Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0634 State: PUBLISHED Published: 2022-04-25T15:51:00 Last Updated: 2024-08-02T23:32:46.452Z Vendors: Unknown Products: ThirstyAffiliates Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The ThirstyAffiliates WordPress plugin before 3.10.5 lacks authorization checks in the ta_insert_external_image action, allowing a low-privilege user (with a role as low as Subscriber) to add an image from an external URL to an affiliate link. Further the plugin lacks csrf checks, allowing an attacker to trick a logged in user to perform the action by crafting a special request. Additional Analyst Notes: - CVE Program Container: References:
ser to perform the action by crafting a special request. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7e11aeb0-b231-407d-86ec-9018c2c7eee3
CVE ID: CVE-2022-0635 State: PUBLISHED Published: 2022-03-23T11:55:10.058754Z Last Updated: 2024-09-17T02:21:44.299Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND Problem Types: We refactored the RFC 8198 Aggressive Use of DNSSEC-Validated Cache feature (synth-from-dnssec) for the new BIND 9.18.0 stable release, and changed the default so that is now automatically enabled for dnssec-validating resolvers. Subsequently it was found that repeated patterns of specific queries to servers with this feature enabled could cause an INSIST failure in query.c:query_dname which causes named to terminate unexpectedly. The vulnerability affects BIND res
n INSIST failure in query.c:query_dname which causes named to terminate unexpectedly. The vulnerability affects BIND resolvers running 9.18.0 that have both dnssec-validation and synth-from-dnssec enabled. (Note that dnssec-validation auto; is the default setting unless configured otherwise in named.conf and that enabling dnssec-validation automatically enables synth-from-dnssec unless explicitly disabled) Versions affected: BIND 9.18.0 Description: Versions affected: BIND 9.18.0 When a vulnerable version of named receives a series of specific queries, the named process will eventually terminate due to a failed assertion check. Additional Analyst Notes: - CVE Program Container: References: -
l eventually terminate due to a failed assertion check. Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/v1/docs/cve-2022-0635 - https://security.netapp.com/advisory/ntap-20220408-0001/
CVE ID: CVE-2022-0636 State: PUBLISHED Published: 2022-04-22T20:30:49 Last Updated: 2024-08-02T23:32:46.449Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: Thin Installer Problem Types: CWE-120 Description: A denial of service vulnerability was reported in Lenovo Thin Installer prior to version 1.3.0039 that could trigger a system crash. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-78116
CVE ID: CVE-2022-0637 State: PUBLISHED Published: 2023-02-16T00:00:00.000Z Last Updated: 2025-03-19T14:53:11.104Z Vendors: n/a Products: mozilla/pollbot Problem Types: open redirect Description: open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.mozilla.org/show_bug.cgi?id=1753838
CVE ID: CVE-2022-0638 State: PUBLISHED Published: 2022-02-17T16:30:17 Last Updated: 2024-08-02T23:32:46.543Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in Packagist microweber/microweber prior to 1.2.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9d3d883c-d74c-4fe2-9978-a8e3d1ccf9f3 - https://github.com/microweber/microweber/commit/756096da1260f29ff6f4532234d93d8e41dd5aa8
CVE ID: CVE-2022-0639 State: PUBLISHED Published: 2022-02-17T00:00:00 Last Updated: 2024-08-02T23:32:46.546Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: unshiftio Products: unshiftio/url-parse Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/83a6bc9a-b542-4a38-82cd-d995a1481155 - https://github.com/unshiftio/url-parse/commit/ef45a1355375a8244063793a19059b4f62fc8788 - https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html
CVE ID: CVE-2022-0640 State: PUBLISHED Published: 2022-03-21T18:55:54 Last Updated: 2024-08-02T23:32:46.538Z Vendors: Unknown Products: Pricing Table Builder – AP Pricing Tables Lite Problem Types: CWE-79 Description: The Pricing Table Builder WordPress plugin before 1.1.5 does not sanitize and escape the postid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f8405e06-9cf3-4acb-aebb-e80fb402daa9 - https://plugins.trac.wordpress.org/changeset/2684253
CVE ID: CVE-2022-0641 State: PUBLISHED Published: 2022-03-28T17:23:08 Last Updated: 2024-08-02T23:32:46.554Z Vendors: Unknown Products: Popup Like box – Page Plugin Problem Types: CWE-79 Description: The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0a9830df-5f5d-40a3-9841-40994275136f
CVE ID: CVE-2022-0642 State: PUBLISHED Published: 2022-05-30T08:35:35 Last Updated: 2024-08-02T23:32:46.492Z Vendors: Unknown Products: JivoChat Live Chat – WP live chat plugin for WordPress Problem Types: CWE-352 Description: The JivoChat Live Chat WordPress plugin before 1.3.5.4 does not properly check CSRF tokens on POST requests to the plugins admin page, and does not sanitise some parameters, leading to a stored Cross-Site Scripting vulnerability where an attacker can trick a logged in administrator to inject arbitrary javascript. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/099cf9b4-0b3a-43c6-8ca9-7c2d50f86425
CVE ID: CVE-2022-0643 State: PUBLISHED Published: 2022-03-28T17:23:10 Last Updated: 2024-08-02T23:32:46.417Z Vendors: Unknown Products: Bank Mellat Problem Types: CWE-79 Description: The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5be0de93-9625-419a-8c37-521c1bd9c24c
CVE ID: CVE-2022-0644 State: REJECTED Published: 2022-08-29T14:03:06 Last Updated: 2022-08-29T14:03:06 Description: No description available.
CVE ID: CVE-2022-0645 State: PUBLISHED Published: 2022-04-19T11:20:10 Last Updated: 2024-08-02T23:32:46.538Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: posthog Products: posthog/posthog Problem Types: CWE-601 Description: Open redirect vulnerability via endpoint authorize_and_redirect/?redirect= in GitHub repository posthog/posthog prior to 1.34.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c13258a2-30e3-4261-9a3b-2f39c49a8bd6 - https://github.com/posthog/posthog/commit/859d8ed9ac7c5026db09714a26c85c1458abb038
CVE ID: CVE-2022-0646 State: PUBLISHED Published: 2022-02-18T17:50:36 Last Updated: 2024-08-02T23:32:46.447Z Vendors: n/a Products: Kernel Problem Types: CWE-459 Description: A flaw use after free in the Linux kernel Management Component Transport Protocol (MCTP) subsystem was found in the way user triggers cancel_work_sync after the unregister_netdev during removing device. A local user could use this flaw to crash the system or escalate their privileges on the system. It is actual from Linux Kernel 5.17-rc1 (when mctp-serial.c introduced) till 5.17-rc5. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/all/20220211011552.1861886-1-jk%40codeconstruct.c
Notes: - CVE Program Container: References: - https://lore.kernel.org/all/20220211011552.1861886-1-jk%40codeconstruct.com.au - https://security.netapp.com/advisory/ntap-20220318-0006/
CVE ID: CVE-2022-0647 State: PUBLISHED Published: 2022-03-28T17:23:12 Last Updated: 2024-08-02T23:32:46.543Z Vendors: Unknown Products: Bulk Creator Problem Types: CWE-79 Description: The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4a585d5f-72ba-43e3-b04f-8b3e1b84444a
CVE ID: CVE-2022-0648 State: PUBLISHED Published: 2022-03-14T14:41:40 Last Updated: 2024-08-02T23:32:46.542Z Vendors: Unknown Products: Team Circle Image Slider With Lightbox Problem Types: CWE-79 Description: The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the order_pos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/90f9ad6a-4855-4a8e-97f6-5f403eb6455d
CVE ID: CVE-2022-0649 State: PUBLISHED Published: 2022-05-02T16:05:39 Last Updated: 2024-08-02T23:32:46.545Z Vendors: Unknown Products: AdRotate – Ad manager & AdSense Ads Problem Types: CWE-79 Description: The AdRotate WordPress plugin before 5.8.23 does not escape Group Names, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/284fbc98-803d-4da5-8920-411eeae4bac8
CVE ID: CVE-2022-0650 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-02-19T15:42:56.115Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: TP-Link Products: TL-WR940N Problem Types: CWE-121 Description: This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 200316 Rel.34392n (5553) routers. Authentication is required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fix
t. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-13993. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-407/
CVE ID: CVE-2022-0651 State: PUBLISHED Published: 2022-02-24T18:27:07.000Z Last Updated: 2025-01-31T19:02:18.407Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: WP Statistics Products: WP Statistics Problem Types: CWE-89 Description: The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to obtain sensitive information, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnric
formation, in versions up to and including 13.1.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gist.github.com/Xib3rR4dAr/5dbd58b7f57a5037fe461fba8e696042 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0651 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2679983%40wp-statistics&new=2679983%40wp-statistics&sfp_email=&sfph_mail=
CVE ID: CVE-2022-0652 State: PUBLISHED Published: 2022-03-21T23:45:15 Last Updated: 2024-08-02T23:32:46.552Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Sophos Products: Sophos UTM Problem Types: n/a Description: Confd log files contain local users', including root’s, SHA512crypt password hashes with insecure access permissions. This allows a local attacker to attempt off-line brute-force attacks against these password hashes in Sophos UTM before version 9.710. Additional Analyst Notes: - CVE Program Container: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220321-utm-9710
CVE ID: CVE-2022-0653 State: PUBLISHED Published: 2022-02-24T18:27:05.000Z Last Updated: 2025-01-31T19:03:11.339Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Cozmoslabs Products: Profile Builder – User Profile & User Registration Forms Problem Types: CWE-79 Description: The Profile Builder – User Profile & User Registration Forms WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the site_url parameter found in the ~/assets/misc/fallback-page.php file which allows attackers to inject arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This
arbitrary web scripts onto a pages that executes whenever a user clicks on a specially crafted link by an attacker. This affects versions up to and including 3.6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/02/reflected-cross-site-scripting-vulnerability-patched-in-wordpress-profile-builder-plugin/ - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2655168%40profile-builder&new=2655168%40profile-builder&sfp_email=&sfph_mail=
CVE ID: CVE-2022-0654 State: PUBLISHED Published: 2022-02-22T23:30:11 Last Updated: 2024-08-02T23:32:46.547Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: fgribreau Products: fgribreau/node-request-retry Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository fgribreau/node-request-retry prior to 7.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a779faf5-c2cc-48be-a31d-4ddfac357afc - https://github.com/fgribreau/node-request-retry/commit/0979c6001d9d57c2aac3157c11b007397158922a
CVE ID: CVE-2022-0655 State: REJECTED Published: 2022-02-25T18:11:16 Last Updated: 2022-02-25T18:11:16 Description: No description available.
CVE ID: CVE-2022-0656 State: PUBLISHED Published: 2022-04-25T15:51:03 Last Updated: 2024-08-02T23:32:46.447Z Vendors: Unknown Products: Web To Print Shop : uDraw Problem Types: CWE-552 Description: The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc) Additional Analyst Notes: - CVE Program Container: References: - https
b server (such as /etc/passwd, wp-config.php etc) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/925c4c28-ae94-4684-a365-5f1e34e6c151
CVE ID: CVE-2022-0657 State: PUBLISHED Published: 2022-04-25T15:51:04 Last Updated: 2024-08-02T23:32:46.550Z Vendors: Unknown Products: 5 Stars Rating Funnel WordPress Plugin | RRatingg Problem Types: CWE-89 Description: The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtngg_delete_leads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue. There is an attempt to sanitise the input, using sanitize_text_field(), however such function is not intended to prevent SQL injections. Additional Analyst Notes: - CVE Pro
itize_text_field(), however such function is not intended to prevent SQL injections. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e7fe8218-4ef5-4ef9-9850-8567c207e8e6
CVE ID: CVE-2022-0658 State: PUBLISHED Published: 2022-03-14T14:41:41 Last Updated: 2024-08-02T23:32:46.451Z Vendors: Unknown Products: CommonsBooking Problem Types: CWE-89 Description: The CommonsBooking WordPress plugin before 2.6.8 does not sanitise and escape the location parameter of the calendar_data AJAX action (available to unauthenticated users) before it is used in dynamically constructed SQL queries, leading to an unauthenticated SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d7f0805a-61ce-454a-96fb-5ecacd767578
CVE ID: CVE-2022-0659 State: PUBLISHED Published: 2022-03-14T14:41:42 Last Updated: 2024-08-02T23:32:46.452Z Vendors: Unknown Products: Sync QCloud COS Problem Types: CWE-79 Description: The Sync QCloud COS WordPress plugin before 2.0.1 does not escape some of its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/22dc2661-ba64-49e7-af65-892a617ab02c
CVE ID: CVE-2022-0660 State: PUBLISHED Published: 2022-02-18T11:10:10 Last Updated: 2024-08-02T23:32:46.500Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-209 Description: Generation of Error Message Containing Sensitive Information in Packagist microweber/microweber prior to 1.2.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/01fd2e0d-b8cf-487f-a16c-7b088ef3a291 - https://github.com/microweber/microweber/commit/2417bd2eda2aa2868c1dad1abf62341f22bfc20a
CVE ID: CVE-2022-0661 State: PUBLISHED Published: 2022-04-18T17:10:28 Last Updated: 2024-08-02T23:32:46.540Z Vendors: Unknown Products: Ad Injection Problem Types: CWE-94 Description: The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set. Additional Analyst Notes: -
vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3c5a7b03-d4c3-46b9-af65-fb50e58b0bfd
CVE ID: CVE-2022-0662 State: PUBLISHED Published: 2022-05-02T16:05:40 Last Updated: 2024-08-02T23:32:46.556Z Vendors: Unknown Products: AdRotate – Ad manager & AdSense Ads Problem Types: CWE-79 Description: The AdRotate WordPress plugin before 5.8.23 does not sanitise and escape Advert Names which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/27ad58ba-b648-41d9-8074-16e4feeaee69
CVE ID: CVE-2022-0663 State: PUBLISHED Published: 2022-06-20T10:25:46 Last Updated: 2024-08-02T23:32:46.439Z Vendors: Unknown Products: Print, PDF, Email by PrintFriendly Problem Types: CWE-79 Description: The Print, PDF, Email by PrintFriendly WordPress plugin before 5.2.3 does not sanitise and escape the Custom Button Text settings, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b586b217-f91e-42d3-81f1-cc3ee3a4b01e
CVE ID: CVE-2022-0664 State: PUBLISHED Published: 2022-02-18T14:00:13 Last Updated: 2024-08-02T23:32:46.560Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: gravitl Products: gravitl/netmaker Problem Types: CWE-321 Description: Use of Hard-coded Cryptographic Key in Go github.com/gravitl/netmaker prior to 0.8.5,0.9.4,0.10.0,0.10.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/29898a42-fd4f-4b5b-a8e3-ab573cb87eac - https://github.com/gravitl/netmaker/commit/9bee12642986cb9534e268447b70e6f0f03c59cf
CVE ID: CVE-2022-0665 State: PUBLISHED Published: 2022-02-22T14:55:09 Last Updated: 2024-08-02T23:32:46.655Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-22 Description: Path Traversal in GitHub repository pimcore/pimcore prior to 10.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/423df64d-c591-4ad9-bf1c-411bcbc06ba3 - https://github.com/pimcore/pimcore/commit/28945649a6234ccaa8c94c6cd83d1954603baf3e
CVE ID: CVE-2022-0666 State: PUBLISHED Published: 2022-02-18T14:55:12 Last Updated: 2024-08-02T23:32:46.614Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-93 Description: CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7215afc7-9133-4749-8e8e-0569317dbd55 - https://github.com/microweber/microweber/commit/f0e338f1b7dc5ec9d99231f4ed3fa6245a5eb128
CVE ID: CVE-2022-0667 State: PUBLISHED Published: 2022-03-22T11:15:13.972441Z Last Updated: 2024-09-16T22:20:53.204Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND Problem Types: In BIND 9.18.0 the recursive client code was refactored. This refactoring introduced a "backstop lifetime timer". While BIND is processing a request for a DS record that needs to be forwarded, it waits until this processing is complete or until the backstop lifetime timer has timed out. When the resume_dslookup() function is called as a result of such a timeout, the function does not test whether the fetch has previously been shut down. This introduces the possibil
such a timeout, the function does not test whether the fetch has previously been shut down. This introduces the possibility of triggering an assertion failure, which could cause the BIND process to terminate. Only the BIND 9.18 branch is affected. BIND 9.18.0 Description: When the vulnerability is triggered the BIND process will exit. BIND 9.18.0 Additional Analyst Notes: - CVE Program Container: References: - https://kb.isc.org/v1/docs/cve-2022-0667 - https://security.netapp.com/advisory/ntap-20220408-0001/
CVE ID: CVE-2022-0668 State: PUBLISHED Published: 2023-01-08T00:00:00.000Z Last Updated: 2025-04-09T13:44:13.635Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: JFrog Products: JFrog Artifactory Problem Types: CWE-274 Description: JFrog Artifactory prior to 7.37.13 is vulnerable to Authentication Bypass, which can lead to Privilege Escalation when a specially crafted request is sent by an unauthenticated user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jfrog.com/confluence/display/JFROG/CVE-2022-0668%3A+Artifactory+Authentication+Bypass