Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1163 State: PUBLISHED Published: 2022-03-30T06:45:14 Last Updated: 2024-08-02T23:55:24.299Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:L/A:L) Vendors: mineweb Products: mineweb/minewebcms Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository mineweb/minewebcms prior to next. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/44d40f34-c391-40c0-a517-12a2c0258149 - https://github.com/mineweb/minewebcms/commit/06ce52c20f208b0bbf24c6480d60332c9dd19428 - http://packetstormsecurity.com/files/166629/minewebcms-1.15.2-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/5
packetstormsecurity.com/files/166629/minewebcms-1.15.2-Cross-Site-Scripting.html - https://www.exploit-db.com/exploits/50853
CVE ID: CVE-2022-1164 State: PUBLISHED Published: 2022-04-04T15:36:01 Last Updated: 2024-08-02T23:55:24.358Z Vendors: Unknown Products: WYZI Business Finder Problem Types: CWE-79 Description: The Wyzi Theme was affected by reflected XSS vulnerabilities in the business search feature Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/157a9a76-3e5f-4d27-aefc-cb9cb88b3286
CVE ID: CVE-2022-1165 State: PUBLISHED Published: 2022-04-04T15:36:03 Last Updated: 2024-08-02T23:55:24.201Z Vendors: Unknown Products: Blackhole for Bad Bots Problem Types: CWE-639 Description: The Blackhole for Bad Bots WordPress plugin before 3.3.2 uses headers such as CF-CONNECTING-IP, CLIENT-IP etc to determine the IP address of requests hitting the blackhole URL, which allows them to be spoofed. This could result in blocking arbitrary IP addresses, such as legitimate/good search engine crawlers / bots. This could also be abused by competitors to cause damage related to visibility in search engines, can be used to bypass arbitrary blocks caused by this plugin, block any visitor or even
o visibility in search engines, can be used to bypass arbitrary blocks caused by this plugin, block any visitor or even the administrator and even more. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/10d85913-ea8c-4c2e-a32e-fa61cf191710 - https://plugins.trac.wordpress.org/changeset/2666486
CVE ID: CVE-2022-1166 State: PUBLISHED Published: 2022-04-04T15:36:05 Last Updated: 2024-08-02T23:55:24.352Z Vendors: Unknown Products: Noo JobMonster Problem Types: CWE-22 Description: The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189 - https
es: - CVE Program Container: References: - https://wpscan.com/vulnerability/ea6646ac-f71f-4340-965d-fab272da5189 - https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446
CVE ID: CVE-2022-1167 State: PUBLISHED Published: 2022-04-04T15:36:06 Last Updated: 2024-08-02T23:55:24.253Z Vendors: Unknown Products: Careerup Problem Types: CWE-79 Description: There are unauthenticated reflected Cross-Site Scripting (XSS) vulnerabilities in CareerUp Careerup WordPress theme before 2.3.1, via the filter parameters. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a30a1430-c474-4cd1-877c-35c4ab624170 - https://themeforest.net/item/careerup-job-board-wordpress-theme/24002090 - https://m0ze.ru/vulnerability/%5B2020-06-17%5D-%5BWordPress%5D-%5BCWE-79%5D-CareerUp-WordPress-Theme-v2.3.0.txt
CVE ID: CVE-2022-1168 State: PUBLISHED Published: 2022-04-04T15:36:08 Last Updated: 2024-08-02T23:55:24.666Z Vendors: Unknown Products: WP JobSearch Problem Types: CWE-79 Description: There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1. Additional Analyst Notes: - CVE Program Container: References: - https://codecanyon.net/item/jobsearch-wp-job-board-wordpress-plugin/21066856 - https://wpscan.com/vulnerability/bcf38e87-011e-4540-8bfb-c93443a4a490
CVE ID: CVE-2022-1169 State: PUBLISHED Published: 2022-04-04T15:36:09 Last Updated: 2024-08-02T23:55:24.311Z Vendors: Unknown Products: Careerfy Problem Types: CWE-79 Description: There is a XSS vulnerability in Careerfy. Additional Analyst Notes: - CVE Program Container: References: - https://themeforest.net/item/careerfy-job-board-wordpress-theme/21137053 - https://wpscan.com/vulnerability/f3a1dcad-528a-4ecc-ac8e-728caa7c9878
CVE ID: CVE-2022-1170 State: PUBLISHED Published: 2022-04-04T15:36:11 Last Updated: 2024-08-02T23:55:24.223Z Vendors: Unknown Products: Noo JobMonster Problem Types: CWE-79 Description: In the Noo JobMonster WordPress theme before 4.5.2.9 JobMonster there is a XSS vulnerability as the input for the search form is provided through unsanitized GET requests. Additional Analyst Notes: - CVE Program Container: References: - https://themeforest.net/item/jobmonster-job-board-wordpress-theme/10965446 - https://wpscan.com/vulnerability/2ecb18e6-b575-4a20-bd31-94d24f1d1efc
CVE ID: CVE-2022-1171 State: PUBLISHED Published: 2022-05-09T16:50:47 Last Updated: 2024-08-02T23:55:24.446Z Vendors: Unknown Products: Vertical scroll recent post Problem Types: CWE-79 Description: The Vertical scroll recent post WordPress plugin before 14.0 does not sanitise and escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dc5eace4-542f-47e9-b870-a6aae6a38b0f
CVE ID: CVE-2022-1172 State: PUBLISHED Published: 2022-03-30T09:30:16 Last Updated: 2024-08-02T23:55:24.378Z Severity: MEDIUM (CVSS 5.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-476 Description: Null Pointer Dereference Caused Segmentation Fault in GitHub repository gpac/gpac prior to 2.1.0-DEV. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a26cb79c-9257-4fbf-98c5-a5a331efa264 - https://github.com/gpac/gpac/commit/55a183e6b8602369c04ea3836e05436a79fbc7f8
CVE ID: CVE-2022-1173 State: PUBLISHED Published: 2022-04-26T16:06:42 Last Updated: 2024-08-02T23:55:24.267Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:H) Vendors: getgrav Products: getgrav/grav Problem Types: CWE-79 Description: stored xss in GitHub repository getgrav/grav prior to 1.7.33. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b6016e95-9f48-4945-89cb-199b6e072218 - https://github.com/getgrav/grav/commit/1c0ed43afa5dc14169e6aa693b38e1a2f7aecad9
CVE ID: CVE-2022-1174 State: PUBLISHED Published: 2022-04-04T19:46:06 Last Updated: 2024-08-02T23:55:24.266Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A potential DoS vulnerability was discovered in Gitlab CE/EE versions 13.7 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to trigger high CPU usage via a special crafted input added in Issues, Merge requests, Milestones, Snippets, Wiki pages, etc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/
estones, Snippets, Wiki pages, etc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/338721 - https://hackerone.com/reports/1305431 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1174.json
CVE ID: CVE-2022-1175 State: PUBLISHED Published: 2022-04-04T19:46:15 Last Updated: 2024-08-02T23:55:24.361Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353370 - https
ional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353370 - https://hackerone.com/reports/1481207 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1175.json - http://packetstormsecurity.com/files/166829/Gitlab-14.9-Cross-Site-Scripting.html
CVE ID: CVE-2022-1176 State: PUBLISHED Published: 2022-03-31T10:10:10 Last Updated: 2024-08-02T23:55:24.377Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-843 Description: Loose comparison causes IDOR on multiple endpoints in GitHub repository livehelperchat/livehelperchat prior to 3.96. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3e30171b-c9bf-415c-82f1-6f55a44d09d3 - https://github.com/livehelperchat/livehelperchat/commit/72c0df160bfe9838c618652facef29af99392ce3
CVE ID: CVE-2022-1177 State: PUBLISHED Published: 2022-03-30T11:00:28 Last Updated: 2024-08-02T23:55:24.350Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: openemr Products: openemr/openemr Problem Types: CWE-1220 Description: Accounting User Can Download Patient Reports in openemr in GitHub repository openemr/openemr prior to 6.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0bb2979b-9643-4cdf-ab58-4354976b481b - https://github.com/openemr/openemr/commit/a2e918abcf15f9fc1f7cb4a1f2b09ff019021175
CVE ID: CVE-2022-1178 State: PUBLISHED Published: 2022-03-30T11:00:20 Last Updated: 2024-08-02T23:55:24.554Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: openemr Products: openemr/openemr Problem Types: CWE-79 Description: Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5813bd1f-b3aa-44f3-a5c0-aeeee2bf6fa4 - https://github.com/openemr/openemr/commit/347ad614507183035d188ba14427bc162419778c
CVE ID: CVE-2022-1179 State: PUBLISHED Published: 2022-03-30T11:05:28 Last Updated: 2024-08-02T23:55:24.358Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: openemr Products: openemr/openemr Problem Types: CWE-79 Description: Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/commit/347ad614507183035d188ba14427bc162419778c - https://huntr.dev/bounties/8025e31f-7dcf-4db9-ab07-06c1e055ab42
CVE ID: CVE-2022-1180 State: PUBLISHED Published: 2022-03-30T11:05:20 Last Updated: 2024-08-02T23:55:24.332Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: openemr Products: openemr/openemr Problem Types: CWE-79 Description: Reflected Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/openemr/openemr/commit/347ad614507183035d188ba14427bc162419778c - https://huntr.dev/bounties/0e281ea2-70f7-4ed7-8814-74502eff9dd5
CVE ID: CVE-2022-1181 State: PUBLISHED Published: 2022-03-30T11:05:13 Last Updated: 2024-08-02T23:55:24.217Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: openemr Products: openemr/openemr Problem Types: CWE-79 Description: Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2534e0fb-f503-4a4b-aed1-ec448c98bf60 - https://github.com/openemr/openemr/commit/2835cc397610fc28037302dad948c38fda032022
CVE ID: CVE-2022-1182 State: PUBLISHED Published: 2022-05-16T14:30:39 Last Updated: 2024-08-02T23:55:24.319Z Vendors: Unknown Products: Visual Slide Box Builder Problem Types: CWE-89 Description: The Visual Slide Box Builder WordPress plugin through 3.2.9 does not sanitise and escape various parameters before using them in SQL statements via some of its AJAX actions available to any authenticated users (such as subscriber), leading to SQL Injections Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/01d108bb-d134-4651-9c74-babcc88da177
CVE ID: CVE-2022-1183 State: PUBLISHED Published: 2022-05-19T09:55:09.565075Z Last Updated: 2024-09-17T04:00:26.575Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: In BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch, an assertion failure can be triggered if a TLS connection to a configured http TLS listener with a defined endpoint is destroyed too early. Description: On vulnerable configurations, the named daemon may, in some circumstances, terminate with an assertion failure. Vulnerable configurations are those that include a reference to http within the listen-on statements in their named.conf.
lnerable configurations are those that include a reference to http within the listen-on statements in their named.conf. TLS is used by both DNS over TLS (DoT) and DNS over HTTPS (DoH), but configurations using DoT alone are unaffected. Affects BIND 9.18.0 -> 9.18.2 and version 9.19.0 of the BIND 9.19 development branch. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2022-1183 - https://security.netapp.com/advisory/ntap-20220707-0002/
CVE ID: CVE-2022-1184 State: PUBLISHED Published: 2022-08-29T00:00:00 Last Updated: 2024-08-02T23:55:24.530Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2070205 - https://access.redhat.com/security/cve/CVE-2022-1184 - https://ubuntu.com/security/CVE-2022-1184 - https://www.debian.org/security/2022/dsa-5257 - https://lists.debian.org/debian-lts-announce/2022/11/msg
CVE-2022-1184 - https://www.debian.org/security/2022/dsa-5257 - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
CVE ID: CVE-2022-1185 State: PUBLISHED Published: 2022-04-04T19:46:09 Last Updated: 2024-08-02T23:55:24.257Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A denial of service vulnerability when rendering RDoc files in GitLab CE/EE versions 10 to 14.7.7, 14.8.0 to 14.8.5, and 14.9.0 to 14.9.2 allows an attacker to crash the GitLab web application with a maliciously crafted RDoc file Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/349148 - https://hackerone.com/reports/1415071 - https://gitlab.com/gitl
- https://gitlab.com/gitlab-org/gitlab/-/issues/349148 - https://hackerone.com/reports/1415071 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1185.json
CVE ID: CVE-2022-1186 State: PUBLISHED Published: 2022-04-19T20:26:38.000Z Last Updated: 2025-05-05T16:43:13.129Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: bepopiacompliant Products: Be POPIA Compliant Problem Types: CWE-200 Information Exposure Description: The WordPress plugin Be POPIA Compliant exposed sensitive information to unauthenticated users consisting of site visitors emails and usernames via an API route, in versions up to an including 1.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0fcdd6b5-a273-4916-a894-a753be0a7921?source=cve - htt
ences: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0fcdd6b5-a273-4916-a894-a753be0a7921?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2701343%40be-popia-compliant&new=2701343%40be-popia-compliant&sfp_email=&sfph_mail=
CVE ID: CVE-2022-1187 State: PUBLISHED Published: 2022-04-19T20:26:35.000Z Last Updated: 2025-05-05T16:43:01.344Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: macbookandrew Products: WP YouTube Live Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WordPress WP YouTube Live Plugin is vulnerable to Reflected Cross-Site Scripting via POST data found in the ~/inc/admin.php file which allows unauthenticated attackers to inject arbitrary web scripts in versions up to, and including, 1.7.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
nd including, 1.7.21. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2d540b53-5c39-43d5-a055-cc5eccfa65b8?source=cve - https://plugins.trac.wordpress.org/browser/wp-youtube-live/trunk/inc/admin.php#L355 - https://github.com/macbookandrew/wp-youtube-live/commit/2d8ccb7b12742bf16b5a6068f9fdeeac69bc11b1
CVE ID: CVE-2022-1188 State: PUBLISHED Published: 2022-04-04T19:46:05 Last Updated: 2024-08-02T23:55:24.446Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Server-side request forgery (ssrf) in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.1 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 where a blind SSRF attack through the repository mirroring feature was possible. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/354059 - https://hackerone.c
Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/354059 - https://hackerone.com/reports/1486659 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1188.json
CVE ID: CVE-2022-1189 State: PUBLISHED Published: 2022-04-04T19:46:00 Last Updated: 2024-08-02T23:55:24.233Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.2 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 that allowed for an unauthorised user to read the the approval rules of a private project. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353718 - https://gitlab.com/gi
tes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353718 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1189.json
CVE ID: CVE-2022-1190 State: PUBLISHED Published: 2022-04-04T19:46:15 Last Updated: 2024-08-02T23:55:24.448Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/352
etc. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/352392 - https://hackerone.com/reports/1455036 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1190.json
CVE ID: CVE-2022-1191 State: PUBLISHED Published: 2022-03-31T08:35:09 Last Updated: 2024-08-02T23:55:24.613Z Severity: HIGH (CVSS 8.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-918 Description: SSRF on index.php/cobrowse/proxycss/ in GitHub repository livehelperchat/livehelperchat prior to 3.96. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7264a2e1-17e7-4244-93e4-49ec14f282b3 - https://github.com/livehelperchat/livehelperchat/commit/c41f283a2c1b46c42dd2af16ecbeaedd2fe1f5df
CVE ID: CVE-2022-1192 State: PUBLISHED Published: 2022-05-23T07:15:26 Last Updated: 2024-08-02T23:55:24.236Z Vendors: Unknown Products: Turn off all comments Problem Types: CWE-79 Description: The Turn off all comments WordPress plugin through 1.0 does not sanitise and escape the rows parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/18660c71-5a89-4ef6-b0dd-7a166e3449d6
CVE ID: CVE-2022-1193 State: PUBLISHED Published: 2022-04-11T19:38:25 Last Updated: 2024-08-02T23:55:24.436Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: Improper access control in GitLab CE/EE versions 10.7 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows a malicious actor to obtain details of the latest commit in a private project via Merge Requests under certain circumstances Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/351823 - https://hackerone.com/reports/1465994 - https://gitla
ferences: - https://gitlab.com/gitlab-org/gitlab/-/issues/351823 - https://hackerone.com/reports/1465994 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1193.json
CVE ID: CVE-2022-1194 State: PUBLISHED Published: 2022-09-16T08:40:25 Last Updated: 2024-08-02T23:55:24.226Z Vendors: Unknown Products: Mobile Events Manager Problem Types: CWE-1236 Description: The Mobile Events Manager WordPress plugin before 1.4.8 does not properly escape the Enquiry source field when exporting events, or the Paid for field when exporting transactions as CSV, leading to a CSV injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/62be0991-f095-43cf-a167-3daaed254594
CVE ID: CVE-2022-1195 State: PUBLISHED Published: 2022-04-29T15:40:58 Last Updated: 2024-08-02T23:55:24.439Z Vendors: n/a Products: kernel Problem Types: CWE-362 Description: A use-after-free vulnerability was found in the Linux kernel in drivers/net/hamradio. This flaw allows a local attacker with a user privilege to cause a denial of service (DOS) when the mkiss or sixpack device is detached and reclaim resources early. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2056381 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 - https://git.kernel.org/pub/scm/lin