'https://wpscan.com/vulnerability/d70c5335-4c01-448d-85fc-f8e75b104351', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0230
The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins
Affected Products: Better WordPress Google XML Sitemaps (support Sitemap Index, Multi-site and Google News)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/c73316d2-ae6a-42db-935b-b8b03a7e4363'}]
CVE State: PUBLISHED
Explain CVE-2022-0231
livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF)
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/adaf98cf-60ab-40e0-aa3b-42ba0d3b7cbf'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/6ad1349dc5e7503b00c5017499a0a895d7654a61'}]
CVE State: PUBLISHED
Explain CVE-2022-0232
The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text parameter found in the ~/includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled.
Affected Products: User Registration, Login & Landing Pages – LeadMagic 
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0232'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/BigTiger2020/2022/blob/main/User%20Registration%20Xss.md'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/browser/custom-landing-pages-leadmagic/tags/1.2.6/includes/templates/landing-page.php#L35'}]
CVE State: PUBLISHED
Explain CVE-2022-0233
The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7.
Affected Products: ProfileGrid – User Profiles, Memberships, Groups and Communities
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/BigTiger2020/2022/blob/main/ProfileGrid%20Xss.md'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/4.7.4/admin/class-profile-magic-admin.php#L961'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0233'}]
CVE State: PUBLISHED
Explain CVE-2022-0234
The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting
Affected Products: WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/fd568a1f-bd51-41bb-960d-f8573b84527b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2659191'}]
CVE State: PUBLISHED
Explain CVE-2022-0235
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Affected Products: node-fetch/node-fetch
References: [{'url': 'https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7'}, {'url': 'https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10'}, {'url': 'https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf'}, {'name': '[debian-lts-announce] 20221205 [SECURITY] [DLA 3222-1] node-fetch security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html'}]
CVE State: PUBLISHED