Anusha64/LoanDataSet huggingface dataset:
Explain CVE-2022-1494
Insufficient data validation in Trusted Types in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass trusted types policy via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1298122'}, {'name': 'GLSA-202208-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-25'}]
CVE State: PUBLISHED
Explain CVE-2022-1495
Incorrect security UI in Downloads in Google Chrome on Android prior to 101.0.4951.41 allowed a remote attacker to spoof the APK downloads dialog via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1301180'}, {'name': 'GLSA-202208-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-25'}]
CVE State: PUBLISHED
Explain CVE-2022-1496
Use after free in File Manager in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to potentially exploit heap corruption via specific and direct user interaction.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1306391'}, {'name': 'GLSA-202208-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-25'}]
CVE State: PUBLISHED
Explain CVE-2022-1497
Inappropriate implementation in Input in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to spoof the contents of cross-origin websites via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1264543'}, {'name': 'GLSA-202208-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-25'}]
CVE State: PUBLISHED
Explain CVE-2022-1498
Inappropriate implementation in HTML Parser in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1297138'}, {'name': 'GLSA-202208-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-25'}]
CVE State: PUBLISHED
Explain CVE-2022-1499
Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1000408'}, {'name': 'GLSA-202208-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-25'}]
CVE State: PUBLISHED
Explain CVE-2022-1500
Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1223475'}, {'name': 'GLSA-202208-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-25'}]
CVE State: PUBLISHED
Explain CVE-2022-1501
Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Affected Products: Chrome
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html'}, {'tags': ['x_refsource_MISC'], 'url': 'https://crbug.com/1293191'}, {'name': 'GLSA-202208-25', 'tags': ['vendor-advisory', 'x_refsource_GENTOO'], 'url': 'https://security.gentoo.org/glsa/202208-25'}]
CVE State: PUBLISHED
Explain CVE-2022-1502
Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions.
Affected Products: Octopus Server
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://advisories.octopus.com/post/2022/sa2022-03/'}]
CVE State: PUBLISHED
Explain CVE-2022-1503
A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like <script>alert(1)</script> leads to cross site scripting. The attack may be launched remotely but requires authentication. Expoit details have been disclosed within the advisory.
Affected Products: CMS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/joinia/project/blob/main/GetSimple/GetSimplereadme.md'}, {'tags': ['x_refsource_MISC'], 'url': 'https://vuldb.com/?id.198542'}]
CVE State: PUBLISHED
Explain CVE-2022-1504
XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks.
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/b8e5c324-3dfe-46b4-8095-1697c6b0a6d6'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/1f6a4de416a85e626dc643bb5ceb916e4802223e'}]
CVE State: PUBLISHED
Explain CVE-2022-1505
The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.6.
Affected Products: RSVPMaker
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2715095%40rsvpmaker&new=2715095%40rsvpmaker&sfp_email=&sfph_mail='}, {'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1505'}]
CVE State: PUBLISHED
Explain CVE-2022-1506
The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks
Affected Products: WP BORN BABIES PLUGIN
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/ee4f6786-27e4-474c-85e0-715b0c0f2776'}]
CVE State: PUBLISHED
Explain CVE-2022-1507
chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in GitHub repository hpjansson/chafa prior to 1.10.2. chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file.
Affected Products: hpjansson/chafa
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/104d8c5d-cac5-4baa-9ac9-291ea0bcab95'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/hpjansson/chafa/commit/e4b777c7b7c144cd16a0ea96108267b1004fe6c9'}, {'name': 'FEDORA-2022-e72698d659', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L54UEP5S254VP5FZWGFPHLTPMFJVOGYT/'}, {'name': 'FEDORA-2022-4bdf35a1b5', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIOAZPITFL2Y7Y6KHCZ4OIK7P7KWFN22/'}, {'name': 'FEDORA-2022-0aab67e874', 'tags': ['vendor-advisory', 'x_refsource_FEDORA'], 'url': 'https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PLHKTQYK6AO3M5NAVM3CDVQTZZS6MCO/'}]
CVE State: PUBLISHED
Explain CVE-2022-1508
An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() function with some special parameters. This flaw allows a local user to read some memory out of bounds.
Affected Products: Kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2075533'}, {'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=89c2b3b74918200e46699338d7bcc19b1ea12110'}, {'tags': ['x_refsource_MISC'], 'url': 'https://access.redhat.com/security/cve/CVE-2022-1508'}, {'tags': ['x_refsource_MISC'], 'url': 'https://ubuntu.com/security/CVE-2022-1508'}]
CVE State: PUBLISHED
Explain CVE-2022-1509
Sed Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context.
Affected Products: hestiacp/hestiacp
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/09e69dff-f281-4e51-8312-ed7ab7606338'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/hestiacp/hestiacp/commit/d50f95cf208049dfb6ac67a8020802121745bd60'}]
CVE State: PUBLISHED
Explain CVE-2022-1510
An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing the attacker to cause uncontrolled resource consumption.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/343276'}, {'tags': ['x_refsource_MISC'], 'url': 'https://hackerone.com/reports/1353058'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1510.json'}]
CVE State: PUBLISHED
Explain CVE-2022-1511
Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4.
Affected Products: snipe/snipe-it
References: [{'url': 'https://huntr.dev/bounties/4a1723e9-5bc4-4c4b-bceb-1c45964cc71d'}, {'url': 'https://github.com/snipe/snipe-it/commit/2e9cf8fa87a025c0eac9f79f4864b3fdd33a950c'}]
CVE State: PUBLISHED
Explain CVE-2022-1512
The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Affected Products: ScrollReveal.js Effects
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/a754a516-07fc-44f1-9c34-31e963460301'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/166820/'}]
CVE State: PUBLISHED
Explain CVE-2022-1513
A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website.
Affected Products: PCManager
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://iknow.lenovo.com.cn/detail/dc_203545.html'}]
CVE State: PUBLISHED
Explain CVE-2022-1514
Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account.
Affected Products: neorazorx/facturascripts
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/4ae2a917-843a-4ae4-8197-8425a596761c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/neorazorx/facturascripts/commit/aa9f28cb86467468f43486b77ddef7ff4d3c687e'}]
CVE State: PUBLISHED
Explain CVE-2022-1515
A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This issue can potentially result in DoS.
Affected Products: matio
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/tbeu/matio/issues/186'}, {'tags': ['x_refsource_MISC'], 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2079986'}]
CVE State: PUBLISHED
Explain CVE-2022-1516
A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system.
Affected Products: Kernel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=7781607938c8'}, {'name': '[oss-security] 20220619 Linux kernel: CVE-2022-1516: NULL pointer dereference in Linux kernel`s X.25 network protocol', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'http://www.openwall.com/lists/oss-security/2022/06/19/1'}, {'name': '[debian-lts-announce] 20220701 [SECURITY] [DLA 3065-1] linux security update', 'tags': ['mailing-list', 'x_refsource_MLIST'], 'url': 'https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html'}, {'name': 'DSA-5173', 'tags': ['vendor-advisory', 'x_refsource_DEBIAN'], 'url': 'https://www.debian.org/security/2022/dsa-5173'}]
CVE State: PUBLISHED
Explain CVE-2022-1517
LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.
Affected Products: NextSeq 550Dx
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02'}]
CVE State: PUBLISHED
Explain CVE-2022-1518
LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.
Affected Products: NextSeq 550Dx
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02'}]
CVE State: PUBLISHED
Explain CVE-2022-1519
LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.
Affected Products: NextSeq 550Dx
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02'}]
CVE State: PUBLISHED
Explain CVE-2022-1520
When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird < 91.9.
Affected Products: Thunderbird
References: [{'url': 'https://www.mozilla.org/security/advisories/mfsa2022-18/'}, {'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1745019'}]
CVE State: PUBLISHED
Explain CVE-2022-1521
LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data.
Affected Products: NextSeq 550Dx
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02'}]
CVE State: PUBLISHED
Explain CVE-2022-1522
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which allows an attacker to create false logs that show the password as having been changed when it is not, complicating forensics.
Affected Products: 3D-A1000 Dimensioning System
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03'}]
CVE State: PUBLISHED
Explain CVE-2022-1523
Fuji Electric D300win prior to version 3.7.1.17 is vulnerable to a write-what-where condition, which could allow an attacker to overwrite program memory to manipulate the flow of information.
Affected Products: D300win
References: [{'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-05'}]
CVE State: PUBLISHED
Explain CVE-2022-1524
LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials.
Affected Products: NextSeq 550Dx
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02'}]
CVE State: PUBLISHED
Explain CVE-2022-1525
The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow attackers to bypass web access controls by inspecting and modifying the source code of password protected web elements.
Affected Products: 3D-A1000 Dimensioning System
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03'}]
CVE State: PUBLISHED
Explain CVE-2022-1526
A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input <script>alert(1);</script> leads to cross site scripting. It is possible to initiate the attack remotely but it requires a signup and login by the attacker. The exploit has been disclosed to the public and may be used.
Affected Products: Emlog Pro
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/emlog%3C=pro-1.2.2%20Stored%20Cross-Site%20Scripting%28XSS%29.md'}, {'tags': ['x_refsource_MISC'], 'url': 'https://vuldb.com/?id.198705'}]
CVE State: PUBLISHED
Explain CVE-2022-1527
The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
Affected Products: WP 2FA – Two-factor authentication for WordPress
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/0260d5c0-52a9-44ce-b7be-aff642056d16'}]
CVE State: PUBLISHED
Explain CVE-2022-1528
The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting
Affected Products: VikBooking Hotel Booking Engine & PMS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/d1e59894-382f-4151-8c4c-5608f3d8ac1f'}]
CVE State: PUBLISHED
Explain CVE-2022-1529
An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1.
Affected Products: Firefox ESR
References: [{'url': 'https://www.mozilla.org/security/advisories/mfsa2022-19/'}, {'url': 'https://bugzilla.mozilla.org/show_bug.cgi?id=1770048'}]
CVE State: PUBLISHED
Explain CVE-2022-1530
Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript on the application.
Affected Products: livehelperchat/livehelperchat
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/8fd8de01-7e83-4324-9cc8-a97acb9b70d6'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/livehelperchat/livehelperchat/commit/edef7a8387be718d0de2dfd1e722789afb0461bc'}]
CVE State: PUBLISHED
Explain CVE-2022-1531
SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in GitHub repository rtxteam/rtx prior to checkpoint_2022-04-20 . This vulnerability is critical as it can lead to remote code execution and thus complete server takeover.
Affected Products: rtxteam/rtx
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/fc4eb544-ef1e-412d-9fdb-0ceb04e038fe'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/rtxteam/rtx/commit/fa2797e656e3dba18f990a2db1f0f029d41f1921'}]
CVE State: PUBLISHED
Explain CVE-2022-1532
Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Affected Products: Themify – WooCommerce Product Filter
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/d106cd93-cb9b-4558-9a29-0d556fd7c9e1'}]
CVE State: PUBLISHED
Explain CVE-2022-1533
Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. This vulnerability is capable of arbitrary code execution.
Affected Products: bfabiszewski/libmobi
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/cb574ce1-fbf7-42ea-9e6a-91e17adecdc3'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/bfabiszewski/libmobi/commit/eafc415bc6067e72577f70d6dd5acbf057ce6e6f'}]
CVE State: PUBLISHED
Explain CVE-2022-1534
Buffer Over-read at parse_rawml.c:1416 in GitHub repository bfabiszewski/libmobi prior to 0.11. The bug causes the program reads data past the end of the intented buffer. Typically, this can allow attackers to read sensitive information from other memory locations or cause a crash.
Affected Products: bfabiszewski/libmobi
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/9a90ffa1-38f5-4685-9c00-68ba9068ce3d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/bfabiszewski/libmobi/commit/fb1ab50e448ddbed746fd27ae07469bc506d838b'}]
CVE State: PUBLISHED
Explain CVE-2022-1536
A vulnerability has been found in automad up to 1.10.9 and classified as problematic. This vulnerability affects the Dashboard. The manipulation of the argument title with the input Home</title><script>alert("home")</script><title> leads to a cross site scripting. The attack can be initiated remotely but requires an authentication. The exploit details have disclosed to the public and may be used.
Affected Products: automad
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/automad%3C%3D1.10.9%20Stored%20Cross-Site%20Scripting%28XSS%29.md'}, {'tags': ['x_refsource_MISC'], 'url': 'https://vuldb.com/?id.198706'}]
CVE State: PUBLISHED
Explain CVE-2022-1537
file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.
Affected Products: gruntjs/grunt
References: [{'url': 'https://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d'}, {'url': 'https://github.com/gruntjs/grunt/commit/58016ffac5ed9338b63ecc2a63710f5027362bae'}, {'name': '[debian-lts-announce] 20230405 [SECURITY] [DLA 3383-1] grunt security update', 'tags': ['mailing-list'], 'url': 'https://lists.debian.org/debian-lts-announce/2023/04/msg00006.html'}]
CVE State: PUBLISHED
Explain CVE-2022-1539
The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.
Affected Products: Exports and Reports
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/50f70927-9677-4ba4-a388-0a41ed356523'}]
CVE State: PUBLISHED
Explain CVE-2022-1540
The PostmagThemes Demo Import WordPress plugin through 1.0.7 does not validate the imported file, allowing high-privilege users such as admin to upload arbitrary files (such as PHP) leading to RCE.
Affected Products: PostmagThemes Demo Import
References: [{'url': 'https://wpscan.com/vulnerability/77a524d8-0b1a-407a-98d2-d8d0ed78fa0f', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-1541
The Video Slider WordPress plugin before 1.4.8 does not sanitize or escape some of its video settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Affected Products: Video Slider – Slider Carousel
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/053a9815-cf0a-472e-844a-3dea407ce022'}]
CVE State: PUBLISHED
Explain CVE-2022-1542
The HPB Dashboard WordPress plugin through 1.3.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Affected Products: hpb Dashboard
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/40916242-df03-49a1-9a6a-9af33907e359'}]
CVE State: PUBLISHED
Explain CVE-2022-1543
Improper handling of Length parameter in GitHub repository erudika/scoold prior to 1.49.4. When the text size is large enough the service results in a momentary outage in a production environment. That can lead to memory corruption on the server.
Affected Products: erudika/scoold
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/9889d435-3b9c-4e9d-93bc-5272e0723f9f'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/erudika/scoold/commit/62a0e92e1486ddc17676a7ead2c07ff653d167ce'}]
CVE State: PUBLISHED
Explain CVE-2022-1544
Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.
Affected Products: luyadev/yii-helpers
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/fa6d6e75-bc7a-40f6-9bdd-2541318912d4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/luyadev/yii-helpers/commit/9956ed63f516110c2b588471507b870e748c4cfb'}]
CVE State: PUBLISHED
Explain CVE-2022-1545
It was possible to disclose details of confidential notes created via the API in Gitlab CE/EE affecting all versions from 13.2 prior to 14.8.6, 14.9 prior to 14.9.4, and 14.10 prior to 14.10.1 if an unauthorised project member was tagged in the note.
Affected Products: GitLab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://gitlab.com/gitlab-org/gitlab/-/issues/351030'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1545.json'}]
CVE State: PUBLISHED
Explain CVE-2022-1546
The WooCommerce - Product Importer WordPress plugin through 1.5.2 does not sanitise and escape the imported data before outputting it back in the page, leading to a Reflected Cross-Site Scripting
Affected Products: WooCommerce – Product Importer
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/5ec6182c-6917-4c48-90ce-e0ebe38e7595'}]
CVE State: PUBLISHED
Explain CVE-2022-1547
The Check & Log Email WordPress plugin before 1.0.6 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
Affected Products: Check & Log Email
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/83eca346-7045-414e-81fc-e0d9b735f0bd'}]
CVE State: PUBLISHED
Explain CVE-2022-1548
Mattermost Playbooks plugin 1.25 and earlier fails to properly restrict user-level permissions, which allows playbook members to escalate their membership privileges and perform actions restricted to playbook admins.
Affected Products: Mattermost Playbooks
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://mattermost.com/security-updates/'}]
CVE State: PUBLISHED
Explain CVE-2022-1549
The WP Athletics WordPress plugin through 1.1.7 does not sanitize parameters before storing them in the database, nor does it escape the values when outputting them back in the admin dashboard, leading to a Stored Cross-Site Scripting vulnerability.
Affected Products: WP Athletics
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/afef06f5-71a6-4372-9648-0db59f9b254f'}]
CVE State: PUBLISHED
Explain CVE-2022-1551
The SP Project & Document Manager WordPress plugin before 4.58 uses an easily guessable path to store user files, bad actors could use that to access other users' sensitive files.
Affected Products: SP Project & Document Manager
References: [{'url': 'https://wpscan.com/vulnerability/51b4752a-7922-444d-a022-f1c7159b5d84', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-1552
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activated relevant protections too late or not at all during the process. This flaw allows an attacker with permission to create non-temporary objects in at least one schema to execute arbitrary SQL functions under a superuser identity.
Affected Products: postgresql
References: [{'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=2081126'}, {'url': 'https://www.postgresql.org/about/news/postgresql-143-137-1211-1116-and-1021-released-2449/'}, {'url': 'https://www.postgresql.org/support/security/CVE-2022-1552/'}, {'url': 'https://access.redhat.com/security/cve/CVE-2022-1552'}, {'url': 'https://security.netapp.com/advisory/ntap-20221104-0005/'}, {'name': 'GLSA-202211-04', 'tags': ['vendor-advisory'], 'url': 'https://security.gentoo.org/glsa/202211-04'}]
CVE State: PUBLISHED
Explain CVE-2022-1553
Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.
Affected Products: publify/publify
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/b398e4c9-6cdf-4973-ad86-da796cde221f'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/publify/publify/commit/1a78f16f460847274265a12a9555b3524892d7db'}]
CVE State: PUBLISHED
Explain CVE-2022-1554
Path Traversal due to `send_file` call in GitHub repository clinical-genomics/scout prior to 4.52.
Affected Products: clinical-genomics/scout
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/7acac778-5ba4-4f02-99e2-e4e17a81e600'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/clinical-genomics/scout/commit/952a2e2319af2d95d22b017a561730feac086ff1'}]
CVE State: PUBLISHED
Explain CVE-2022-1555
DOM XSS in microweber ver 1.2.15 in GitHub repository microweber/microweber prior to 1.2.16. inject arbitrary js code, deface website, steal cookie...
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/d9f9b5bd-16f3-4eaa-9e36-d4958b557687'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/724e2d186a33c0c27273107dc4f160a09384877f'}]
CVE State: PUBLISHED
Explain CVE-2022-1556
The StaffList WordPress plugin before 3.1.5 does not properly sanitise and escape a parameter before using it in a SQL statement when searching for Staff in the admin dashboard, leading to an SQL Injection
Affected Products: StaffList
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/04890549-6bd1-44dd-8bce-7125c01be5d4'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/166918/'}]
CVE State: PUBLISHED
Explain CVE-2022-1557
The ULeak Security & Monitoring WordPress plugin through 1.2.3 does not have authorisation and CSRF checks when updating its settings, and is also lacking sanitisation as well as escaping in some of them, which could allow any authenticated users such as subscriber to perform Stored Cross-Site Scripting attacks against admins viewing the settings
Affected Products: ULeak Security & Monitoring Plugin
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/e2b6dbf5-8709-4a2c-90be-3214ff55ed56'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/166564/'}]
CVE State: PUBLISHED
Explain CVE-2022-1558
The Curtain WordPress plugin through 1.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed
Affected Products: Curtain
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/0414dad4-e90b-4122-8b77-a8a958ab824d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/166839/'}]
CVE State: PUBLISHED
Explain CVE-2022-1559
The Clipr WordPress plugin through 1.2.3 does not sanitise and escape its API Key settings before outputting it in an attribute, leading to a Stored Cross-Site Scripting issue even when the unfiltered_html capability is disallowed
Affected Products: Clipr
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/99059337-c3cd-4e91-9a03-df32a05b719c'}, {'tags': ['x_refsource_MISC'], 'url': 'https://packetstormsecurity.com/files/166530/'}]
CVE State: PUBLISHED
Explain CVE-2022-1560
The Amministrazione Aperta WordPress plugin before 3.8 does not validate the open parameter before using it in an include statement, leading to a Local File Inclusion issue. The original advisory mentions that unauthenticated users can exploit this, however the affected file generates a fatal error when accessed directly and the affected code is not reached. The issue can be exploited via the dashboard when logged in as an admin, or by making a logged in admin open a malicious link
Affected Products: Amministrazione Aperta
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/5c5fbbea-92d2-46bb-9a70-75155fffb6de'}]
CVE State: PUBLISHED
Explain CVE-2022-1561
Lura and KrakenD-CE versions older than v2.0.2 and KrakenD-EE versions older than v2.0.0 do not sanitize URL parameters correctly, allowing a malicious user to alter the backend URL defined for a pipe when remote users send crafty URL requests. The vulnerability does not affect KrakenD itself, but the consumed backend might be vulnerable.
Affected Products: Lura Project
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.incibe-cert.es/en/early-warning/security-advisories/crafted-backend-urls-lura-project'}, {'tags': ['x_refsource_CONFIRM'], 'url': 'https://www.krakend.io/blog/cve-2022-1561-crafted-backend-urls/'}]
CVE State: PUBLISHED
Explain CVE-2022-1562
The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
Affected Products: Enable SVG
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/8e5b1e4f-c132-42ee-b2d0-7306ab4ab615'}]
CVE State: PUBLISHED
Explain CVE-2022-1564
The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Affected Products: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/a487c7e7-667c-4c92-a427-c43cc13b348d'}]
CVE State: PUBLISHED
Explain CVE-2022-1565
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.
Affected Products: Import any XML or CSV File to WordPress
References: [{'url': 'https://plugins.trac.wordpress.org/changeset/2749264/wp-all-import/trunk?contextall=1&old=2737093&old_path=%2Fwp-all-import%2Ftrunk'}, {'url': 'https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1565'}, {'url': 'http://packetstormsecurity.com/files/171578/WordPress-WP-All-Import-3.6.7-Remote-Code-Execution.html'}]
CVE State: PUBLISHED
Explain CVE-2022-1566
The Quotes llama WordPress plugin before 1.0.0 does not sanitise and escape Quotes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. The attack could also be performed by tricking an admin to import a malicious CSV file
Affected Products: Quotes llama
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/0af030d8-b676-4826-91c0-98706b816f3c'}]
CVE State: PUBLISHED
Explain CVE-2022-1567
The WP-JS plugin for WordPress contains a script called wp-js.php with the function wp_js_admin, that accepts unvalidated user input and echoes it back to the user. This can be used for reflected Cross-Site Scripting in versions up to, and including, 2.0.6.
Affected Products: WP JS
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1567'}, {'tags': ['x_refsource_MISC'], 'url': 'https://plugins.trac.wordpress.org/browser/wp-js/trunk/wp-js.php?rev=100281#L140'}]
CVE State: PUBLISHED
Explain CVE-2022-1568
The Team Members WordPress plugin before 5.1.1 does not escape some of its Team settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed
Affected Products: Team Members
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/88328d17-ffc9-4b94-8b01-ad2fd3047fbc'}]
CVE State: PUBLISHED
Explain CVE-2022-1569
The Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more! WordPress plugin before 1.4.9.4 does not sanitise and escape some of its form fields, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks when unfiltered_html is disallowed
Affected Products: Drag & Drop Builder, Human Face Detector, Pre-built Templates, Spam Protection, User Email Notifications & more!
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/5a2756c1-9abf-4fd6-8ce2-9f840514dfcc'}]
CVE State: PUBLISHED
Explain CVE-2022-1570
The Files Download Delay WordPress plugin before 1.0.7 does not have authorisation and CSRF checks when reseting its settings, which could allow any authenticated users, such as subscriber to perform such action.
Affected Products: Files Download Delay
References: [{'url': 'https://wpscan.com/vulnerability/c0257564-48ee-4d02-865f-82c8b5e793c9', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-1571
Cross-site scripting - Reflected in Create Subaccount in GitHub repository neorazorx/facturascripts prior to 2022.07. This vulnerability can be arbitrarily executed javascript code to steal user'cookie, perform HTTP request, get content of `same origin` page, etc ...
Affected Products: neorazorx/facturascripts
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/4578a690-73e5-4313-840c-ee15e5329741'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/neorazorx/facturascripts/commit/482c5a82b4d79e7a19614f5a67dc24593046cefd'}]
CVE State: PUBLISHED
Explain CVE-2022-1572
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file
Affected Products: HTML2WP
References: [{'url': 'https://wpscan.com/vulnerability/9afd1805-d449-4551-986a-f92cb47c95c5', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-1573
The HTML2WP WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them
Affected Products: HTML2WP
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/9c1acd9c-999f-4a35-a272-1ad31552e685'}]
CVE State: PUBLISHED
Explain CVE-2022-1574
The HTML2WP WordPress plugin through 1.0.0 does not have authorisation and CSRF checks when importing files, and does not validate them, as a result, unauthenticated attackers can upload arbitrary files (such as PHP) on the remote server
Affected Products: HTML2WP
References: [{'url': 'https://wpscan.com/vulnerability/c36d0ea8-bf5c-4af9-bd3d-911eb02adc14', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-1575
Arbitrary Code Execution through Sanitizer Bypass in GitHub repository jgraph/drawio prior to 18.0.0. - Arbitrary (remote) code execution in the desktop app. - Stored XSS in the web app.
Affected Products: jgraph/drawio
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/033d3423-eb05-4b53-a747-1bfcba873127'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/jgraph/drawio/commit/f768ed73875d5eca20110b9c1d72f2789cd1bab7'}]
CVE State: PUBLISHED
Explain CVE-2022-1576
The WP Maintenance Mode & Coming Soon WordPress plugin before 2.4.5 is lacking CSRF when emptying the subscribed users list, which could allow attackers to make a logged in admin perform such action via a CSRF attack
Affected Products: WP Maintenance Mode & Coming Soon
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/68deab46-1c16-46ae-a912-a104958ca4cf'}]
CVE State: PUBLISHED
Explain CVE-2022-1577
The Database Backup for WordPress plugin before 2.5.2 does not have CSRF check in place when updating the schedule backup settings, which could allow an attacker to make a logged in admin change them via a CSRF attack. This could lead to cases where attackers can send backup notification emails to themselves, which contain more details. Or disable the automatic backup schedule
Affected Products: Database Backup for WordPress
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/39388900-266d-4308-88e7-d40ca6bbe346'}]
CVE State: PUBLISHED
Explain CVE-2022-1578
The My wpdb WordPress plugin before 2.5 is missing CSRF check when running SQL queries, which could allow attacker to make a logged in admin run arbitrary SQL query via a CSRF attack
Affected Products: My wpdb
References: [{'url': 'https://wpscan.com/vulnerability/c280da92-4ac2-43ea-93a2-6c583b79b98b', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-1579
The function check_is_login_page() uses headers for the IP check, which can be easily spoofed.
Affected Products: Login Block IPs
References: [{'url': 'https://wpscan.com/vulnerability/6f3d40fa-458b-44f0-9407-763e80b29668', 'tags': ['exploit', 'vdb-entry', 'technical-description']}]
CVE State: PUBLISHED
Explain CVE-2022-1580
The Site Offline Or Coming Soon Or Maintenance Mode WordPress plugin before 1.5.3 prevents users from accessing a website but does not do so if the URL contained certain keywords. Adding those keywords to the URL's query string would bypass the plugin's main feature.
Affected Products: Site Offline Or Coming Soon Or Maintenance Mode
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/7b6f91cd-5a00-49ca-93ff-db7220d2630a'}]
CVE State: PUBLISHED
Explain CVE-2022-1581
The WP-Polls WordPress plugin before 2.76.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations.
Affected Products: WP-Polls
References: [{'url': 'https://wpscan.com/vulnerability/c1896ab9-9585-40e2-abbf-ef5153b3c6b2', 'tags': ['exploit', 'vdb-entry', 'technical-description']}, {'url': 'https://www.hightechdad.com/2009/12/21/warning-wp-polls-wordpress-poll-plugin-can-be-exploited/'}]
CVE State: PUBLISHED
Explain CVE-2022-1582
The External Links in New Window / New Tab WordPress plugin before 1.43 does not properly escape URLs it concatenates to onclick event handlers, which makes Stored Cross-Site Scripting attacks possible.
Affected Products: External Links in New Window / New Tab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/cbb75383-4351-4488-aaca-ddb0f6f120cd'}]
CVE State: PUBLISHED
Explain CVE-2022-1583
The External Links in New Window / New Tab WordPress plugin before 1.43 does not ensure window.opener is set to "null" when links to external sites are clicked, which may enable tabnabbing attacks to occur.
Affected Products: External Links in New Window / New Tab
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/aa9d727c-4d17-4220-b8cb-e6dec30361a9'}]
CVE State: PUBLISHED
Explain CVE-2022-1584
Reflected XSS in GitHub repository microweber/microweber prior to 1.2.16. Executing JavaScript as the victim
Affected Products: microweber/microweber
References: [{'tags': ['x_refsource_CONFIRM'], 'url': 'https://huntr.dev/bounties/69f4ca67-d615-4f25-b2d1-19df7bf1107d'}, {'tags': ['x_refsource_MISC'], 'url': 'https://github.com/microweber/microweber/commit/527abd148e6b7aff8df92a9f1aa951e5bebac59c'}]
CVE State: PUBLISHED
Explain CVE-2022-1585
The Project Source Code Download WordPress plugin through 1.0.0 does not protect its backup generation and download functionalities, which may allow any visitors on the site to download the entire site, including sensitive files like wp-config.php.
Affected Products: WordPress project source code download
References: [{'tags': ['x_refsource_MISC'], 'url': 'https://wpscan.com/vulnerability/e709958c-7bce-45d7-9a0a-6e0ed12cd03f'}]
CVE State: PUBLISHED