Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0396 State: PUBLISHED Published: 2022-03-23T10:45:13.589095Z Last Updated: 2024-09-16T19:05:24.544Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ISC Products: BIND Problem Types: ISC recently discovered an issue in BIND that allows TCP connection slots to be consumed for an indefinite time frame via a specifically crafted TCP stream sent from a client. This issue is present in BIND. BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. 9.16.11 to 9.16.26 (including S editions), and 9.18.0. This issue can only be triggered on BIND servers which have keep-response-order enable
ncluding S editions), and 9.18.0. This issue can only be triggered on BIND servers which have keep-response-order enabled, which is not the default configuration. The keep-response-order option is an ACL block; any hosts which are specified within it will be able to trigger this issue on affected versions. BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Description: BIND 9.16.11 -> 9.16.26, 9.17.0 -> 9.18.0 and versions 9.16.11-S1 -> 9.16.26-S1 of the BIND Supported Preview Edition. Specifically crafted TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after th
TCP streams can cause connections to BIND to remain in CLOSE_WAIT status for an indefinite period of time, even after the client has terminated the connection. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/v1/docs/cve-2022-0396 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NYD7US4HZRFUGAJ66ZTHFBYVP5N3OQBY/ - https://security.netapp.com/advisory/ntap-20220408-0001/ - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf - https://security.gentoo.org/glsa/202210-25
CVE ID: CVE-2022-0397 State: PUBLISHED Published: 2022-03-28T17:22:48 Last Updated: 2024-08-02T23:25:40.607Z Vendors: Unknown Products: WPC Smart Wishlist for WooCommerce Problem Types: CWE-79 Description: The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c8091254-1ced-4363-ab7f-5b880447713d
CVE ID: CVE-2022-0398 State: PUBLISHED Published: 2022-04-25T15:50:57 Last Updated: 2024-08-02T23:25:40.372Z Vendors: Unknown Products: ThirstyAffiliates Affiliate Link Manager Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The ThirstyAffiliates Affiliate Link Manager WordPress plugin before 3.10.5 does not have authorisation and CSRF checks when creating affiliate links, which could allow any authenticated user, such as subscriber to create arbitrary affiliate links, which could then be used to redirect users to an arbitrary website Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/21aec131
trary website Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/21aec131-91ff-4300-ac7a-0bf31d6b2b24
CVE ID: CVE-2022-0399 State: PUBLISHED Published: 2022-03-14T14:41:31 Last Updated: 2024-08-02T23:25:40.599Z Vendors: Unknown Products: Advanced Product Labels for WooCommerce Problem Types: CWE-79 Description: The Advanced Product Labels for WooCommerce WordPress plugin before 1.2.3.7 does not sanitise and escape the tax_color_set_type parameter before outputting it back in the berocket_apl_color_listener AJAX action's response, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5e5fdcf4-ec2b-4e73-8009-05606b2d5164 - https://plugins.trac.wordpress.org/changeset/2678919
CVE ID: CVE-2022-0400 State: PUBLISHED Published: 2022-08-29T14:03:03 Last Updated: 2024-08-02T23:25:40.451Z Vendors: n/a Products: kernel Problem Types: CWE-125 Description: An out-of-bounds read vulnerability was discovered in linux kernel in the smc protocol stack, causing remote dos. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2040604 - https://bugzilla.redhat.com/show_bug.cgi?id=2044575 - https://access.redhat.com/security/cve/CVE-2022-0400
CVE ID: CVE-2022-0401 State: PUBLISHED Published: 2022-02-01T12:28:46 Last Updated: 2024-08-02T23:25:40.481Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: yuda-lyu Products: yuda-lyu/w-zip Problem Types: CWE-22 Description: Path Traversal in NPM w-zip prior to 1.0.12. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d93259aa-ad03-43d6-8846-a00b9f58876d - https://github.com/yuda-lyu/w-zip/commit/d7039d034e02fa358e6656565157cedf5fa83288
CVE ID: CVE-2022-0402 State: PUBLISHED Published: 2024-01-16T15:51:00.565Z Last Updated: 2025-06-20T16:55:32.537Z Vendors: Unknown Products: Super Forms - Drag & Drop Form Builder Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Super Forms - Drag & Drop Form Builder WordPress plugin before 6.0.4 does not escape the bob_czy_panstwa_sprawa_zostala_rozwiazana parameter before outputting it back in an attribute via the super_language_switcher AJAX action, leading to a Reflected Cross-Site Scripting. The action is also lacking CSRF, making the attack easier to perform against any user. Additional Analyst Notes: - CVE Program Container:
lacking CSRF, making the attack easier to perform against any user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2e2e2478-2488-4c91-8af8-69b07783854f/ - https://github.com/RensTillmann/super-forms/commit/c19d65abbe43d9b6359c1bf3498dc697d0c19d02
CVE ID: CVE-2022-0403 State: PUBLISHED Published: 2022-04-04T15:35:41 Last Updated: 2024-08-02T23:25:40.624Z Vendors: Unknown Products: Library File Manager Problem Types: CWE-434 Description: The Library File Manager WordPress plugin before 5.2.3 is using an outdated version of the elFinder library, which is know to be affected by security issues (CVE-2021-32682), and does not have any authorisation as well as CSRF checks in its connector AJAX action, allowing any authenticated users, such as subscriber to call it. Furthermore, as the options passed to the elFinder library does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and fo
does not restrict any file type, users with a role as low as subscriber can Create/Upload/Delete Arbitrary files and folders. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/997a7fbf-98c6-453e-ad84-75c1e91d5a1e
CVE ID: CVE-2022-0404 State: PUBLISHED Published: 2022-04-04T15:35:43 Last Updated: 2024-08-02T23:25:40.617Z Vendors: Unknown Products: Material Design for Contact Form 7 Problem Types: CWE-862 Missing Authorization Description: The Material Design for Contact Form 7 WordPress plugin through 2.6.4 does not check authorization or that the option mentioned in the notice param belongs to the plugin when processing requests to the cf7md_dismiss_notice action, allowing any logged in user (with roles as low as Subscriber) to set arbitrary options to true, potentially leading to Denial of Service by breaking the site. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.c
enial of Service by breaking the site. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6d0932bb-d515-4432-b67b-16aba34bd285
CVE ID: CVE-2022-0405 State: PUBLISHED Published: 2022-04-03T18:30:15 Last Updated: 2024-08-02T23:25:40.394Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: janeczku Products: janeczku/calibre-web Problem Types: CWE-284 Description: Improper Access Control in GitHub repository janeczku/calibre-web prior to 0.6.16. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92 - https://huntr.dev/bounties/370538f6-5312-4c15-9fc0-b4c36ac236fe
CVE ID: CVE-2022-0406 State: PUBLISHED Published: 2022-04-03T19:05:10 Last Updated: 2024-08-02T23:25:40.441Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: janeczku Products: janeczku/calibre-web Problem Types: CWE-285 Description: Improper Authorization in GitHub repository janeczku/calibre-web prior to 0.6.16. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d7498799-4797-4751-b5e2-b669e729d5db - https://github.com/janeczku/calibre-web/commit/e0e04220109920575179a8f924543449c6de0706
CVE ID: CVE-2022-0407 State: PUBLISHED Published: 2022-01-30T13:45:52 Last Updated: 2024-08-02T23:25:40.459Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/81822bf7-aafe-4d37-b836-1255d46e572c - https://github.com/vim/vim/commit/44db8213d38c39877d2148eff6a72f4beccfb94e - https://security.gentoo.org/glsa/202208-32
CVE ID: CVE-2022-0408 State: PUBLISHED Published: 2022-01-30T00:00:00 Last Updated: 2024-08-02T23:25:40.333Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-121 Description: Stack-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5e635bad-5cf6-46cd-aeac-34ef224e179d - https://github.com/vim/vim/commit/06f15416bb8d5636200a10776f1752c4d6e49f31 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/ - https://lists.fedoraproject.org/archives/
announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0409 State: PUBLISHED Published: 2022-02-19T04:35:10 Last Updated: 2024-08-02T23:25:40.441Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in Packagist showdoc/showdoc prior to 2.10.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c25bfad1-2611-4226-954f-009e50f966f7 - https://github.com/star7th/showdoc/commit/7383d7a3c1b0807b6f397ba7df415a0ce7ccc436
CVE ID: CVE-2022-0410 State: PUBLISHED Published: 2022-03-07T08:16:31 Last Updated: 2024-08-02T23:25:40.346Z Vendors: Unknown Products: WP Visitor Statistics (Real Time Traffic) Problem Types: CWE-89 Description: The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.6 does not sanitise and escape the id parameter before using it in a SQL statement via the refUrlDetails AJAX action, available to any authenticated user, leading to a SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0d6b89f5-cf12-4ad4-831b-fed26763ba20
CVE ID: CVE-2022-0411 State: PUBLISHED Published: 2022-02-28T09:06:54 Last Updated: 2024-08-02T23:25:40.440Z Vendors: Unknown Products: Asgaros Forum Problem Types: CWE-89 Description: The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated user), leading to a SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/35272197-c973-48ad-8405-538bfbafa172 - https://plugins.trac.wordpress.org/changeset/2669226/asgaros-forum
CVE ID: CVE-2022-0412 State: PUBLISHED Published: 2022-02-28T09:06:56 Last Updated: 2024-08-02T23:25:40.372Z Vendors: TemplateInvaders Products: TI WooCommerce Wishlist, TI WooCommerce Wishlist Pro Problem Types: CWE-89 Description: The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint, allowing unauthenticated attackers to perform SQL injection attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e984ba11-abeb-4ed4-9dad-0bfd539a9682 - https://plug
VE Program Container: References: - https://wpscan.com/vulnerability/e984ba11-abeb-4ed4-9dad-0bfd539a9682 - https://plugins.trac.wordpress.org/changeset/2668899
CVE ID: CVE-2022-0413 State: PUBLISHED Published: 2022-01-30T00:00:00 Last Updated: 2024-08-02T23:25:40.374Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/563d1e8f-5c3d-4669-941c-3216f4a87c38 - https://github.com/vim/vim/commit/37f47958b8a2a44abc60614271d9537e7f14e51a - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/ - https://lists.fedoraproject.org/archives/list/package-
sts.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/ - https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0414 State: PUBLISHED Published: 2022-01-31T00:00:00 Last Updated: 2024-08-02T23:25:40.379Z Severity: MEDIUM (CVSS 4.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N) Vendors: dolibarr Products: dolibarr/dolibarr Problem Types: CWE-1284 Description: Improper Validation of Specified Quantity in Input in Packagist dolibarr/dolibarr prior to 16.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/76f3b405-9f5d-44b1-8434-b52b56ee395f - https://github.com/dolibarr/dolibarr/commit/37fb02ee760cfff18c795ba468da1ba1c53f4684
CVE ID: CVE-2022-0415 State: PUBLISHED Published: 2022-03-21T10:45:13 Last Updated: 2024-08-02T23:25:40.311Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: gogs Products: gogs/gogs Problem Types: CWE-20 Description: Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902 - https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284
CVE ID: CVE-2022-0417 State: PUBLISHED Published: 2022-02-01T00:00:00.000Z Last Updated: 2025-11-03T20:34:28.705Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fc86bc8d-c866-4ade-8b7f-e49cec306d1a - https://github.com/vim/vim/commit/652dee448618589de5528a9e9a36995803f5557a - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/ - https://lists.fedoraproject.org/archives
-announce%40lists.fedoraproject.org/message/UFXFAILMLUIK4MBUEZO4HNBNKYZRJ5AP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/ - https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0418 State: PUBLISHED Published: 2022-05-02T16:05:36 Last Updated: 2024-08-02T23:25:40.575Z Vendors: Unknown Products: Event List Problem Types: CWE-79 Description: The Event List WordPress plugin before 0.8.8 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks against other admin even when the unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/74888a9f-fb75-443d-bb85-0120cbb764a0
CVE ID: CVE-2022-0419 State: PUBLISHED Published: 2022-02-01T10:38:32 Last Updated: 2024-08-02T23:25:40.366Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1f84e79d-70e7-4b29-8b48-a108f81c89aa - https://github.com/radareorg/radare2/commit/feaa4e7f7399c51ee6f52deb84dc3f795b4035d6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKGIB52R4XPCPNEW6GF56EHW7ST24IJU/ - http
oraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SKGIB52R4XPCPNEW6GF56EHW7ST24IJU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IQIRJ72UALGMSWH6MYPVJQQLXFGZ23RS/ - https://census-labs.com/news/2022/05/24/multiple-vulnerabilities-in-radare2/ - http://www.openwall.com/lists/oss-security/2022/05/25/1
CVE ID: CVE-2022-0420 State: PUBLISHED Published: 2022-03-07T08:16:33 Last Updated: 2024-08-02T23:25:40.446Z Vendors: Unknown Products: RegistrationMagic – Custom Registration Forms, User Registration and User Login Plugin Problem Types: CWE-89 Description: The RegistrationMagic WordPress plugin before 5.0.2.2 does not sanitise and escape the rm_form_id parameter before using it in a SQL statement in the Automation admin dashboard, allowing high privilege users to perform SQL injection attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/056b5167-3cbc-47d1-9917-52a434796151 - https://plugins.trac.wordpress.org/changeset/2672042
CVE ID: CVE-2022-0421 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-30T14:54:24.956Z Vendors: Unknown Products: Five Star Restaurant Reservations Problem Types: CWE-116 Improper Encoding or Escaping of Output Description: The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments Additional Analyst Notes: - CVE Program Conta
te Scripting attacks against a logged in admin viewing the failed payments Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/145e8d3c-cd6f-4827-86e5-ea2d395a80b9
CVE ID: CVE-2022-0422 State: PUBLISHED Published: 2022-03-07T08:16:34 Last Updated: 2024-08-02T23:25:40.657Z Vendors: Unknown Products: White Label CMS Problem Types: CWE-79 Description: The White Label CMS WordPress plugin before 2.2.9 does not sanitise and validate the wlcms[_login_custom_js] parameter before outputting it back in the response while previewing, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/429be4eb-8a6b-4531-9465-9ef0d35c12cc - https://plugins.trac.wordpress.org/changeset/2672615
CVE ID: CVE-2022-0423 State: PUBLISHED Published: 2022-03-21T18:55:45 Last Updated: 2024-08-02T23:25:40.625Z Vendors: Unknown Products: 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery Problem Types: CWE-79 Description: The 3D FlipBook WordPress plugin before 1.12.1 does not have authorisation and CSRF checks when updating its settings, and does not have any sanitisation/escaping, allowing any authenticated users, such as subscriber to put Cross-Site Scripting payloads in all pages with a 3d flipbook. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7dde0b9d-9b86-4961-b005-a11b6ffba952
CVE ID: CVE-2022-0424 State: PUBLISHED Published: 2022-05-09T16:50:28 Last Updated: 2024-08-02T23:25:40.455Z Vendors: Unknown Products: Popup by Supsystic Problem Types: CWE-306 Description: The Popup by Supsystic WordPress plugin before 1.10.9 does not have any authentication and authorisation in an AJAX action, allowing unauthenticated attackers to call it and get the email addresses of subscribed users Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1e4593fd-51e5-43ca-a244-9aaef3804b9f
CVE ID: CVE-2022-0425 State: PUBLISHED Published: 2022-04-01T22:17:39 Last Updated: 2024-08-02T23:25:40.638Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Server-side request forgery (ssrf) in GitLab Description: A DNS rebinding vulnerability in the Irker IRC Gateway integration in all versions of GitLab CE/EE since version 7.9 allows an attacker to trigger Server Side Request Forgery (SSRF) attacks. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/22350 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0425.json
CVE ID: CVE-2022-0426 State: PUBLISHED Published: 2022-03-07T08:16:36 Last Updated: 2024-08-02T23:25:40.558Z Vendors: Unknown Products: Product Feed PRO for WooCommerce Problem Types: CWE-79 Description: The Product Feed PRO for WooCommerce WordPress plugin before 11.2.3 does not escape the rowCount parameter before outputting it back in an attribute via the woosea_categories_dropdown AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/de69bcd1-b0b1-4b16-9655-776ee57ad90a - https://plugins.trac.wordpress.org/changeset/2670405
CVE ID: CVE-2022-0427 State: PUBLISHED Published: 2022-03-28T18:53:05 Last Updated: 2024-08-02T23:25:40.340Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Cross-site request forgery (csrf) in GitLab Description: Missing sanitization of HTML attributes in Jupyter notebooks in all versions of GitLab CE/EE since version 14.5 allows an attacker to perform arbitrary HTTP POST requests on a user's behalf leading to potential account takeover Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/347284 - https://hackerone.com/reports/1409788 - https://gitlab.com/gitlab-o
tps://gitlab.com/gitlab-org/gitlab/-/issues/347284 - https://hackerone.com/reports/1409788 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0427.json