Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0597 State: PUBLISHED Published: 2022-02-15T13:50:10 Last Updated: 2024-08-02T23:32:46.413Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: microweber Products: microweber/microweber Problem Types: CWE-601 Description: Open Redirect in Packagist microweber/microweber prior to 1.2.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/68c22eab-cc69-4e9f-bcb6-2df3db626813 - https://github.com/microweber/microweber/commit/acfc6a581d1ea86096d1b0ecd8a0eec927c0e9b2
CVE ID: CVE-2022-0598 State: PUBLISHED Published: 2022-08-01T12:47:18 Last Updated: 2024-08-02T23:32:46.432Z Vendors: Unknown Products: Login with phone number Problem Types: CWE-79 Description: The Login with phone number WordPress plugin before 1.3.8 does not sanitise and escape plugin settings which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4688d39e-ac9b-47f5-a4c1-f9548b63c68c
CVE ID: CVE-2022-0599 State: PUBLISHED Published: 2022-03-28T17:22:59 Last Updated: 2024-08-02T23:32:46.492Z Vendors: Unknown Products: Mapping multiple URLs redirect same page Problem Types: CWE-79 Description: The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4f1d45bc-d3bd-472c-959d-05abeff32765
CVE ID: CVE-2022-0600 State: PUBLISHED Published: 2022-03-28T17:23:01 Last Updated: 2024-08-02T23:32:46.454Z Vendors: Unknown Products: Conference Scheduler Problem Types: CWE-79 Description: The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5dd6f625-6738-4e6a-81dc-21c0add4368d
CVE ID: CVE-2022-0601 State: PUBLISHED Published: 2022-03-14T14:41:38 Last Updated: 2024-08-02T23:32:46.451Z Vendors: Unknown Products: Countdown, Coming Soon, Maintenance – Countdown & Clock Problem Types: CWE-79 Description: The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6ec62eae-2072-4098-8f77-b22d61a89cbf - https://plugins.trac.wordpress.org/changeset/2679245
CVE ID: CVE-2022-0602 State: PUBLISHED Published: 2022-04-05T15:55:10 Last Updated: 2024-08-02T23:32:46.537Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: tastyigniter Products: tastyigniter/tastyigniter Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository tastyigniter/tastyigniter prior to 3.3.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/615f1788-d474-4580-b0ef-5edd50274010 - https://github.com/tastyigniter/tastyigniter/commit/992d4ce6444805c3132e3635a01b6fd222063554
CVE ID: CVE-2022-0603 State: PUBLISHED Published: 2022-04-04T23:55:22 Last Updated: 2024-08-02T23:32:46.499Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in File Manager in Google Chrome on Chrome OS prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1290008 - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
CVE ID: CVE-2022-0604 State: PUBLISHED Published: 2022-04-04T23:55:24 Last Updated: 2024-08-02T23:32:46.463Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in Tab Groups in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html - https://crbug.com/1273397
CVE ID: CVE-2022-0605 State: PUBLISHED Published: 2022-04-04T23:55:25 Last Updated: 2024-08-02T23:32:46.538Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Webstore API in Google Chrome prior to 98.0.4758.102 allowed an attacker who convinced a user to install a malicious extension and convinced a user to enage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html - https://crbug.com/1286940
CVE ID: CVE-2022-0606 State: PUBLISHED Published: 2022-04-04T23:55:27 Last Updated: 2024-08-02T23:32:46.412Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in ANGLE in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html - https://crbug.com/1288020
CVE ID: CVE-2022-0607 State: PUBLISHED Published: 2022-04-04T23:55:28 Last Updated: 2024-08-02T23:32:46.445Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in GPU in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html - https://crbug.com/1250655
CVE ID: CVE-2022-0608 State: PUBLISHED Published: 2022-04-04T23:55:30 Last Updated: 2024-08-02T23:32:46.461Z Vendors: Google Products: Chrome Problem Types: Integer overflow Description: Integer overflow in Mojo in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html - https://crbug.com/1270333
CVE ID: CVE-2022-0609 State: PUBLISHED Published: 2022-04-04T23:55:32.000Z Last Updated: 2025-10-21T23:15:42.637Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html - https://crbug.com/1296150
CVE ID: CVE-2022-0610 State: PUBLISHED Published: 2022-04-04T23:55:33 Last Updated: 2024-08-02T23:32:46.433Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html - https://crbug.com/1285449
CVE ID: CVE-2022-0611 State: PUBLISHED Published: 2022-02-15T23:30:11 Last Updated: 2024-08-02T23:32:46.440Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-862 Description: Missing Authorization in Packagist snipe/snipe-it prior to 5.3.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7b7447fc-f1b0-446c-b016-ee3f6511010b - https://github.com/snipe/snipe-it/commit/321be4733d3997fc738f0118e1b9af5905f95439
CVE ID: CVE-2022-0612 State: PUBLISHED Published: 2022-02-16T05:40:09 Last Updated: 2024-08-02T23:32:46.545Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in Packagist remdex/livehelperchat prior to 3.93v. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/eadcf7d2-a479-4901-abcc-1505d3f1b32f - https://github.com/livehelperchat/livehelperchat/commit/4d4f1db1701f09177896a38e43fd0c693835f03b
CVE ID: CVE-2022-0613 State: PUBLISHED Published: 2022-02-16T08:40:09 Last Updated: 2024-08-02T23:32:46.462Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: medialize Products: medialize/uri.js Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key in NPM urijs prior to 1.19.8. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f53d5c42-c108-40b8-917d-9dad51535083 - https://github.com/medialize/uri.js/commit/6ea641cc8648b025ed5f30b090c2abd4d1a5249f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MXSSATHALUSXXD2KT6UFZAX7EG4GR332/
CVE ID: CVE-2022-0614 State: PUBLISHED Published: 2022-02-16T09:40:10 Last Updated: 2024-08-02T23:32:46.442Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset in Homebrew mruby prior to 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a980ce4d-c359-4425-92c4-e844c0055879 - https://github.com/mruby/mruby/commit/ff3a5ebed6ffbe3e70481531cfb969b497aa73ad
CVE ID: CVE-2022-0615 State: PUBLISHED Published: 2022-02-25T18:10:52.569572Z Last Updated: 2024-09-16T17:37:36.148Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ESET, spol. s r.o. Products: Endpoint Antivirus for Linux, ESET Server Security for Linux Problem Types: CWE-416 Description: Use-after-free in eset_rtp kernel module used in ESET products for Linux allows potential attacker to trigger denial-of-service condition on the system. Additional Analyst Notes: - CVE Program Container: References: - https://support.eset.com/en/ca8230
CVE ID: CVE-2022-0616 State: PUBLISHED Published: 2022-03-21T18:55:50 Last Updated: 2024-08-02T23:32:46.481Z Vendors: Unknown Products: Amelia – Events & Appointments Booking Calendar Problem Types: CWE-352 Description: The Amelia WordPress plugin before 1.0.47 does not have CSRF check in place when deleting customers, which could allow attackers to make a logged in admin delete arbitrary customers via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7c63d76e-34ca-4778-8784-437d446c16e0
CVE ID: CVE-2022-0617 State: PUBLISHED Published: 2022-02-16T16:38:03 Last Updated: 2024-08-02T23:32:46.477Z Vendors: n/a Products: Kernel Problem Types: CWE-476 Description: A flaw null pointer dereference in the Linux kernel UDF file system functionality was found in the way user triggers udf_file_write_iter function for the malicious UDF image. A local user could use this flaw to crash the system. Actual from Linux kernel 4.2-rc1 till 5.17-rc2. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7fc3b7c2981bbd1047916ade327beccb90994eee - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux
git/commit/?id=7fc3b7c2981bbd1047916ade327beccb90994eee - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ea8569194b43f0f01f0a84c689388542c7254a1f - https://lore.kernel.org/lkml/20220114172329.ygzry5rlz64ua2nr%40quack3.lan/T/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00011.html - https://lists.debian.org/debian-lts-announce/2022/03/msg00012.html - https://www.debian.org/security/2022/dsa-5095 - https://www.debian.org/security/2022/dsa-5096 - http://www.openwall.com/lists/oss-security/2022/04/13/2
CVE ID: CVE-2022-0618 State: PUBLISHED Published: 2022-03-09T20:23:38 Last Updated: 2024-08-02T23:32:46.550Z Vendors: Swift Project Products: SwiftNIO HTTP2 Problem Types: CWE-130 Description: A program using swift-nio-http2 is vulnerable to a denial of service attack, caused by a network peer sending a specially crafted HTTP/2 frame. This vulnerability is caused by a logical error when parsing a HTTP/2 HEADERS or HTTP/2 PUSH_PROMISE frame where the frame contains padding information without any other data. This logical error caused confusion about the size of the frame, leading to a parsing error. This parsing error immediately crashes the entire process. Sending a HEADERS frame or PUSH_PRO
ading to a parsing error. This parsing error immediately crashes the entire process. Sending a HEADERS frame or PUSH_PROMISE frame with HTTP/2 padding information does not require any special permission, so any HTTP/2 connection peer may send such a frame. For clients, this means any server to which they connect may launch this attack. For servers, anyone they allow to connect to them may launch such an attack. The attack is low-effort: it takes very little resources to send an appropriately crafted frame. The impact on availability is high: receiving the frame immediately crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward
crashes the server, dropping all in-flight connections and causing the service to need to restart. It is straightforward for an attacker to repeatedly send appropriately crafted frames, so attackers require very few resources to achieve a substantial denial of service. The attack does not have any confidentiality or integrity risks in and of itself: swift-nio-http2 is parsing the frame in memory-safe code, so the crash is safe. However, sudden process crashes can lead to violations of invariants in services, so it is possible that this attack can be used to trigger an error condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented fr
condition that has confidentiality or integrity risks. The risk can be mitigated if untrusted peers can be prevented from communicating with the service. This mitigation is not available to many services. The issue is fixed by rewriting the parsing code to correctly handle the condition. The issue was found by automated fuzzing by oss-fuzz. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apple/swift-nio-http2/security/advisories/GHSA-q36x-r5x4-h4q6
CVE ID: CVE-2022-0619 State: PUBLISHED Published: 2022-03-28T17:23:03 Last Updated: 2024-08-02T23:32:46.487Z Vendors: Unknown Products: Database Peek Problem Types: CWE-79 Description: The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d18892c6-2b19-4037-bc39-5d170adaf3d9
CVE ID: CVE-2022-0620 State: PUBLISHED Published: 2022-03-28T17:23:05 Last Updated: 2024-08-02T23:32:46.556Z Vendors: Unknown Products: Delete Old Orders Problem Types: CWE-79 Description: The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/77b92130-167c-4e8a-bde5-3fd1bd6982c6
CVE ID: CVE-2022-0621 State: PUBLISHED Published: 2022-03-28T17:23:07 Last Updated: 2024-08-02T23:32:46.485Z Vendors: Unknown Products: dTabs Problem Types: CWE-79 Description: The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b5578747-298d-4f4b-867e-46b767485a98
CVE ID: CVE-2022-0622 State: PUBLISHED Published: 2022-02-17T02:05:11 Last Updated: 2024-08-02T23:32:46.446Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-209 Description: Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4ed99dab-5319-4b6b-919a-84a9acd0061a - https://github.com/snipe/snipe-it/commit/178e44095141ab805c282f563fb088df1a10b2e2
CVE ID: CVE-2022-0623 State: PUBLISHED Published: 2022-02-17T06:30:10 Last Updated: 2024-08-02T23:32:46.438Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: mruby Products: mruby/mruby Problem Types: CWE-125 Description: Out-of-bounds Read in Homebrew mruby prior to 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/commit/ff3a5ebed6ffbe3e70481531cfb969b497aa73ad - https://huntr.dev/bounties/5b908ac7-d8f1-4fcd-9355-85df565f7580
CVE ID: CVE-2022-0624 State: PUBLISHED Published: 2022-06-28T09:10:10 Last Updated: 2024-08-02T23:32:46.493Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: ionicabizau Products: ionicabizau/parse-path Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/afffb2bd-fb06-4144-829e-ecbbcbc85388 - https://github.com/ionicabizau/parse-path/commit/f9ad8856a3c8ae18e1cf4caef5edbabbc42840e8
CVE ID: CVE-2022-0625 State: PUBLISHED Published: 2022-05-09T16:50:31 Last Updated: 2024-08-02T23:32:46.506Z Vendors: Unknown Products: Admin Menu Editor Problem Types: CWE-79 Description: The Admin Menu Editor WordPress plugin through 1.0.4 does not sanitize and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ec5c331c-fb74-4ccc-a4d4-446c2b4e703a
CVE ID: CVE-2022-0626 State: PUBLISHED Published: 2022-06-13T12:41:28 Last Updated: 2024-08-02T23:32:46.496Z Vendors: Unknown Products: Advanced Admin Search Problem Types: CWE-79 Description: The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d72164e2-8449-4fb1-aad3-bfa86d645e47
CVE ID: CVE-2022-0627 State: PUBLISHED Published: 2022-03-21T18:55:51 Last Updated: 2024-08-02T23:32:46.462Z Vendors: Unknown Products: Amelia – Events & Appointments Booking Calendar Problem Types: CWE-79 Description: The Amelia WordPress plugin before 1.0.47 does not sanitize and escape the code parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fd8c720a-a94a-438f-b686-3a734e3c24e4
CVE ID: CVE-2022-0628 State: PUBLISHED Published: 2022-03-21T18:55:52 Last Updated: 2024-08-02T23:32:46.431Z Vendors: Unknown Products: Mega Menu Plugin for WordPress – AP Mega Menu Problem Types: CWE-79 Description: The Mega Menu WordPress plugin before 3.0.8 does not sanitize and escape the _wpnonce parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/af9787ee-c496-4f02-a22c-c8f8a97ad902 - https://plugins.trac.wordpress.org/changeset/2684307
CVE ID: CVE-2022-0629 State: PUBLISHED Published: 2022-02-17T00:00:00 Last Updated: 2024-08-02T23:32:46.445Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-121 Description: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/95e2b0da-e480-4ee8-9324-a93a2ab0a877 - https://github.com/vim/vim/commit/34f8117dec685ace52cd9e578e2729db278163fc - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UURGABNDL77YR5FRQKTFBYNBDQX2KO7Q/ - https://lists.fedoraproject.org/archives/
announce%40lists.fedoraproject.org/message/UURGABNDL77YR5FRQKTFBYNBDQX2KO7Q/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html
CVE ID: CVE-2022-0630 State: PUBLISHED Published: 2022-02-19T13:55:09 Last Updated: 2024-08-02T23:32:46.461Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-125 Description: Out-of-bounds Read in Homebrew mruby prior to 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/mruby/mruby/commit/ff3a5ebed6ffbe3e70481531cfb969b497aa73ad - https://huntr.dev/bounties/f7cdd680-1a7f-4992-b4b8-44b5e4ba3e32
CVE ID: CVE-2022-0631 State: PUBLISHED Published: 2022-02-18T13:55:10 Last Updated: 2024-08-02T23:32:46.546Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: mruby Products: mruby/mruby Problem Types: CWE-122 Description: Heap-based Buffer Overflow in Homebrew mruby prior to 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9bdc49ca-6697-4adc-a785-081e1961bf40 - https://github.com/mruby/mruby/commit/47068ae07a5fa3aa9a1879cdfe98a9ce0f339299
CVE ID: CVE-2022-0632 State: PUBLISHED Published: 2022-02-19T14:00:12 Last Updated: 2024-08-02T23:32:46.436Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-476 Description: NULL Pointer Dereference in Homebrew mruby prior to 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3e5bb8f6-30fd-4553-86dd-761e9459ce1b - https://github.com/mruby/mruby/commit/44f591aa8f7091e6ca6cb418e428ae6d4ceaf77d
CVE ID: CVE-2022-0633 State: PUBLISHED Published: 2022-02-17T18:45:11 Last Updated: 2024-08-02T23:32:46.437Z Vendors: UpdraftPlus Products: UpdraftPlus WordPress Backup Plugin (Free), UpdraftPlus WordPress Backup Plugin (Premium) Problem Types: CWE-863 Description: The UpdraftPlus WordPress plugin Free before 1.22.3 and Premium before 2.22.3 do not properly validate a user has the required privileges to access a backup's nonce identifier, which may allow any users with an account on the site (such as subscriber) to download the most recent site & database backup. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d257c28f-3c7e-422b-a5c2-e618ed3c
Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d257c28f-3c7e-422b-a5c2-e618ed3c0bf3 - https://updraftplus.com/updraftplus-security-release-1-22-3-2-22-3/ - https://jetpack.com/2022/02/17/severe-vulnerability-fixed-in-updraftplus-1-22-3/ - http://packetstormsecurity.com/files/166059/WordPress-UpdraftPlus-1.22.2-Backup-Disclosure.html