Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
d PDF file to be parsed. The issue has been patched in muhammara version 3.4.0 and the fix has been backported to version 2.6.2. As a workaround, do not process files from untrusted sources. If using hummus, replace the package with muhammara. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/julianhille/MuhammaraJS/security/advisories/GHSA-2r7v-cmch-5x26 - https://github.com/julianhille/MuhammaraJS/pull/235 - https://github.com/julianhille/MuhammaraJS/pull/238
CVE ID: CVE-2022-41958 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-04-22T15:59:43.385Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: 4ra1n Products: super-xray Problem Types: CWE-502 Description: super-xray is a web vulnerability scanning tool. Versions prior to 0.7 assumed trusted input for the program config which is stored in a yaml file. An attacker with local access to the file could exploit this and compromise the program. This issue has been addressed in commit `4d0d5966` and will be included in future releases. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Prog
eases. Users are advised to upgrade. There are no known workarounds for this issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/4ra1n/super-xray/security/advisories/GHSA-39pv-4vmj-c4fr - https://github.com/4ra1n/super-xray/commit/4d0d59663596db03f39d7edd2be251d48b52dcfc
CVE ID: CVE-2022-41960 State: PUBLISHED Published: 2022-12-15T23:56:26.500Z Last Updated: 2025-04-17T18:07:27.624Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-345 Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3, are subject to Insufficient Verification of Data Authenticity, resulting in Denial of Service. An attacker can make a Meteor call to `validateAuthToken` using a victim's userId, meetingId, and an invalid authToken. This forces the victim to leave the conference, because the resulting verification failure is also observed and handled by the victi
the victim to leave the conference, because the resulting verification failure is also observed and handled by the victim's client. The attacker must be a participant in any meeting on the server. This issue is patched in version 2.4.3. There are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-rgjp-3r74-g4cm - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1
CVE ID: CVE-2022-41961 State: PUBLISHED Published: 2022-12-16T12:24:43.465Z Last Updated: 2025-04-17T17:24:47.412Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-346, CWE-345 Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6 are subject to Ineffective user bans. The attacker could register multiple users, and join the meeting with one of them. When that user is banned, they could still join the meeting with the remaining registered users from the same extId. This issue has been fixed by improving permissions such that banning a user removes all users rela
from the same extId. This issue has been fixed by improving permissions such that banning a user removes all users related to their extId, including registered users that have not joined the meeting. This issue is patched in versions 2.4-rc-6 and 2.5-alpha-1. There are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-wxjp-h88g-7fqg - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1
CVE ID: CVE-2022-41962 State: PUBLISHED Published: 2022-12-16T12:45:06.499Z Last Updated: 2025-04-17T15:37:50.823Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-863 Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4-rc-6, and 2.5-alpha-1 contain Incorrect Authorization for setting emoji status. A user with moderator rights can use the clear status feature to set any emoji status for other users. Moderators should only be able to set none as the status of other users. This issue is patched in 2.4-rc-6 and 2.5-alpha-1There are no workarounds. Additional Analyst Not
status of other users. This issue is patched in 2.4-rc-6 and 2.5-alpha-1There are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-88qf-33qm-9mm7 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4-rc-6 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.5-alpha-1
CVE ID: CVE-2022-41963 State: PUBLISHED Published: 2022-12-16T13:00:42.459Z Last Updated: 2025-04-17T15:35:44.332Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-281 Description: BigBlueButton is an open source web conferencing system. Versions prior to 2.4.3 contain a whiteboard grace period that exists to handle delayed messages, but this grace period could be used by attackers to take actions in the few seconds after their access is revoked. The attacker must be a meeting participant. This issue is patched in version 2.4.3 an version 2.5-alpha-1 Additional Analyst Notes: - CVE Program Container: - CIS
. This issue is patched in version 2.4.3 an version 2.5-alpha-1 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-v6p9-926c-6qfp - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.3
CVE ID: CVE-2022-41964 State: PUBLISHED Published: 2022-12-16T17:17:15.394Z Last Updated: 2025-04-17T15:34:13.275Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: bigbluebutton Products: bigbluebutton Problem Types: CWE-200 Description: BigBlueButton is an open source web conferencing system. This vulnerability only affects release candidates of BigBlueButton 2.4. The attacker can start a subscription for poll results before starting an anonymous poll, and use this subscription to see individual responses in the anonymous poll. The attacker had to be a meeting presenter. This issue is patched in version 2.4.0. There are no workarounds. Additional Analyst Not
had to be a meeting presenter. This issue is patched in version 2.4.0. There are no workarounds. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/bigbluebutton/bigbluebutton/security/advisories/GHSA-fgmj-rx7j-fqr4 - https://github.com/bigbluebutton/bigbluebutton/releases/tag/v2.4.0
CVE ID: CVE-2022-41965 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-23T16:34:13.752Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: opencast Products: opencast Problem Types: CWE-601 Description: Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to Opencast 12.5, Opencast's Paella authentication page could be used to redirect to an arbitrary URL for authenticated users. The vulnerability allows attackers to redirect users to sites outside of one's Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12
Opencast install, potentially facilitating phishing attacks or other security issues. This issue is fixed in Opencast 12.5 and newer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/opencast/opencast/security/advisories/GHSA-r3qr-vwvg-43f7 - https://github.com/opencast/opencast/commit/d2ce2321590f86b066a67e8c231cf68219aea017
CVE ID: CVE-2022-41966 State: PUBLISHED Published: 2022-12-27T23:07:54.048Z Last Updated: 2025-04-11T14:51:09.642Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: x-stream Products: xstream Problem Types: CWE-120, CWE-121, CWE-502 Description: XStream serializes Java objects to XML and back again. Versions prior to 1.4.20 may allow a remote attacker to terminate the application with a stack overflow error, resulting in a denial of service only via manipulation the processed input stream. The attack uses the hash code implementation for collections and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 whi
tions and maps to force recursive hash calculation causing a stack overflow. This issue is patched in version 1.4.20 which handles the stack overflow and raises an InputManipulationException instead. A potential workaround for users who only use HashMap or HashSet and whose XML refers these only as default map or set, is to change the default implementation of java.util.Map and java.util per the code example in the referenced advisory. However, this implies that your application does not care about the implementation of the map and all elements are comparable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/x-stream/xstream/securit
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/x-stream/xstream/security/advisories/GHSA-j563-grx4-pjpv - https://x-stream.github.io/CVE-2022-41966.html
CVE ID: CVE-2022-41967 State: PUBLISHED Published: 2022-12-27T23:45:00.786Z Last Updated: 2025-04-14T16:23:21.201Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: HyperaDev Products: Dragonfly Problem Types: CWE-611 Description: Dragonfly is a Java runtime dependency management library. Dragonfly v0.3.0-SNAPSHOT does not configure DocumentBuilderFactory to prevent XML external entity (XXE) attacks. This issue is patched in 0.3.1-SNAPSHOT. As a workaround, since Dragonfly only parses XML `SNAPSHOT` versions are being resolved, this vulnerability may be avoided by not trying to resolve `SNAPSHOT` versions. Additional Analyst Notes: - CVE Program Container: - CISA
may be avoided by not trying to resolve `SNAPSHOT` versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/HyperaDev/Dragonfly/security/advisories/GHSA-6x3m-96qp-mmxv - https://github.com/HyperaDev/Dragonfly/commit/9661375e1135127ca6cdb5712e978bec33cc06b3
CVE ID: CVE-2022-41968 State: PUBLISHED Published: 2022-12-01T20:38:46.973Z Last Updated: 2025-04-23T16:33:31.118Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-400 Description: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.10 and 24.0.5, calendar name lengths are not validated before writing to a database. As a result, an attacker can send unnecessary amounts of data against the database. Version 23.0.10 and 24.0.5 contain patches for the issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References
known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-m92j-xxc8-hq3v - https://github.com/nextcloud/server/pull/33139 - https://hackerone.com/reports/1596148
CVE ID: CVE-2022-41969 State: PUBLISHED Published: 2022-12-01T20:47:50.466Z Last Updated: 2025-04-23T16:33:25.528Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:L) Vendors: nextcloud Products: security-advisories Problem Types: CWE-400 Description: Nextcloud Server is an open source personal cloud server. Prior to versions 23.0.11, 24.0.7, and 25.0.0, there is no password length limit when creating a user as an administrator. An administrator can cause a limited DoS attack against their own server. Versions 23.0.11, 24.0.7, and 25.0.0 contain a fix for the issue. As a workaround, don't create user accounts with long passwords. Additional Analyst Notes: - CVE Program Cont
the issue. As a workaround, don't create user accounts with long passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-4gm7-j7wg-m4fx - https://github.com/nextcloud/server/pull/34500 - https://hackerone.com/reports/1727424
CVE ID: CVE-2022-41970 State: PUBLISHED Published: 2022-12-01T20:54:37.460Z Last Updated: 2025-04-23T16:33:19.664Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-284, CWE-863 Description: Nextcloud Server is an open source personal cloud server. Prior to versions 24.0.7 and 25.0.1, disabled download shares still allow download through preview images. Images could be downloaded and previews of documents (first page) can be downloaded without being watermarked. Versions 24.0.7 and 25.0.1 contain a fix for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: -
1 contain a fix for this issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-9mh6-cph8-772c - https://github.com/nextcloud/server/pull/34788 - https://hackerone.com/reports/1745766
CVE ID: CVE-2022-41971 State: PUBLISHED Published: 2022-12-01T20:55:46.040Z Last Updated: 2025-04-23T16:33:14.121Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: nextcloud Products: security-advisories Problem Types: CWE-359, CWE-200 Description: Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to see videos on a call in a public conversation after being removed from that conversation, provided that they were removed while being in the call. Versions 12.2
ation after being removed from that conversation, provided that they were removed while being in the call. Versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0 contain patches for the issue. No known workarounds are available. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/nextcloud/security-advisories/security/advisories/GHSA-wx6w-xpg9-6fv4 - https://github.com/nextcloud/spreed/pull/7974 - https://hackerone.com/reports/1706248
CVE ID: CVE-2022-41972 State: PUBLISHED Published: 2022-12-16T17:37:57.536Z Last Updated: 2025-04-17T15:33:41.977Z Severity: LOW (CVSS 2.9 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: contiki-ng Products: contiki-ng Problem Types: CWE-476 Description: Contiki-NG is an open-source, cross-platform operating system for Next-Generation IoT devices. Versions prior to 4.9 contain a NULL Pointer Dereference in BLE L2CAP module. The Contiki-NG operating system for IoT devices contains a Bluetooth Low Energy stack. An attacker can inject a packet in this stack, which causes the implementation to dereference a NULL pointer and triggers undefined behavior. More specifically, while processing
s the implementation to dereference a NULL pointer and triggers undefined behavior. More specifically, while processing the L2CAP protocol, the implementation maps an incoming channel ID to its metadata structure. In this structure, state information regarding credits is managed through calls to the function input_l2cap_credit in the module os/net/mac/ble/ble-l2cap.c. Unfortunately, the input_l2cap_credit function does not check that the metadata corresponding to the user-supplied channel ID actually exists, which can lead to the channel variable being set to NULL before a pointer dereferencing operation is performed. The vulnerability has been patched in the "develop" branch of Contiki-NG,
pointer dereferencing operation is performed. The vulnerability has been patched in the "develop" branch of Contiki-NG, and will be included in release 4.9. Users can apply the patch in Contiki-NG pull request #2253 as a workaround until the new package is released. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/contiki-ng/contiki-ng/security/advisories/GHSA-24xp-g5gf-6vvm - https://github.com/contiki-ng/contiki-ng/pull/2253
CVE ID: CVE-2022-41973 State: PUBLISHED Published: 2022-10-29T00:00:00 Last Updated: 2024-08-03T12:56:39.104Z Vendors: n/a Products: n/a Problem Types: n/a Description: multipath-tools 0.7.7 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited in conjunction with CVE-2022-41974. Local users able to access /dev/shm can change symlinks in multipathd due to incorrect symlink handling, which could lead to controlled file writes outside of the /dev/shm directory. This could be used indirectly for local privilege escalation to root. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1202739 - https://github.com/op
Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1202739 - https://github.com/opensvc/multipath-tools/releases/tag/0.9.2 - http://www.openwall.com/lists/oss-security/2022/10/24/2 - http://seclists.org/fulldisclosure/2022/Oct/25 - http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/ - https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt - http://www.openwall.com/lists/oss-security/2022/11/30/2 - http://seclists.org/fulldisclosure/2022/Dec/4 - http://packet
http://www.openwall.com/lists/oss-security/2022/11/30/2 - http://seclists.org/fulldisclosure/2022/Dec/4 - http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html - https://www.debian.org/security/2023/dsa-5366 - https://security.gentoo.org/glsa/202311-06
CVE ID: CVE-2022-41974 State: PUBLISHED Published: 2022-10-29T00:00:00 Last Updated: 2024-08-03T12:56:39.193Z Vendors: n/a Products: n/a Problem Types: n/a Description: multipath-tools 0.7.0 through 0.9.x before 0.9.2 allows local users to obtain root access, as exploited alone or in conjunction with CVE-2022-41973. Local users able to write to UNIX domain sockets can bypass access controls and manipulate the multipath setup. This can lead to local privilege escalation to root. This occurs because an attacker can repeat a keyword, which is mishandled because arithmetic ADD is used instead of bitwise OR. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.co
is used instead of bitwise OR. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1202739 - https://github.com/opensvc/multipath-tools/releases/tag/0.9.2 - http://www.openwall.com/lists/oss-security/2022/10/24/2 - http://seclists.org/fulldisclosure/2022/Oct/25 - http://packetstormsecurity.com/files/169611/Leeloo-Multipath-Authorization-Bypass-Symlink-Attack.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QIGZM5NOOMFDCITOLQEJNNX5SCRQLQVV/ - https://www.qualys.com/2022/10/24/leeloo-multipath/leeloo-multipath.txt - http://www.openwall.com/lists/oss-security/2022/11/30/2 - http://secli
022/10/24/leeloo-multipath/leeloo-multipath.txt - http://www.openwall.com/lists/oss-security/2022/11/30/2 - http://seclists.org/fulldisclosure/2022/Dec/4 - http://packetstormsecurity.com/files/170176/snap-confine-must_mkdir_and_open_with_perms-Race-Condition.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00037.html - https://www.debian.org/security/2023/dsa-5366 - https://security.gentoo.org/glsa/202311-06
CVE ID: CVE-2022-41975 State: PUBLISHED Published: 2022-09-30T17:20:33.000Z Last Updated: 2025-05-20T16:02:59.158Z Vendors: n/a Products: n/a Problem Types: n/a Description: RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://help.realvnc.com/hc/en-us/articles/360002253138-Release-Notes#vnc-server-6-11-0-released-0-2
CVE ID: CVE-2022-41976 State: PUBLISHED Published: 2023-04-10T00:00:00.000Z Last Updated: 2025-02-12T15:59:37.945Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N) Vendors: n/a Products: n/a Problem Types: n/a Description: An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application as a low-privileged user to change role (e.g., to administrator) by updating their user profile. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://scada-lts.org/ - https://github.com/SCADA-LTS/Scada-LTS/releases - https://m3n0sd0n4ld.blogspot.com/2022/11/scada-lt
p://scada-lts.org/ - https://github.com/SCADA-LTS/Scada-LTS/releases - https://m3n0sd0n4ld.blogspot.com/2022/11/scada-lts-privilege-escalation-cve-2022.html
CVE ID: CVE-2022-41977 State: PUBLISHED Published: 2022-12-23T23:03:51.372Z Last Updated: 2025-04-14T19:12:09.833Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: OpenImageIO Project Products: OpenImageIO Problem Types: CWE-125 Description: An out of bounds read vulnerability exists in the way OpenImageIO version v2.3.19.0 processes string fields in TIFF image files. A specially-crafted TIFF file can lead to information disclosure. An attacker can provide a malicious file to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1627
m Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1627 - https://www.debian.org/security/2023/dsa-5384 - https://security.gentoo.org/glsa/202305-33
CVE ID: CVE-2022-41978 State: PUBLISHED Published: 2022-11-09T15:46:23.306Z Last Updated: 2025-02-20T19:54:36.692Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Zoho CRM Products: Zoho CRM Lead Magnet (WordPress plugin) Problem Types: CWE-264 Description: Auth. (subscriber+) Arbitrary Options Update vulnerability in Zoho CRM Lead Magnet plugin <= 1.7.5.8 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/zoho-crm-forms/wordpress-zoho-crm-lead-magnet-plugin-1-7-5-6-auth-arbitrary-options-update-vulnerability?_s_id=cve - https://wordpress.org/plugins/zoho-crm-for
magnet-plugin-1-7-5-6-auth-arbitrary-options-update-vulnerability?_s_id=cve - https://wordpress.org/plugins/zoho-crm-forms/#developers