Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2022-0086
uppy is vulnerable to Server-Side Request Forgery (SSRF)
Affected Products: transloadit/uppy
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/c1c03ef6-3f18-4976-a9ad-08c251279122'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/transloadit/uppy/commit/fc137e30a2a3102eb191141f280d5de20dacdf8f'}]
CVE State: PUBLISHED
Explain CVE-2022-0087
keystone is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products: keystonejs/keystone
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/c9d7374f-2cb9-4bac-9c90-a965942f413e'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/keystonejs/keystone/commit/96bf833a23b1a0a5d365cf394467a943cc481b38'}]
CVE State: PUBLISHED
Explain CVE-2022-0088
Cross-Site Request Forgery (CSRF) in GitHub repository yourls/yourls prior to 1.8.3.
Affected Products: yourls/yourls
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/d01f0726-1a0f-4575-ae17-4b5319b11c29'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/yourls/yourls/commit/1de256d8694b0ec7d4df2ac1d5976d4055e09d59'}]
CVE State: PUBLISHED
Explain CVE-2022-0090
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab is configured in a way that it doesn't ignore replacement references with git sub-commands, allowing a malicious user to spoof the contents of their commits in the UI.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitaly/-/issues/3948'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/1415964'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0090.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0093
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab allows a user with an expired password to access sensitive information through RSS feeds.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/343247'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/1348738'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0093.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0096
Use after free in Storage in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1275020'}, {'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0097
Inappropriate implementation in DevTools in Google Chrome prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malicious extension to to potentially allow extension to escape the sandbox via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1117173'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0098
Use after free in Screen Capture in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to perform specific user gestures to potentially exploit heap corruption via specific user gestures.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1273609'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0099
Use after free in Sign-in in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gestures to potentially exploit heap corruption via specific user gesture.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1245629'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0100
Heap buffer overflow in Media streams API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1238209'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0101
Heap buffer overflow in Bookmarks in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gesture to potentially exploit heap corruption via specific user gesture.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1249426'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0102
Type confusion in V8 in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1260129'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0103
Use after free in SwiftShader in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1272266'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0104
Heap buffer overflow in ANGLE in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1273661'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0105
Use after free in PDF Accessibility in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1274376'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0106
Use after free in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who convinced a user to perform specific user gesture to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1278960'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0107
Use after free in File Manager API in Google Chrome on Chrome OS prior to 97.0.4692.71 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1248438'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0108
Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Affected Products: Chrome
References: [{'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'url': 'https://crbug.com/1248444'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}, {'name': '[oss-security] 20230421 WebKitGTK and WPE WebKit Security Advisory WSA-2023-0003', 'tags': ['mailing-list'], 'url': 'http://www.openwall.com/lists/oss-security/2023/04/21/3'}, {'name': 'FEDORA-2023-5b61346bbe', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QL5OGMSHRQ26FTYWZUXVNWB2VHOSVXK/'}, {'name': 'FEDORA-2023-a4bbf02a57', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5OKKVEUQAAGH3NHMX3WHWKRPYU4QFKTQ/'}, {'name': 'DSA-5397', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2023/dsa-5397'}, {'name': 'DSA-5396', 'tags': ['vendor-advisory'], 'url': 'https://www.debian.org/security/2023/dsa-5396'}, {'name': 'FEDORA-2023-8900b35c6f', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KC7DMUX37BRCLAI4VPQYHDUVEGTNYN5A/'}, {'name': '[debian-lts-announce] 20230512 [SECURITY] [DLA 3419-1] webkit2gtk security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/05/msg00011.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0109
Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1261689'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0110
Incorrect security UI in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1237310'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0111
Inappropriate implementation in Navigation in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to incorrectly set origin via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1241188'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0112
Incorrect security UI in Browser UI in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to display missing URL or incorrect URL via a crafted URL.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1255713'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0113
Inappropriate implementation in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1039885'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0114
Out of bounds memory access in Blink Serial API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page and virtual serial port driver.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1267627'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0115
Uninitialized use in File API in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1268903'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0116
Inappropriate implementation in Compositing in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1272250'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0117
Policy bypass in Blink in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1115847'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0118
Inappropriate implementation in WebShare in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially hide the contents of the Omnibox (URL bar) via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1238631'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0120
Inappropriate implementation in Passwords in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to potentially leak cross-origin data via a malicious website.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1262953'}, {'name': 'FEDORA-2022-d1a15f9cdb', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5PAGL5M2KGYPN3VEQCRJJE6NA7D5YG5X/'}, {'name': 'FEDORA-2022-49b52819a4', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KQJB6ZPRLKV6WCMX2PRRRQBFAOXFBK6B/'}, {'name': 'FEDORA-2022-57923346cf', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRWRAXAFR3JR7XCFWTHC2KALSZKWACCE/'}]
CVE State: PUBLISHED
Explain CVE-2022-0121
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hoppscotch hoppscotch/hoppscotch.This issue affects hoppscotch/hoppscotch before 2.1.1.


Affected Products: hoppscotch/hoppscotch
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/b70a6191-8226-4ac6-b817-cae7332a68ee'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/hoppscotch/hoppscotch/commit/86ef1a4e143ea5bb0c7b309574127cc39d4faa74'}]
CVE State: PUBLISHED
Explain CVE-2022-0122
forge is vulnerable to URL Redirection to Untrusted Site
Affected Products: digitalbazaar/forge
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/digitalbazaar/forge/commit/db8016c805371e72b06d8e2edfe0ace0df934a5e'}]
CVE State: PUBLISHED
Explain CVE-2022-0123
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. GitLab does not validate SSL certificates for some of external CI services which makes it possible to perform MitM attacks on connections to these external services.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/296632'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0123.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0124
An issue has been discovered affecting GitLab versions prior to 14.4.5, between 14.5.0 and 14.5.3, and between 14.6.0 and 14.6.1. Gitlab's Slack integration is incorrectly validating user input and allows to craft malicious URLs that are sent to slack.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/340176'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/1310778'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0124.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0125
An issue has been discovered in GitLab affecting all versions starting from 12.0 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not verifying that a maintainer of a project had the right access to import members from a target project.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/345564'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/1356100'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0125.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0128
vim is vulnerable to Out-of-bounds Read
Affected Products: vim/vim
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/63f51299-008a-4112-b85b-1e904aadd4ba'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/vim/vim/commit/d3a117814d6acbf0dca3eff1a7626843b9b3734a'}, {'name': "[oss-security] 20220114 Re: 3 new CVE's in vim", 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2022/01/15/1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT213183'}, {'name': '20220314 APPLE-SA-2022-03-14-4 macOS Monterey 12.3', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2022/Mar/29'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT213256'}, {'name': '20220516 APPLE-SA-2022-05-16-3 macOS Big Sur 11.6.6', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2022/May/35'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://support.apple.com/kb/HT213343'}, {'name': '20220721 APPLE-SA-2022-07-20-4 Security Update 2022-005 Catalina', 'tags': ['mailing-list', 'x_refsource_FULLDISC'], 'url': 'http://seclists.org/fulldisclosure/2022/Jul/14'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-32'}]
CVE State: PUBLISHED
Explain CVE-2022-0129
Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) gaining elevation of privileges to system user. This was achieved through placing the malicious DLL in the same directory that the process was run from.
Affected Products: McAfee TechCheck
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://service.mcafee.com/?articleId=TS103243'}]
CVE State: PUBLISHED
Explain CVE-2022-0130
Tenable.sc versions 5.14.0 through 5.19.1 were found to contain a remote code execution vulnerability which could allow a remote, unauthenticated attacker to execute code under special circumstances. An attacker would first have to stage a specific file type in the web server root of the Tenable.sc host prior to remote exploitation.
Affected Products: Tenable.sc
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.tenable.com/security/tns-2022-01'}]
CVE State: PUBLISHED
Explain CVE-2022-0131
Jimoty App for Android versions prior to 3.7.42 uses a hard-coded API key for an external service. By exploiting this vulnerability, API key for an external service may be obtained by analyzing data in the app.
Affected Products: Jimoty App for Android
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://jvn.jp/en/jp/JVN49047921/index.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0132
peertube is vulnerable to Server-Side Request Forgery (SSRF)
Affected Products: chocobozzz/peertube
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/77ec5308-5561-4664-af21-d780df2d1e4b'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/chocobozzz/peertube/commit/7b54a81cccf6b4c12269e9d6897d608b1a99537a'}]
CVE State: PUBLISHED
Explain CVE-2022-0133
peertube is vulnerable to Improper Access Control
Affected Products: chocobozzz/peertube
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/80aabdc1-89fe-47b8-87ca-9d68107fc0b4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/chocobozzz/peertube/commit/795212f7acc690c88c86d0fab8772f6564d59cb8'}]
CVE State: PUBLISHED
Explain CVE-2022-0134
The AnyComment WordPress plugin before 0.2.18 does not have CSRF checks in the Import and Revert HyperComments features, allowing attackers to make logged in admin perform such actions via a CSRF attack
Affected Products: AnyComment
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/fa09ea9b-d5a0-4773-a692-9ff0200bcd85'}]
CVE State: PUBLISHED
Explain CVE-2022-0135
An out-of-bounds write issue was found in the VirGL virtual OpenGL renderer (virglrenderer). This flaw allows a malicious guest to create a specially crafted virgil resource and then issue a VIRTGPU_EXECBUFFER ioctl, leading to a denial of service or possible code execution.
Affected Products: virglrenderer
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2037790'}, {'name': 'GLSA-202210-05', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202210-05'}, {'name': '[debian-lts-announce] 20221207 [SECURITY] [DLA 3232-1] virglrenderer security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/12/msg00017.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0136
A vulnerability was discovered in GitLab versions 10.5 to 14.5.4, 14.6 to 14.6.4, and 14.7 to 14.7.1. GitLab was vulnerable to a blind SSRF attack through the Project Import feature.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/28561'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/560658'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0136.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0137
A heap buffer overflow in image_set_mask function of HTMLDOC before 1.9.15 allows an attacker to write outside the buffer boundaries.
Affected Products: htmldoc
References: [{'tags': ['issue-tracking'], 'url': 'https://github.com/michaelrsweet/htmldoc/issues/461'}, {'tags': ['patch'], 'url': 'https://github.com/michaelrsweet/htmldoc/commit/71fe87878c9cbc3db429f5e5c70f28e4b3d96e3b'}]
CVE State: PUBLISHED
Explain CVE-2022-0138
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialization function that does not validate or check the data, allowing arbitrary classes to be created.
Affected Products: MMP
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02'}]
CVE State: PUBLISHED
Explain CVE-2022-0139
Use After Free in GitHub repository radareorg/radare2 prior to 5.6.0.
Affected Products: radareorg/radare2
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/radareorg/radare2/commit/37897226a1a31f982bfefdc4aeefc2e50355c73c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/3dcb6f40-45cd-403b-929f-db123fde32c0'}]
CVE State: PUBLISHED
Explain CVE-2022-0140
The Visual Form Builder WordPress plugin before 3.0.6 does not perform access control on entry form export, allowing unauthenticated users to see the form entries or export it as a CSV File using the vfb-export endpoint.
Affected Products: Visual Form Builder
References: [{'url': 'https://wpscan.com/vulnerability/9fa2b3b6-2fe3-40f0-8f71-371dd58fe336', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'https://www.fortiguard.com/zeroday/FG-VD-21-082'}]
CVE State: PUBLISHED
Explain CVE-2022-0141
The Visual Form Builder WordPress plugin before 3.0.8 does not enforce nonce checks which could allow attackers to make a logged in admin or editor delete and restore arbitrary form entries via CSRF attacks
Affected Products: Visual Form Builder
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/2adc8390-bb19-4adf-9805-e9c462d14d22'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.fortiguard.com/zeroday/FG-VD-21-081'}]
CVE State: PUBLISHED
Explain CVE-2022-0142
The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a command that will be included in the exported CSV file, leading to possible code execution.
Affected Products: Visual Form Builder
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/03210390-2054-40c0-9508-39d168087878'}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.fortiguard.com/zeroday/FG-VD-21-080'}]
CVE State: PUBLISHED
Explain CVE-2022-0143
When the LDAP connector is started with StartTLS configured, unauthenticated access is granted. This issue affects: all versions of the LDAP connector prior to 1.5.20.9. The LDAP connector is bundled with Identity Management (IDM) and Remote Connector Server (RCS)
Affected Products: LDAP Connector
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://backstage.forgerock.com/knowledge/kb/article/a11380515'}, {'tags': ['x_refsource_MISC'], 'url': 'https://backstage.forgerock.com/downloads/browse/idm/featured/connectors'}]
CVE State: PUBLISHED
Explain CVE-2022-0144
shelljs is vulnerable to Improper Privilege Management
Affected Products: shelljs/shelljs
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/50996581-c08e-4eed-a90e-c0bac082679c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/shelljs/shelljs/commit/d919d22dd6de385edaa9d90313075a77f74b338c'}]
CVE State: PUBLISHED
Explain CVE-2022-0145
Cross-site Scripting (XSS) - Stored in GitHub repository forkcms/forkcms prior to 5.11.1.
Affected Products: forkcms/forkcms
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/b5b8c680-3cd9-4477-bcd9-3a29657ba7ba'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/forkcms/forkcms/commit/981730f1a3d59b423ca903b1f4bf79b848a1766e'}]
CVE State: PUBLISHED
Explain CVE-2022-0147
The Cookie Information | Free GDPR Consent Solution WordPress plugin before 2.0.8 does not escape user data before outputting it back in attributes in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Affected Products: Cookie Information | Free GDPR Consent Solution
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/2c735365-69c0-4652-b48e-c4a192dfe0d1'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2681371'}]
CVE State: PUBLISHED
Explain CVE-2022-0148
The All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs WordPress plugin before 2.0.4 was vulnerable to reflected XSS on the my-sticky-elements-leads admin page.
Affected Products: All-in-one Floating Contact Form, Call, Chat, and 50+ Social Icon Tabs  – My Sticky Elements
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/37665ee1-c57f-4445-9596-df4f7d72c8cd'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2654453/mystickyelements'}]
CVE State: PUBLISHED
Explain CVE-2022-0149
The WooCommerce Stored Exporter WordPress plugin before 2.7.1 was affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the woo_ce admin page.
Affected Products: WooCommerce – Store Exporter
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/e47c288a-2ea3-4926-93cc-113867cbc77c'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2654545/woocommerce-exporter'}]
CVE State: PUBLISHED
Explain CVE-2022-0150
The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cross-Site Scripting issue
Affected Products: WP Accessibility Helper (WAH)
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/7142a538-7c3d-4dd0-bd2c-cbd2efaf53c5'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2661008'}]
CVE State: PUBLISHED
Explain CVE-2022-0151
An issue has been discovered in GitLab affecting all versions starting from 12.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was not correctly handling requests to delete existing packages which could result in a Denial of Service under specific conditions.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/348176'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0151.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0152
An issue has been discovered in GitLab affecting all versions starting from 13.10 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to unauthorized access to some particular fields through the GraphQL API.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/347467'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0152.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0153
SQL Injection in GitHub repository forkcms/forkcms prior to 5.11.1.
Affected Products: forkcms/forkcms
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/841503dd-311c-470a-a8ec-d4579b3274eb'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/forkcms/forkcms/commit/7a12046a67ae5d8cf04face3ee75e55f03a1a608'}]
CVE State: PUBLISHED
Explain CVE-2022-0154
An issue has been discovered in GitLab affecting all versions starting from 7.7 before 14.4.5, all versions starting from 14.5.0 before 14.5.3, all versions starting from 14.6.0 before 14.6.2. GitLab was vulnerable to a Cross-Site Request Forgery attack that allows a malicious user to have their GitHub project imported on another GitLab user account.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/29580'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/605576'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0154.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0155
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
Affected Products: follow-redirects/follow-redirects
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/follow-redirects/follow-redirects/commit/8b347cbcef7c7b72a6e9be20f5710c17d6163c22'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf'}]
CVE State: PUBLISHED