Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2853 State: PUBLISHED Published: 2022-09-26T00:00:00.000Z Last Updated: 2025-05-22T14:27:58.069Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in Downloads in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html - https://crbug.com/1350097 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapr
op_16.html - https://crbug.com/1350097 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/ - http://packetstormsecurity.com/files/169459/Chrome-offline_items_collection-OfflineContentAggregator-OnItemRemoved-Heap-Buffer-Overflow.html
CVE ID: CVE-2022-2854 State: PUBLISHED Published: 2022-09-26T15:01:11.000Z Last Updated: 2025-05-22T13:57:22.582Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in SwiftShader in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html - https://crbug.com/1337538 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2855 State: PUBLISHED Published: 2022-09-26T15:01:12.000Z Last Updated: 2025-05-22T13:55:06.925Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in ANGLE in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html - https://crbug.com/1345042 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2856 State: PUBLISHED Published: 2022-09-26T15:01:12.000Z Last Updated: 2025-10-21T23:15:34.379Z Vendors: Google Products: Chrome Problem Types: Insufficient validation of untrusted input Description: Insufficient validation of untrusted input in Intents in Google Chrome on Android prior to 104.0.5112.101 allowed a remote attacker to arbitrarily browse to a malicious website via a crafted HTML page. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html - https://crbug.com/1345630 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.f
r-desktop_16.html - https://crbug.com/1345630 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2857 State: PUBLISHED Published: 2022-09-26T15:01:13.000Z Last Updated: 2025-05-22T13:51:49.485Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Blink in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html - https://crbug.com/1338135 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2858 State: PUBLISHED Published: 2022-09-26T15:01:14.000Z Last Updated: 2025-05-21T19:12:12.706Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Sign-In Flow in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to potentially exploit heap corruption via specific UI interaction. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html - https://crbug.com/1341918 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2859 State: PUBLISHED Published: 2022-09-26T15:01:15.000Z Last Updated: 2025-05-21T19:11:26.194Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Chrome OS Shell in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific UI interactions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html - https://crbug.com/1338412 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fe
-desktop_16.html - https://crbug.com/1338412 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2860 State: PUBLISHED Published: 2022-09-26T15:01:16.000Z Last Updated: 2025-05-21T19:10:29.991Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in Cookies in Google Chrome prior to 104.0.5112.101 allowed a remote attacker to bypass cookie prefix restrictions via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html - https://crbug.com/1345193 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD
5193 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2861 State: PUBLISHED Published: 2022-09-26T15:01:17.000Z Last Updated: 2025-05-21T19:09:28.492Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Extensions API in Google Chrome prior to 104.0.5112.101 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts into WebUI via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_16.html - https://crbug.com/1346236 - https://lists.fedoraproject.org/archives/list/package-announce
-update-for-desktop_16.html - https://crbug.com/1346236 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-2862 State: PUBLISHED Published: 2022-08-17T00:00:00 Last Updated: 2024-08-03T00:52:59.949Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.0221. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/71180988-1ab6-4311-bca8-e9a879b06765 - https://github.com/vim/vim/commit/1889f499a4f248cd84e0e0bf6d0d820016774494 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWOJOA7PZZAMBI5GFTL6PWHXMWSDLUXL/ - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2863 State: PUBLISHED Published: 2022-09-16T00:00:00 Last Updated: 2024-08-03T00:52:58.992Z Vendors: Unknown Products: Migration, Backup, Staging – WPvivid Problem Types: CWE-22 Description: The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cb6a3304-2166-47a0-a011-4dcacaa133e5 - http://seclists.org/fulldisclosure/2022/Oct/0 - http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Bac
33e5 - http://seclists.org/fulldisclosure/2022/Oct/0 - http://packetstormsecurity.com/files/168616/WordPress-WPvivid-Backup-Path-Traversal.html
CVE ID: CVE-2022-2864 State: PUBLISHED Published: 2022-10-28T16:52:09.076Z Last Updated: 2025-01-31T18:49:38.968Z Severity: HIGH (CVSS 8.8 CVSS:3.1/A:H/I:H/C:H/S:U/UI:R/PR:N/AC:L/AV:N) Vendors: demonisblack Products: demon image annotation Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The demon image annotation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.7. This is due to missing nonce validation in the ~/includes/settings.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator
the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/demon-image-annotation/trunk/includes/settings.php - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2772352%40demon-image-annotation&new=2772352%40demon-image-annotation&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2864
CVE ID: CVE-2022-2865 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T13:57:18.072Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions before 15.1.6, 15.2 to 15.2.4 and 15.3 prior to 15.3.2. It was possible to exploit a vulnerability in setting the labels colour feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. Additional An
d to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/370873 - https://hackerone.com/reports/1665658 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2865.json
CVE ID: CVE-2022-2866 State: PUBLISHED Published: 2022-08-31T15:59:34.000Z Last Updated: 2025-04-16T17:48:54.531Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: FvDesigner Problem Types: CWE-787 Description: FATEK FvDesigner version 1.5.103 and prior is vulnerable to an out-of-bounds write while processing project files. If a valid user is tricked into using maliciously crafted project files, an attacker could achieve arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-237-01
CVE ID: CVE-2022-2867 State: PUBLISHED Published: 2022-08-17T00:00:00 Last Updated: 2024-08-03T00:52:59.602Z Vendors: n/a Products: libtiff Problem Types: CWE-191 Description: libtiff's tiffcrop utility has a uint32_t underflow that can lead to out of bounds read and write. An attacker who supplies a crafted file to tiffcrop (likely via tricking a user to run tiffcrop on it with certain parameters) could cause a crash or in some cases, further exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2118847 - https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-2868 State: PUBLISHED Published: 2022-08-17T00:00:00 Last Updated: 2024-08-03T00:52:59.323Z Vendors: n/a Products: libtiff Problem Types: CWE-20 Description: libtiff's tiffcrop utility has a improper input validation flaw that can lead to out of bounds read and ultimately cause a crash if an attacker is able to supply a crafted file to tiffcrop. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2118863 - https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-2869 State: PUBLISHED Published: 2022-08-17T00:00:00 Last Updated: 2024-08-03T00:52:59.054Z Vendors: n/a Products: libtiff Problem Types: CWE-191 Description: libtiff's tiffcrop tool has a uint32_t underflow which leads to out of bounds read and write in the extractContigSamples8bits routine. An attacker who supplies a crafted file to tiffcrop could trigger this flaw, most likely by tricking a user into opening the crafted file with tiffcrop. Triggering this flaw could cause a crash or potentially further exploitation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2118869 - https://lists.debian.org/debian-lts-ann
m Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2118869 - https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-2870 State: PUBLISHED Published: 2022-08-17T18:45:14.000Z Last Updated: 2025-04-15T13:49:24.534Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: laravel Problem Types: CWE-502 Description: A vulnerability was found in laravel 5.1 and classified as problematic. This issue affects some unknown processing. The manipulation leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206501 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/beicheng
y. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/beicheng-maker/vulns/issues/2 - https://vuldb.com/?id.206501
CVE ID: CVE-2022-2871 State: PUBLISHED Published: 2022-08-17T09:00:17 Last Updated: 2024-08-03T00:52:59.647Z Severity: MEDIUM (CVSS 4.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: notrinos Products: notrinos/notrinoserp Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository notrinos/notrinoserp prior to 0.7. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/61126c07-22ac-4961-a198-1aa33060b373 - https://github.com/notrinos/notrinoserp/commit/0362778f4f678156c22a009094225823df8a4760
CVE ID: CVE-2022-2872 State: PUBLISHED Published: 2022-09-21T09:55:08.000Z Last Updated: 2025-05-28T15:26:59.092Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: octoprint Products: octoprint/octoprint Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository octoprint/octoprint prior to 1.8.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b966c74d-6f3f-49fe-b40a-eaf25e362c56 - https://github.com/octoprint/octoprint/commit/3e3c11811e216fb371a33e28412df83f9701e5b0
CVE ID: CVE-2022-2873 State: PUBLISHED Published: 2022-08-22T00:00:00 Last Updated: 2024-08-03T00:52:59.620Z Vendors: n/a Products: Kernel Problem Types: CWE-131 Description: An out-of-bounds memory access flaw was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way a user triggers the I2C_SMBUS_BLOCK_DATA (with the ioctl I2C_SMBUS) with malicious input data. This flaw allows a local user to crash the system. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/lkml/20220729093451.551672-1-zheyuma97%40gmail.com/T/ - https://security.netapp.com/advisory/ntap-20230120-0001/ - https://www.debian.org/security/2023/dsa-5324 - https://
T/ - https://security.netapp.com/advisory/ntap-20230120-0001/ - https://www.debian.org/security/2023/dsa-5324 - https://lists.debian.org/debian-lts-announce/2023/03/msg00000.html - https://lists.debian.org/debian-lts-announce/2023/05/msg00006.html
CVE ID: CVE-2022-2874 State: PUBLISHED Published: 2022-08-18T00:00:00 Last Updated: 2024-08-03T00:52:59.351Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0224. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/95f97dfe-247d-475d-9740-b7adc71f4c79 - https://github.com/vim/vim/commit/4875d6ab068f09df88d24d81de40dcd8d56e243d - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2876 State: PUBLISHED Published: 2022-08-18T07:30:14.000Z Last Updated: 2025-04-15T13:49:13.855Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Student Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Student Management System. Affected is an unknown function of the file index.php. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-206634 is the identifier assigned to this vulnerability. Additional Analyst Notes: -
to the public and may be used. VDB-206634 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/beicheng-maker/vulns/issues/4 - https://vuldb.com/?id.206634
CVE ID: CVE-2022-2877 State: PUBLISHED Published: 2022-09-16T08:40:37 Last Updated: 2024-08-03T00:52:59.794Z Vendors: Unknown Products: Titan Anti-spam & Security Problem Types: CWE-639 Description: The Titan Anti-spam & Security WordPress plugin before 7.3.1 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f1af4267-3a43-4b88-a8b9-c1d5b2aa9d68
CVE ID: CVE-2022-2879 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-02-13T16:32:38.510Z Vendors: Go standard library Products: archive/tar Problem Types: CWE 400: Uncontrolled Resource Consumption Description: Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of header blocks to 1 MiB. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/issue/54853 - https://go.dev/cl/439355 - https://groups.google.com/g/golang-announce/c/xtuG5faxtaU -
: - https://go.dev/issue/54853 - https://go.dev/cl/439355 - https://groups.google.com/g/golang-announce/c/xtuG5faxtaU - https://pkg.go.dev/vuln/GO-2022-1037 - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2022-2880 State: PUBLISHED Published: 2022-10-14T00:00:00.000Z Last Updated: 2025-02-13T16:32:39.111Z Vendors: Go standard library Products: net/http/httputil Problem Types: CWE-444: Inconsistent Interpretation of HTTP Requests Description: Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that t
query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/issue/54663 - https://go.dev/cl/432976 - https://groups.google.com/g/golang-announce/c/xtuG5faxtaU - https://pkg.go.dev/vuln/GO-2022-1038 - https://security.gentoo.org/glsa/202311-09
CVE ID: CVE-2022-2881 State: PUBLISHED Published: 2022-09-21T10:15:26.604Z Last Updated: 2025-05-28T15:26:32.410Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: In BIND 9.18.0 -> 9.18.6 and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, when an HTTP connection was reused to request statistics from the stats channel, the content length of successive responses could grow in size past the end of the allocated buffer. Description: The underlying bug might cause read past end of the buffer and either read memory it should not read, or crash the process. Additional Analyst Notes: - CVE Program Container: - CISA A
either read memory it should not read, or crash the process. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.isc.org/docs/cve-2022-2881 - http://www.openwall.com/lists/oss-security/2022/09/21/3 - https://security.gentoo.org/glsa/202210-25
CVE ID: CVE-2022-2882 State: PUBLISHED Published: 2022-10-28T00:00:00.000Z Last Updated: 2025-05-07T15:09:31.479Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.6 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. A malicious maintainer could exfiltrate a GitHub integration's access token by modifying the integration URL such that authenticated requests are sent to an attacker controlled server. Additional Analyst Notes: - CVE Program
URL such that authenticated requests are sent to an attacker controlled server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/371082 - https://hackerone.com/reports/1656722 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2882.json
CVE ID: CVE-2022-2883 State: PUBLISHED Published: 2023-02-22T00:00:00.000Z Last Updated: 2025-03-11T19:16:07.324Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Zipbomb resource exhaustion Description: In affected versions of Octopus Deploy it is possible to upload a zipbomb file as a task which results in Denial of Service Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2023/sa2023-02/
CVE ID: CVE-2022-2884 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T14:24:19.300Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of special elements used in an os command ('os command injection') in GitLab Description: A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/g