Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2022-0419
NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0.
Affected Products: radareorg/radare2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/1f84e79d-70e7-4b29-8b48-a108f81c89aa'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/radareorg/radare2/commit/feaa4e7f7399c51ee6f52deb84dc3f795b4035d6'}, {'name': 'FEDORA-2022-ba3248e596', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKGIB52R4XPCPNEW6GF56EHW7ST24IJU/'}, {'name': 'FEDORA-2022-3fc85cd09c', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IQIRJ72UALGMSWH6MYPVJQQLXFGZ23RS/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://census-labs.com/news/2022/05/24/multiple-vulnerabilities-in-radare2/'}, {'name': '[oss-security] 20220525 multiple vulnerabilities in radare2', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2022/05/25/1'}]
CVE State: PUBLISHED
Explain CVE-2022-0420
The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks
Affected Products: RegistrationMagic – Custom Registration Forms, User Registration and User Login Plugin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/056b5167-3cbc-47d1-9917-52a434796151'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2672042'}]
CVE State: PUBLISHED
Explain CVE-2022-0421
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments
Affected Products: Five Star Restaurant Reservations
References: [{'url': 'https://wpscan.com/vulnerability/145e8d3c-cd6f-4827-86e5-ea2d395a80b9', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0422
The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue
Affected Products: White Label CMS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/429be4eb-8a6b-4531-9465-9ef0d35c12cc'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2672615'}]
CVE State: PUBLISHED
Explain CVE-2022-0423
The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook.
Affected Products: 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/7dde0b9d-9b86-4961-b005-a11b6ffba952'}]
CVE State: PUBLISHED
Explain CVE-2022-0424
The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users
Affected Products: Popup by Supsystic
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/1e4593fd-51e5-43ca-a244-9aaef3804b9f'}]
CVE State: PUBLISHED
Explain CVE-2022-0425
A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/22350'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0425.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0426
The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting
Affected Products: Product Feed PRO for WooCommerce
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/de69bcd1-b0b1-4b16-9655-776ee57ad90a'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2670405'}]
CVE State: PUBLISHED
Explain CVE-2022-0427
Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/347284'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/1409788'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0427.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0428
The Content Egg WordPress plugin before 5.3.0 does not sanitise and escape the page parameter before outputting back in an attribute in the Autoblogging admin dashboard, leading to a Reflected Cross-Site Scripting
Affected Products: Content Egg
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/071a2f69-9cd6-42a8-a56c-264a589784ab'}]
CVE State: PUBLISHED
Explain CVE-2022-0429
The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 8.9.6 does not sanitise the $url variable before using it in an attribute in the Activity tab in the plugins dashboard, leading to an unauthenticated stored Cross-Site Scripting vulnerability.
Affected Products: WP Cerber Security, Anti-spam & Malware Scan
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/d1b6f438-f737-4b18-89cf-161238a7421b'}]
CVE State: PUBLISHED
Explain CVE-2022-0430
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository httpie/httpie prior to 3.1.0.
Affected Products: httpie/httpie
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/httpie/httpie/commit/65ab7d5caaaf2f95e61f9dd65441801c2ddee38b'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/dafb2e4f-c6b6-4768-8ef5-b396cd6a801f'}]
CVE State: PUBLISHED
Explain CVE-2022-0431
The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting
Affected Products: Insights from Google PageSpeed
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/52bd94df-8816-48fd-8788-38d045eb57ca'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2690415'}]
CVE State: PUBLISHED
Explain CVE-2022-0432
Prototype Pollution in GitHub repository mastodon/mastodon prior to 3.5.0.
Affected Products: mastodon/mastodon
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/d06da292-7716-4d74-a129-dd04773398d7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/mastodon/mastodon/commit/4d6d4b43c6186a13e67b92eaf70fe1b70ea24a09'}]
CVE State: PUBLISHED
Explain CVE-2022-0433
A NULL pointer dereference flaw was found in the Linux kernel's BPF subsystem in the way a user triggers the map_get_next_key function of the BPF bloom filter. This flaw allows a local user to crash the system. This flaw affects Linux kernel versions prior to 5.17-rc1.
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2048259'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git/commit/?id=3ccdcee28415c4226de05438b4d89eb5514edf73'}, {'tags': ['x_refsource_MISC'], 'url': 'https://lore.kernel.org/bpf/1640776802-22421-1-git-send-email-tcs.kernel%40gmail.com/t/'}]
CVE State: PUBLISHED
Explain CVE-2022-0434
The Page View Count WordPress plugin before 2.4.15 does not sanitise and escape the post_ids parameter before using it in a SQL statement via a REST endpoint, available to both unauthenticated and authenticated users. As a result, unauthenticated attackers could perform SQL injection attacks
Affected Products: Page View Count
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/be895016-7365-4ce4-a54f-f36d0ef2d6f1'}]
CVE State: PUBLISHED
Explain CVE-2022-0435
A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. This flaw allows a remote user to crash the system or possibly escalate their privileges if they have access to the TIPC network.
Affected Products: kernel
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2048738'}, {'url': 'https://www.openwall.com/lists/oss-security/2022/02/10/1'}, {'url': 'https://security.netapp.com/advisory/ntap-20220602-0001/'}]
CVE State: PUBLISHED
Explain CVE-2022-0436
Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.
Affected Products: gruntjs/grunt
References: [{'url': 'https://huntr.dev/bounties/f55315e9-9f6d-4dbb-8c40-bae50c1ae92b'}, {'url': 'https://github.com/gruntjs/grunt/commit/aad3d4521c3098fb255fb2db8f2e1d691a033665'}, {'name': '[debian-lts-announce] 20230406 [SECURITY] [DLA 3386-1] grunt security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/04/msg00008.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0437
Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
Affected Products: karma-runner/karma
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/64b67ea1-5487-4382-a5f6-e8a95f798885'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/karma-runner/karma/commit/839578c45a8ac42fbc1d72105f97eab77dd3eb8a'}]
CVE State: PUBLISHED
Explain CVE-2022-0439
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the `order` and `orderby` parameters to the `ajax_fetch_report_list` action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protection in place for the action, allowing an attacker to trick any logged in user to perform the action by clicking a link.
Affected Products: Email Subscribers & Newsletters
References: [{'url': 'https://wpscan.com/vulnerability/729d3e67-d081-4a4e-ac1e-f6b0a184f095', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0440
The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog (ie DISALLOW_UNFILTERED_HTML, DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS constants set to true)
Affected Products: Catch Themes Demo Import
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/2239095f-8a66-4a5d-ab49-1662a40fddf1'}]
CVE State: PUBLISHED
Explain CVE-2022-0441
The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin
Affected Products: MasterStudy LMS – WordPress LMS Plugin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/173c2efe-ee9c-4539-852f-c242b4f728ed'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2667195'}]
CVE State: PUBLISHED
Explain CVE-2022-0442
The UsersWP WordPress plugin before 1.2.3.1 is missing access controls when updating a user avatar, and does not make sure file names for user avatars are unique, allowing a logged in user to overwrite another users avatar.
Affected Products: UsersWP – User Registration & User Profile
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/9cf0822a-c9d6-4ebc-b905-95b143d1a692'}]
CVE State: PUBLISHED
Explain CVE-2022-0443
Use After Free in GitHub repository vim/vim prior to 8.2.
Affected Products: vim/vim
References: [{'url': 'https://huntr.dev/bounties/b987c8cb-bbbe-4601-8a6c-54ff907c6b51'}, {'url': 'https://github.com/vim/vim/commit/9b4a80a66544f2782040b641498754bcb5b8d461'}, {'name': 'FEDORA-2022-da2fb07efb', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/'}, {'name': 'FEDORA-2022-48bf3cb1c4', 'tags': ['vendor-advisory'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/'}, {'name': '[debian-lts-announce] 20220516 [SECURITY] [DLA 3011-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html'}, {'name': 'GLSA-202208-32', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202208-32'}, {'name': '[debian-lts-announce] 20221108 [SECURITY] [DLA 3182-1] vim security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0444
The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin WordPress plugin before 4.3.6 does not have authorisation and CSRF checks when resetting its settings, allowing unauthenticated attackers to reset them, including generating a new backup encryption key.
Affected Products: Backup, Restore and Migrate WordPress Sites With the XCloner Plugin
References: [{'url': 'https://wpscan.com/vulnerability/9567d295-43c7-4e59-9283-c7726f16d40b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0445
The WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent WordPress plugin before 2.14.2 does not have CSRF checks in place when resetting its settings, allowing attackers to make a logged in admin reset them via a CSRF attack
Affected Products: WordPress Real Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/d9f28255-0026-4c42-9e67-d17b618c2285'}]
CVE State: PUBLISHED
Explain CVE-2022-0446
The Simple Banner WordPress plugin before 2.12.0 does not properly sanitize its "Simple Banner Text" Settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
Affected Products: Simple Banner
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/3fc7986e-3b38-4e16-9516-2ae00bc7a581'}]
CVE State: PUBLISHED
Explain CVE-2022-0447
The Post Grid WordPress plugin before 2.1.16 does not sanitise and escape the post_types parameter before outputting it back in the response of the post_grid_update_taxonomies_terms_by_posttypes AJAX action, available to any authenticated users, leading to a Reflected Cross-Site Scripting
Affected Products: Post Grid
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/91ca2cc9-951e-4e96-96ff-3bf131209dbe'}]
CVE State: PUBLISHED
Explain CVE-2022-0448
The CP Blocks WordPress plugin before 1.0.15 does not sanitise and escape its "License ID" settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
Affected Products: CP Blocks
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/d4ff63ee-28e6-486e-9aa7-c878b97f707c'}]
CVE State: PUBLISHED
Explain CVE-2022-0449
The Flexi WordPress plugin before 4.20 does not sanitise and escape various parameters before outputting them back in some pages such as the user dashboard, leading to a Reflected Cross-Site Scripting
Affected Products: Flexi – Guest Submit
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/3cc1bb3c-e124-43d3-bc84-a493561a1387'}]
CVE State: PUBLISHED
Explain CVE-2022-0450
The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving menu settings, and does not validate, sanitise and escape them. As a result, any authenticate users, such as subscriber can update the settings or arbitrary menu and put Cross-Site Scripting payloads in them which will be triggered in the related menu in the frontend
Affected Products: Menu Image, Icons made easy
References: [{'url': 'https://wpscan.com/vulnerability/612f9273-acc8-4be6-b372-33f1e687f54a', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-0451
Dart SDK contains the HTTPClient in dart:io library whcih includes authorization headers when handling cross origin redirects. These headers may be explicitly set and contain sensitive information. By default, HttpClient handles redirection logic. If a request is sent to example.com with authorization header and it redirects to an attackers site, they might not expect attacker site to receive authorization header. We recommend updating the Dart SDK to version 2.16.0 or beyond.
Affected Products: Dart SDK
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://dart-review.googlesource.com/c/sdk/+/229947'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/dart-lang/sdk/commit/57db739be0ad4629079bfa94840064f615d35abc'}]
CVE State: PUBLISHED
Explain CVE-2022-0452
Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1284584'}, {'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0453
Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1284916'}]
CVE State: PUBLISHED
Explain CVE-2022-0454
Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1287962'}]
CVE State: PUBLISHED
Explain CVE-2022-0455
Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1270593'}]
CVE State: PUBLISHED
Explain CVE-2022-0456
Use after free in Web Search in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via profile destruction.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1289523'}]
CVE State: PUBLISHED
Explain CVE-2022-0457
Type confusion in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1274445'}]
CVE State: PUBLISHED
Explain CVE-2022-0458
Use after free in Thumbnail Tab Strip in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1267060'}]
CVE State: PUBLISHED
Explain CVE-2022-0459
Use after free in Screen Capture in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had compromised the renderer process and convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1244205'}]
CVE State: PUBLISHED
Explain CVE-2022-0460
Use after free in Window Dialogue in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1250227'}]
CVE State: PUBLISHED
Explain CVE-2022-0461
Policy bypass in COOP in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to bypass iframe sandbox via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1256823'}]
CVE State: PUBLISHED
Explain CVE-2022-0462
Inappropriate implementation in Scroll in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1270470'}]
CVE State: PUBLISHED
Explain CVE-2022-0463
Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1268240'}]
CVE State: PUBLISHED
Explain CVE-2022-0464
Use after free in Accessibility in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via user interaction.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1270095'}]
CVE State: PUBLISHED
Explain CVE-2022-0465
Use after free in Extensions in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via user interaction.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1281941'}]
CVE State: PUBLISHED
Explain CVE-2022-0466
Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1115460'}]
CVE State: PUBLISHED
Explain CVE-2022-0467
Inappropriate implementation in Pointer Lock in Google Chrome on Windows prior to 98.0.4758.80 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1239496'}]
CVE State: PUBLISHED
Explain CVE-2022-0468
Use after free in Payments in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1252716'}]
CVE State: PUBLISHED
Explain CVE-2022-0469
Use after free in Cast in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who convinced a user to engage in specific interactions to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1279531'}]
CVE State: PUBLISHED
Explain CVE-2022-0470
Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1269225'}]
CVE State: PUBLISHED
Explain CVE-2022-0471
The Favicon by RealFaviconGenerator WordPress plugin before 1.3.23 does not properly sanitise and escape the json_result_url parameter before outputting it back in the Favicon admin dashboard, leading to a Reflected Cross-Site Scripting issue
Affected Products: Favicon by RealFaviconGenerator
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/499bfee4-b481-4276-b6ad-0eead6680f66'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2695862'}]
CVE State: PUBLISHED
Explain CVE-2022-0472
Unrestricted Upload of File with Dangerous Type in Packagist jsdecena/laracom prior to v2.0.9.
Affected Products: jsdecena/laracom
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/cb5b8563-15cf-408c-9f79-4871ea0a8713'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/jsdecena/laracom/commit/256026193ce994dc4c1365e02f414d8a0cd77ae8'}]
CVE State: PUBLISHED
Explain CVE-2022-0473
OTRS administrators can configure dynamic field and inject malicious JavaScript code in the error message of the regular expression check. When used in the agent interface, malicious code might be exectued in the browser. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.31 and prior versions.
Affected Products: OTRS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://otrs.com/release-notes/otrs-security-advisory-2022-01/'}]
CVE State: PUBLISHED
Explain CVE-2022-0474
Full list of recipients from customer users in a contact field could be disclosed in notification emails event when the notification is set to be sent to each recipient individually. This issue affects: OTRS AG OTRSCustomContactFields 8.0.x version: 8.0.11 and prior versions.
Affected Products: OTRSCustomContactFields
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://otrs.com/release-notes/otrs-security-advisory-2022-02/'}]
CVE State: PUBLISHED
Explain CVE-2022-0475
Malicious translator is able to inject JavaScript code in few translatable strings (where HTML is allowed). The code could be executed in the Package manager. This issue affects: OTRS AG OTRS 7.0.x version: 7.0.32 and prior versions, 8.0.x version: 8.0.19 and prior versions.
Affected Products: OTRS
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://otrs.com/release-notes/otrs-security-advisory-2022-05/'}]
CVE State: PUBLISHED
Explain CVE-2022-0476
Denial of Service in GitHub repository radareorg/radare2 prior to 5.6.4.
Affected Products: radareorg/radare2
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/81ddfbda-6c9f-4b69-83ff-85b15141e35d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/radareorg/radare2/commit/27fe8031782d3a06c3998eaa94354867864f9f1b'}, {'name': 'FEDORA-2022-7db9e7bb5b', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/'}, {'name': 'FEDORA-2022-85b277e748', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BZTIMAS53YT66FUS4QHQAFRJOBMUFG6D/'}]
CVE State: PUBLISHED
Explain CVE-2022-0477
An issue has been discovered in GitLab affecting all versions starting from 11.9 before 14.5.4, all versions starting from 14.6.0 before 14.6.4, all versions starting from 14.7.0 before 14.7.1. GitLab was not correctly handling bulk requests to delete existing packages from the package registries which could result in a Denial of Service under specific conditions.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/348166'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0477.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0478
The Event Manager and Tickets Selling for WooCommerce WordPress plugin before 3.5.8 does not validate and escape the post_author_gutenberg parameter before using it in a SQL statement when creating/editing events, which could allow users with a role as low as contributor to perform SQL Injection attacks
Affected Products: Event Manager and Tickets Selling Plugin for WooCommerce
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/d881d725-d06b-464f-a25e-88f41b1f431f'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2671860'}]
CVE State: PUBLISHED
Explain CVE-2022-0479
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Reflected Cross-Site Scripting attack against a logged in admin opening a malicious link
Affected Products: Popup Builder – Create highly converting, mobile friendly marketing popups.
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/0d2bbbaf-fbfd-4921-ba4e-684e2e77e816'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2686454'}]
CVE State: PUBLISHED
Explain CVE-2022-0480
A flaw was found in the filelock_init in fs/locks.c function in the Linux kernel. This issue can lead to host memory exhaustion due to memcg not limiting the number of Portable Operating System Interface (POSIX) file locks.
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/kata-containers/kata-containers/issues/3373'}, {'tags': ['x_refsource_MISC'], 'url': 'https://lore.kernel.org/linux-mm/20210902215519.AWcuVc3li%25akpm%40linux-foundation.org/'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2049700'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0f12156dff2862ac54235fc72703f18770769042'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-0480'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ubuntu.com/security/CVE-2022-0480'}]
CVE State: PUBLISHED
Explain CVE-2022-0481
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Affected Products: mruby/mruby
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/54725c8c-87f4-41b6-878c-01d8e0ee7027'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/mruby/mruby/commit/ae3c99767a27f5c6c584162e2adc6a5d0eb2c54e'}]
CVE State: PUBLISHED
Explain CVE-2022-0482
Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3.
Affected Products: alextselegidis/easyappointments
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/2fe771ef-b615-45ef-9b4d-625978042e26'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/alextselegidis/easyappointments/commit/44af526a6fc5e898bc1e0132b2af9eb3a9b2c466'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/166701/Easy-Appointments-Information-Disclosure.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://opencirt.com/hacking/securing-easy-appointments-cve-2022-0482/'}]
CVE State: PUBLISHED
Explain CVE-2022-0483
Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before build 53
Affected Products: Acronis VSS Doctor
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://security-advisory.acronis.com/advisories/SEC-3354'}]
CVE State: PUBLISHED
Explain CVE-2022-0484
Lack of validation of URLs causes Mirantis Container Cloud Lens Extension before v3.1.1 to open external programs other than the default browser to perform sign on to a new cluster. An attacker could host a webserver which serves a malicious Mirantis Container Cloud configuration file and induce the victim to add a new cluster via its URL. This issue affects: Mirantis Mirantis Container Cloud Lens Extension v3 versions prior to v3.1.1.
Affected Products: Mirantis Container Cloud Lens Extension
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/Mirantis/security/blob/main/advisories/0005.md'}]
CVE State: PUBLISHED
Explain CVE-2022-0485
A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as successful, rather than checking the *error parameter. This could result in the silent creation of a corrupted destination image.
Affected Products: libnbd
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2046194'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2050324'}, {'tags': ['x_refsource_MISC'], 'url': 'https://listman.redhat.com/archives/libguestfs/2022-February/msg00104.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/nbdkit/libnbd/-/commit/8d444b41d09a700c7ee6f9182a649f3f2d325abb'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-0485'}]
CVE State: PUBLISHED
Explain CVE-2022-0486
Improper file permissions in the CommandPost, Collector, Sensor, and Sandbox components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected files and enable escalation of privileges equivalent to the root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability.
Affected Products: Fidelis Network
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411'}]
CVE State: PUBLISHED
Explain CVE-2022-0487
A use-after-free vulnerability was found in rtsx_usb_ms_drv_remove in drivers/memstick/host/rtsx_usb_ms.c in memstick in the Linux kernel. In this flaw, a local attacker with a user privilege may impact system Confidentiality. This flaw affects kernel versions prior to 5.14 rc1.
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2044561'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=42933c8aa14be1caa9eda41f65cde8a3a95d3e39'}, {'name': '[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html'}, {'name': '[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html'}, {'name': 'DSA-5095', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5095'}, {'name': 'DSA-5096', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5096'}]
CVE State: PUBLISHED
Explain CVE-2022-0488
An issue has been discovered in GitLab CE/EE affecting all versions starting with version 8.10. It was possible to trigger a timeout on a page with markdown by using a specific amount of block-quotes.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/23520'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0488.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0489
An issue has been discovered in GitLab CE/EE affecting all versions starting with 8.15 . It was possible to trigger a DOS by using the math feature with a specific formula in issue comments.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/341832'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/1350793'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0489.json'}]
CVE State: PUBLISHED
Explain CVE-2022-0492
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the cgroups v1 release_agent feature to escalate privileges and bypass the namespace isolation unexpectedly.
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2051505'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=24f6008564183aa120d07c03d9289519c2fe02af'}, {'name': '[debian-lts-announce] 20220309 [SECURITY] [DLA 2940-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html'}, {'name': '[debian-lts-announce] 20220309 [SECURITY] [DLA 2941-1] linux-4.19 security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html'}, {'name': 'DSA-5095', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5095'}, {'name': 'DSA-5096', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5096'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.html'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20220419-0002/'}, {'tags': ['x_refsource_MISC'], 'url': 'http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html'}]
CVE State: PUBLISHED
Explain CVE-2022-0493
The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in the search, allowing a pattern to be provided, which will be used to output the relevant matches from the matching file, all content of the file can be disclosed.
Affected Products: String locator
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/21e2e5fc-03d2-4791-beef-07af6bf985ed'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://plugins.trac.wordpress.org/changeset/2685592'}]
CVE State: PUBLISHED
Explain CVE-2022-0494
A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or CAP_SYS_RAWIO) to create issues with confidentiality.
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2039448'}, {'tags': ['x_refsource_MISC'], 'url': 'https://lore.kernel.org/all/20220216084038.15635-1-tcs.kernel%40gmail.com/'}, {'name': 'DSA-5161', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5161'}, {'name': '[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html'}, {'name': 'DSA-5173', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5173'}]
CVE State: PUBLISHED
Explain CVE-2022-0495
The library automation system product KOHA developed by Parantez Teknoloji before version 19.05.03 has an unauthenticated SQL Injection vulnerability. This has been fixed in the version 19.05.03.01.
Affected Products: Parantez Teknoloji
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.usom.gov.tr/bildirim/tr-22-0635'}]
CVE State: PUBLISHED
Explain CVE-2022-0496
A vulnerbiility was found in Openscad, where a DXF-format drawing with particular (not necessarily malformed!) properties may cause an out-of-bounds memory access when imported using import().
Affected Products: openscad
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/openscad/openscad/issues/4037'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2050695'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/openscad/openscad/commit/770e3234cbfe66edbc0333f796b46d36a74aa652'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/openscad/openscad/commit/00a4692989c4e2f191525f73f24ad8727bacdf41'}]
CVE State: PUBLISHED
Explain CVE-2022-0497
A vulnerbiility was found in Openscad, where a .scad file with no trailing newline could cause an out-of-bounds read during parsing of annotations.
Affected Products: openscad
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/openscad/openscad/issues/4043'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2050699'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/openscad/openscad/pull/4044'}]
CVE State: PUBLISHED
Explain CVE-2022-0499
The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.
Affected Products: Sermon Browser
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/e9ccf1fc-1dbf-4a41-bf4a-90af20b286d6'}]
CVE State: PUBLISHED
Explain CVE-2022-0500
A flaw was found in unrestricted eBPF usage by the BPF_BTF_LOAD, leading to a possible out-of-bounds memory write in the Linux kernel’s BPF subsystem due to the way a user loads BTF. This flaw allows a local user to crash or escalate their privileges on the system.
Affected Products: kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2044578'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=20b2aff4bc15bda809f994761d5719827d66c0b4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=216e3cd2f28dbbf1fe86848e0e29e6693b9f0a20'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=34d3a78c681e8e7844b43d1a2f4671a04249c821'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c4807322660d4290ac9062c034aed6b87243861'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=48946bd6a5d695c50b34546864b79c1f910a33c1'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c25b2ae136039ffa820c26138ed4a5e5f3ab3841'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cf9f2f8d62eca810afbd1ee6cc0800202b000e57'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://security.netapp.com/advisory/ntap-20220519-0001/'}]
CVE State: PUBLISHED
Explain CVE-2022-0501
Cross-site Scripting (XSS) - Reflected in Packagist ptrofimov/beanstalk_console prior to 1.7.12.
Affected Products: ptrofimov/beanstalk_console
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/9af1c35e-3f74-4c93-a241-e8be01335ec7'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/ptrofimov/beanstalk_console/commit/e351c8260ec1d3718d9e475ee57c7e12c47f19da'}]
CVE State: PUBLISHED
Explain CVE-2022-0502
Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/34f2aa30-de7f-432a-8749-b43d2774140f'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/d3b107aaa8ec10816acc762d60e7321079c21706'}]
CVE State: PUBLISHED
Explain CVE-2022-0503
The WordPress Multisite Content Copier/Updater WordPress plugin before 2.1.2 does not sanitise and escape the s parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue in the network dashboard
Affected Products: WordPress Multisite Content Copier/Updater
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/b6d38e23-3761-4447-a794-1e5077fd953a'}]
CVE State: PUBLISHED
Explain CVE-2022-0504
Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/285ff8a0-a273-4d62-ba01-3e4b4e18467b'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/e607e5f745cd99d5c06a7fce16b3577fab8e1250'}]
CVE State: PUBLISHED
Explain CVE-2022-0505
Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/65b5a243-3f0c-4df3-9bab-898332180968'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/63447b369973724f0d352a006f25af6ff71ae292'}]
CVE State: PUBLISHED