Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-38444 State: PUBLISHED Published: 2022-10-14T19:50:50.640Z Last Updated: 2025-04-23T16:46:07.128Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Dimension Problem Types: CWE-416 Description: Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb22-57.html
CVE ID: CVE-2022-38445 State: PUBLISHED Published: 2022-10-14T19:50:49.388Z Last Updated: 2025-04-23T16:46:36.240Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Dimension Problem Types: CWE-416 Description: Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb22-57.html
CVE ID: CVE-2022-38446 State: PUBLISHED Published: 2022-10-14T19:50:50.336Z Last Updated: 2025-04-23T16:46:15.451Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Dimension Problem Types: CWE-416 Description: Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb22-57.html
CVE ID: CVE-2022-38447 State: PUBLISHED Published: 2022-10-14T19:50:49.098Z Last Updated: 2025-04-23T16:46:44.160Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Dimension Problem Types: CWE-416 Description: Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb22-57.html
CVE ID: CVE-2022-38448 State: PUBLISHED Published: 2022-10-14T19:50:50.881Z Last Updated: 2025-04-23T16:46:00.772Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Dimension Problem Types: CWE-416 Description: Adobe Dimension versions 3.4.5 is affected by a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/dimension/apsb22-57.html
CVE ID: CVE-2022-38449 State: PUBLISHED Published: 2022-10-14T19:45:29.621Z Last Updated: 2025-04-23T16:47:31.205Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-125 Description: Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
teraction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb22-46.html
CVE ID: CVE-2022-38450 State: PUBLISHED Published: 2022-10-14T19:45:28.615Z Last Updated: 2025-04-23T16:48:02.283Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Adobe Products: Acrobat Reader Problem Types: CWE-121 Description: Adobe Acrobat Reader versions 22.002.20212 (and earlier) and 20.005.30381 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.
ous file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://helpx.adobe.com/security/products/acrobat/apsb22-46.html
CVE ID: CVE-2022-38451 State: PUBLISHED Published: 2023-01-30T10:11:51.438Z Last Updated: 2024-08-03T10:54:03.887Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N) Vendors: FreshTomato, Siretta Products: FreshTomato, QUARTZ-GOLD Problem Types: CWE-22 Description: A directory traversal vulnerability exists in the httpd update.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP request can lead to arbitrary file read. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1642
CVE ID: CVE-2022-38452 State: PUBLISHED Published: 2023-03-21T17:41:26.484Z Last Updated: 2025-02-26T16:38:11.731Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Netgear Products: Orbi Router RBR750 Problem Types: CWE-912 Description: A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a network request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1595 - ht
ntainer: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1595 - https://kb.netgear.com/000065567/Security-Advisory-for-Post-authentication-Command-Injection-on-the-RBR750-PSV-2022-0186
CVE ID: CVE-2022-38453 State: PUBLISHED Published: 2022-09-13T14:55:03.842Z Last Updated: 2025-04-16T16:09:53.917Z Severity: LOW (CVSS 3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: Contec Health Products: CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor Problem Types: CWE-489 Description: Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/us
ities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01
CVE ID: CVE-2022-38454 State: PUBLISHED Published: 2022-09-23T18:36:52.373Z Last Updated: 2025-02-20T20:00:32.249Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Karim Salman Products: Kraken.io Image Optimizer (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Kraken.io Image Optimizer plugin <= 2.6.5 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/kraken-image-optimizer/wordpress-kraken-io-image-optimizer-plugin-2-6-5-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/plug
ken-io-image-optimizer-plugin-2-6-5-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/plugins/kraken-image-optimizer/
CVE ID: CVE-2022-38456 State: PUBLISHED Published: 2023-03-15T14:46:17.239Z Last Updated: 2025-01-13T15:51:37.973Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Ernest Marcinko Products: Ajax Search Lite Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin <= 4.10.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ajax-search-lite/wordpress-ajax-search-lite-plugin-4-10-3-auth-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2022-38457 State: PUBLISHED Published: 2022-09-09T14:39:51.323409Z Last Updated: 2024-09-17T02:11:30.468Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:H) Vendors: Linux Products: kernel Problem Types: CWE-416 Description: A use-after-free(UAF) vulnerability was found in function 'vmw_cmd_res_check' in drivers/gpu/vmxgfx/vmxgfx_execbuf.c in Linux kernel's vmwgfx driver with device file '/dev/dri/renderD128 (or Dxxx)'. This flaw allows a local attacker with a user account on the system to gain privilege, causing a denial of service(DoS). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.openanolis.cn/show_bug.cgi?id=2074
CVE ID: CVE-2022-38458 State: PUBLISHED Published: 2023-03-21T17:41:25.364Z Last Updated: 2025-02-26T16:16:18.651Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Netgear Products: Orbi Router RBR750 Problem Types: CWE-311 Description: A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted man-in-the-middle attack can lead to a disclosure of sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1598 - https://kb.netgear.com/000065428/Security-Advisory
https://talosintelligence.com/vulnerability_reports/TALOS-2022-1598 - https://kb.netgear.com/000065428/Security-Advisory-for-Cleartext-Transmission-on-Some-Orbi-WiFi-Systems-PSV-2022-0189
CVE ID: CVE-2022-38459 State: PUBLISHED Published: 2023-01-26T21:24:49.618Z Last Updated: 2025-03-05T19:27:51.721Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Siretta Products: QUARTZ-GOLD Problem Types: CWE-120 Description: A stack-based buffer overflow vulnerability exists in the httpd downfile.cgi functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted HTTP request can lead to remote code execution. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1608
CVE ID: CVE-2022-38460 State: PUBLISHED Published: 2022-09-23T14:27:01.602Z Last Updated: 2025-02-20T20:03:22.368Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Jitendriya Tripathy Products: NOTICE BOARD (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in NOTICE BOARD plugin <= 1.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/notice-board/wordpress-notice-board-plugin-1-1-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpress.org/plugins/
-board-plugin-1-1-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpress.org/plugins/notice-board/
CVE ID: CVE-2022-38461 State: PUBLISHED Published: 2022-11-17T21:59:46.503Z Last Updated: 2025-02-20T19:54:15.806Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: OnTheGoSystems Ltd. Products: WPML Multilingual CMS (WordPress plugin) Problem Types: CWE-264 Description: Broken Access Control vulnerability in WPML Multilingual CMS premium plugin <= 4.5.10 on WordPress allows users with a subscriber or higher user role to change plugin settings (selected language for legacy widgets, the default behavior for media content). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/site
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sitepress-multilingual-cms/wordpress-wpml-multilingual-cms-plugin-4-5-10-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2022-38462 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T04:37:07.448Z Vendors: n/a Products: n/a Problem Types: n/a Description: Silverstripe silverstripe/framework through 4.11 is vulnerable to XSS by carefully crafting a return URL on a /dev/build or /Security/login request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.silverstripe.org/download/security-releases/ - https://www.silverstripe.org/blog/tag/release - https://forum.silverstripe.org/c/releases
CVE ID: CVE-2022-38463 State: PUBLISHED Published: 2022-08-23T18:07:57 Last Updated: 2024-08-03T10:54:03.697Z Vendors: n/a Products: n/a Problem Types: n/a Description: ServiceNow through San Diego Patch 4b and Patch 6 allows reflected XSS in the logout functionality. Additional Analyst Notes: - CVE Program Container: References: - https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1156793
CVE ID: CVE-2022-38465 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-04-21T13:48:21.222Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC Drive Controller family, SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants), SIMATIC S7-1200 CPU family (incl. SIPLUS variants), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-1500 Software Controller, SIMATIC S7-PLCSIM Advanced, SINUMERIK MC, SINUMERIK ONE Problem Types: CWE-522 Description: A vulnerability has been identified
S7-PLCSIM Advanced, SINUMERIK MC, SINUMERIK ONE Problem Types: CWE-522 Description: A vulnerability has been identified in SIMATIC Drive Controller family (All versions < V2.9.2), SIMATIC ET 200SP Open Controller CPU 1515SP PC (incl. SIPLUS variants) (All versions), SIMATIC ET 200SP Open Controller CPU 1515SP PC2 (incl. SIPLUS variants) (All versions < V21.9), SIMATIC S7-1200 CPU family (incl. SIPLUS variants) (All versions < V4.5.0), SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants) (All versions < V2.9.2), SIMATIC S7-1500 Software Controller (All versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions < V6.21), SINUMERIK ONE
versions < V21.9), SIMATIC S7-PLCSIM Advanced (All versions < V4.0), SINUMERIK MC (All versions < V6.21), SINUMERIK ONE (All versions < V6.21). Affected products protect the built-in global private key in a way that cannot be considered sufficient any longer. The key is used for the legacy protection of confidential configuration data and the legacy PG/PC and HMI communication. This could allow attackers to discover the private key of a CPU product family by an offline attack against a single CPU of the family. Attackers could then use this knowledge to extract confidential configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI comm
configuration data from projects that are protected by that key or to perform attacks against legacy PG/PC and HMI communication. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-568427.pdf - https://cert-portal.siemens.com/productcert/pdf/ssa-568428.pdf
CVE ID: CVE-2022-38466 State: PUBLISHED Published: 2022-09-13T09:40:53 Last Updated: 2024-08-03T10:54:03.668Z Vendors: Siemens Products: CoreShield One-Way Gateway (OWG) Software Problem Types: CWE-284 Description: A vulnerability has been identified in CoreShield One-Way Gateway (OWG) Software (All versions < V2.2). The default installation sets insecure file permissions that could allow a local attacker to escalate privileges to local administrator. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-589975.pdf
CVE ID: CVE-2022-38467 State: PUBLISHED Published: 2023-01-14T10:14:12.393Z Last Updated: 2025-02-19T21:41:09.727Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: CRM Perks Products: CRM Perks Forms – WordPress Form Builder Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in CRM Perks Forms – WordPress Form Builder <= 1.1.0 ver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/crm-perks-forms/wordpress-crm-perks-forms-plugin-1-1-0-reflected-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-38468 State: PUBLISHED Published: 2023-03-01T13:02:01.753Z Last Updated: 2025-01-13T15:55:08.628Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Imagely Products: WordPress Gallery Plugin – NextGEN Gallery Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/nextgen-gallery/wordpress-wordpress-gallery-plugin-nextgen-gallery-plugin-3-28-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-38469 State: PUBLISHED Published: 2023-01-17T23:50:53.642Z Last Updated: 2025-01-16T22:00:41.329Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: GE Digital Products: Proficy Historian Problem Types: CWE-261 Description: An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-017-01 - https://digitalsupport.ge.com/s/article/GE-Digital-Product-Security-Advisory-GED-23-01
CVE ID: CVE-2022-38470 State: PUBLISHED Published: 2022-09-23T15:08:22.696Z Last Updated: 2025-02-20T20:01:35.709Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CusRev Products: Customer Reviews for WooCommerce (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Customer Reviews for WooCommerce plugin <= 5.3.5 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/customer-reviews-woocommerce/#developers - https://patchstack.com/database/vulnerability/customer-reviews-woocommerce/wordpress-customer-reviews-for-woocommerce-plu
ttps://patchstack.com/database/vulnerability/customer-reviews-woocommerce/wordpress-customer-reviews-for-woocommerce-plugin-5-3-5-cross-site-request-forgery-csrf-vulnerability/_s_id=cve
CVE ID: CVE-2022-38472 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T16:50:13.366Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Address bar spoofing via XSLT error handling Description: An attacker could have abused XSLT error handling to associate attacker-controlled content with another origin which was displayed in the address bar. This could have been used to fool the user into submitting data intended for the spoofed origin. This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichmen
91.13, Firefox ESR < 102.2, and Firefox < 104. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-35/ - https://www.mozilla.org/security/advisories/mfsa2022-33/ - https://www.mozilla.org/security/advisories/mfsa2022-37/ - https://www.mozilla.org/security/advisories/mfsa2022-36/ - https://www.mozilla.org/security/advisories/mfsa2022-34/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1769155
CVE ID: CVE-2022-38473 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T16:14:05.031Z Vendors: Mozilla Products: Thunderbird, Firefox ESR, Firefox Problem Types: Cross-origin XSLT Documents would have inherited the parent's permissions Description: A cross-origin iframe referencing an XSLT document would inherit the parent domain's permissions (such as microphone or camera access). This vulnerability affects Thunderbird < 102.2, Thunderbird < 91.13, Firefox ESR < 91.13, Firefox ESR < 102.2, and Firefox < 104. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-35/ - https:/
ram Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-35/ - https://www.mozilla.org/security/advisories/mfsa2022-33/ - https://www.mozilla.org/security/advisories/mfsa2022-37/ - https://www.mozilla.org/security/advisories/mfsa2022-36/ - https://www.mozilla.org/security/advisories/mfsa2022-34/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1771685
CVE ID: CVE-2022-38474 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T16:12:19.063Z Vendors: Mozilla Products: Firefox Problem Types: Recording notification not shown when microphone was recording on Android Description: A website that had permission to access the microphone could record audio without the audio notification being shown. This bug does not allow the attacker to bypass the permission prompt - it only affects the notification shown once permission has been granted.<br />*This bug only affects Firefox for Android. Other operating systems are unaffected.*. This vulnerability affects Firefox < 104. Additional Analyst Notes: - CVE Program Container: -
ystems are unaffected.*. This vulnerability affects Firefox < 104. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-33/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1719511
CVE ID: CVE-2022-38475 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T17:26:11.301Z Vendors: Mozilla Products: Firefox Problem Types: Attacker could write a value to a zero-length array Description: An attacker could have written a value to the first element in a zero-length JavaScript array. Although the array was zero-length, the value was not written to an invalid memory address. This vulnerability affects Firefox < 104. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-33/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1773266