Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1629 State: PUBLISHED Published: 2022-05-10T00:00:00 Last Updated: 2024-08-03T00:10:03.941Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-126 Description: Buffer Over-read in function find_next_quote in GitHub repository vim/vim prior to 8.2.4925. This vulnerabilities are capable of crashing software, Modify Memory, and possible remote execution Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e26d08d4-1886-41f0-9af4-f3e1bf3d52ee - https://github.com/vim/vim/commit/53a70289c2712808e6d4e88927e03cac01b470dd - https://lists.fedoraproject.org/archives/list/pack
/github.com/vim/vim/commit/53a70289c2712808e6d4e88927e03cac01b470dd - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1630 State: PUBLISHED Published: 2022-06-20T10:25:56 Last Updated: 2024-08-03T00:10:03.946Z Vendors: Unknown Products: WP-EMail Problem Types: CWE-352 Description: The WP-EMail WordPress plugin before 2.69.0 does not protect its log deletion functionality with nonce checks, allowing attacker to make a logged in admin delete logs via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/178d0c49-3a93-4948-8734-f3d7518361b3
CVE ID: CVE-2022-1631 State: PUBLISHED Published: 2022-05-09T14:10:10 Last Updated: 2024-08-03T00:10:03.695Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-284 Description: Users Account Pre-Takeover or Users Account Takeover. in GitHub repository microweber/microweber prior to 1.2.15. Victim Account Take Over. Since, there is no email confirmation, an attacker can easily create an account in the application using the Victim’s Email. This allows an attacker to gain pre-authentication to the victim’s account. Further, due to the lack of proper validation of email coming from Social Login and faili
ation to the victim’s account. Further, due to the lack of proper validation of email coming from Social Login and failing to check if an account already exists, the victim will not identify if an account is already existing. Hence, the attacker’s persistence will remain. An attacker would be able to see all the activities performed by the victim user impacting the confidentiality and attempt to modify/corrupt the data impacting the integrity and availability factor. This attack becomes more interesting when an attacker can register an account from an employee’s email address. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee’s account. Additional A
ss. Assuming the organization uses G-Suite, it is much more impactful to hijack into an employee’s account. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5494e258-5c7b-44b4-b443-85cff7ae0ba4 - https://github.com/microweber/microweber/commit/c162dfffb9bfd264d232aaaf5bb3daee16a3cb38 - http://packetstormsecurity.com/files/167376/Microweber-CMS-1.2.15-Account-Takeover.html
CVE ID: CVE-2022-1632 State: PUBLISHED Published: 2022-09-01T00:00:00 Last Updated: 2024-08-03T00:10:03.751Z Vendors: n/a Products: Openshift Problem Types: CWE-295 Description: An Improper Certificate Validation attack was found in Openshift. A re-encrypt Route with destinationCACertificate explicitly set to the default serviceCA skips internal Service TLS certificate validation. This flaw allows an attacker to exploit an invalid certificate, resulting in a loss of confidentiality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2081181
CVE ID: CVE-2022-1633 State: PUBLISHED Published: 2022-07-26T21:55:20 Last Updated: 2024-08-03T00:10:03.653Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Sharesheet in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1316990 - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1634 State: PUBLISHED Published: 2022-07-26T21:55:31 Last Updated: 2024-08-03T00:10:03.810Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Browser UI in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who had convinced a user to engage in specific UI interaction to potentially exploit heap corruption via specific user interactions. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html - https://crbug.com/1314908 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1635 State: PUBLISHED Published: 2022-07-26T21:55:44 Last Updated: 2024-08-03T00:10:03.767Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Permission Prompts in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interactions. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html - https://crbug.com/1319797 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1636 State: PUBLISHED Published: 2022-07-26T21:56:00 Last Updated: 2024-08-03T00:10:03.850Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Performance APIs in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html - https://crbug.com/1297283 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1637 State: PUBLISHED Published: 2022-07-26T21:56:08 Last Updated: 2024-08-03T00:10:03.797Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Web Contents in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html - https://crbug.com/1311820 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1638 State: PUBLISHED Published: 2022-07-26T21:56:21 Last Updated: 2024-08-03T00:10:03.719Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in V8 Internationalization in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html - https://crbug.com/1316946
CVE ID: CVE-2022-1639 State: PUBLISHED Published: 2022-07-26T21:56:34 Last Updated: 2024-08-03T00:10:03.757Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in ANGLE in Google Chrome prior to 101.0.4951.64 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html - https://crbug.com/1317650 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1640 State: PUBLISHED Published: 2022-07-26T21:56:47 Last Updated: 2024-08-03T00:10:03.796Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Sharing in Google Chrome prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html - https://crbug.com/1320592 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1641 State: PUBLISHED Published: 2022-07-26T21:57:02 Last Updated: 2024-08-03T00:10:03.784Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Web UI Diagnostics in Google Chrome on Chrome OS prior to 101.0.4951.64 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via specific user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_10.html - https://crbug.com/1305068 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1642 State: PUBLISHED Published: 2022-06-16T16:39:46 Last Updated: 2024-08-03T00:10:03.820Z Vendors: Swift Project Products: Swift Corelib-Foundation Problem Types: CWE-241, CWE-351, CWE-704 Description: A program using swift-corelibs-foundation is vulnerable to a denial of service attack caused by a potentially malicious source producing a JSON document containing a type mismatch. This vulnerability is caused by the interaction between a deserialization mechanism offered by the Swift standard library, the Codable protocol; and the JSONDecoder class offered by swift-corelibs-foundation, which can deserialize types that adopt the Codable protocol based on the content of a pro
by swift-corelibs-foundation, which can deserialize types that adopt the Codable protocol based on the content of a provided JSON document. When a type that adopts Codable requests the initialization of a field with an integer value, the JSONDecoder class uses a type-erased container with different accessor methods to attempt and coerce a corresponding JSON value and produce an integer. In the case the JSON value was a numeric literal with a floating-point portion, JSONDecoder used different type-eraser methods during validation than it did during the final casting of the value. The checked casting produces a deterministic crash due to this mismatch. The JSONDecoder class is often wrapped b
value. The checked casting produces a deterministic crash due to this mismatch. The JSONDecoder class is often wrapped by popular Swift-based web frameworks to parse the body of HTTP requests and perform basic type validation. This makes the attack low-effort: sending a specifically crafted JSON document during a request to these endpoints will cause them to crash. The attack does not have any confidentiality or integrity risks in and of itself; the crash is produced deterministically by an abort function that ensures that execution does not continue in the face of this violation of assumptions. However, unexpected crashes can lead to violations of invariants in services, so it's possible th
lation of assumptions. However, unexpected crashes can lead to violations of invariants in services, so it's possible that this attack can be used to trigger error conditions that escalate the risk. Producing a denial of service may also be the goal of an attacker in itself. This issue is solved in Swift 5.6.2 for Linux and Windows. This issue was solved by ensuring that the same methods are invoked both when validating and during casting, so that no type mismatch occurs. Swift for Linux and Windows versions are not ABI-interchangeable. To upgrade a service, its owner must update to this version of the Swift toolchain, then recompile and redeploy their software. The new version of Swift incl
update to this version of the Swift toolchain, then recompile and redeploy their software. The new version of Swift includes an updated swift-corelibs-foundation package. Versions of Swift running on Darwin-based operating systems are not affected. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apple/swift-corelibs-foundation/security/advisories/GHSA-239c-6cv2-wwx8
CVE ID: CVE-2022-1643 State: PUBLISHED Published: 2022-05-30T08:36:07 Last Updated: 2024-08-03T00:10:03.791Z Vendors: Unknown Products: Birthdays Widget Problem Types: CWE-79 Description: The Birthdays Widget WordPress plugin through 1.7.18 does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/73111c7e-c772-4bed-b282-854c1ae57444
CVE ID: CVE-2022-1644 State: PUBLISHED Published: 2022-05-30T08:36:09 Last Updated: 2024-08-03T00:10:03.792Z Vendors: Unknown Products: Call&Book Mobile Bar Problem Types: CWE-79 Description: The Call&Book Mobile Bar WordPress plugin through 1.2.2 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0184d70a-548c-4258-b01d-7477f03cc346
CVE ID: CVE-2022-1645 State: PUBLISHED Published: 2022-05-30T08:36:10 Last Updated: 2024-08-03T00:10:03.746Z Vendors: Unknown Products: Amazon Link Problem Types: CWE-79 Description: The Amazon Link WordPress plugin through 3.2.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/915b7d79-f9dd-451d-bf8f-6d14ec3e67d2
CVE ID: CVE-2022-1646 State: PUBLISHED Published: 2022-05-30T08:36:11 Last Updated: 2024-08-03T00:10:03.715Z Vendors: Unknown Products: Simple Real Estate Pack Problem Types: CWE-79 Description: The Simple Real Estate Pack WordPress plugin through 1.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8a32896d-bf1b-4d7b-8d84-dc38b877928b
CVE ID: CVE-2022-1647 State: PUBLISHED Published: 2022-06-06T08:51:13 Last Updated: 2024-08-03T00:10:03.693Z Vendors: Unknown Products: FormCraft – Contact Form Builder for WordPress Problem Types: CWE-79 Description: The FormCraft WordPress plugin before 1.2.6 does not sanitise and escape Field Labels, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8e8f6b08-90ab-466a-9828-dca0c0da2c9c
CVE ID: CVE-2022-1648 State: PUBLISHED Published: 2022-07-26T14:24:32.531380Z Last Updated: 2024-09-16T19:47:11.391Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: Artica PFMS Products: Pandora FMS Problem Types: CWE-23 Description: Pandora FMS v7.0NG.760 and below allows a relative path traversal in File Manager where a privileged user could upload a .php file outside the intended images directory which is restricted to execute the .php file. The impact could lead to a Remote Code Execution with running application privilege. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-expos
nalyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ - https://www.incibe.es/en/cve-assignment-publication/coordinated-cves
CVE ID: CVE-2022-1649 State: PUBLISHED Published: 2022-05-10T09:55:10 Last Updated: 2024-08-03T00:10:03.791Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-476 Description: Null pointer dereference in libr/bin/format/mach0/mach0.c in radareorg/radare2 in GitHub repository radareorg/radare2 prior to 5.7.0. It is likely to be exploitable. For more general description of heap buffer overflow, see [CWE](https://cwe.mitre.org/data/definitions/476.html). Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c07e4918-cf86-4d2e-8969-5fb63575b449 - https://github.com/radareo
am Container: References: - https://huntr.dev/bounties/c07e4918-cf86-4d2e-8969-5fb63575b449 - https://github.com/radareorg/radare2/commit/a5aafb99c3965259c84ddcf45a91144bf7eb4cf1
CVE ID: CVE-2022-1650 State: PUBLISHED Published: 2022-05-12T00:00:00 Last Updated: 2024-08-03T00:10:03.747Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: eventsource Products: eventsource/eventsource Problem Types: CWE-212 Description: Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/dc9e467f-be5d-4945-867d-1044d27e9b8e - https://github.com/eventsource/eventsource/commit/10ee0c4881a6ba2fe65ec18ed195ac35889583c4 - https://lists.debian.org/debian-lts-announce/2022/12/msg00021.html
CVE ID: CVE-2022-1651 State: PUBLISHED Published: 2022-07-26T16:37:04 Last Updated: 2024-08-03T00:10:03.707Z Vendors: n/a Products: Kernel Problem Types: CWE-401 Description: A memory leak flaw was found in the Linux kernel in acrn_dev_ioctl in the drivers/virt/acrn/hsm.c function in how the ACRN Device Model emulates virtual NICs in VM. This flaw allows a local privileged attacker to leak unauthorized kernel information, causing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ecd1735f14d6ac868ae5d8b7a2bf193fa11f388b - https://security.netapp.com/advisory/ntap-20220901-0008/
CVE ID: CVE-2022-1652 State: PUBLISHED Published: 2022-05-31T18:05:47 Last Updated: 2024-08-03T00:10:03.746Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: Linux Kernel could allow a local attacker to execute arbitrary code on the system, caused by a concurrency use-after-free flaw in the bad_flp_intr function. By executing a specially-crafted program, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system. Additional Analyst Notes: - CVE Program Container: References: - https://francozappa.github.io/about-bias/ - https://bugzilla.redhat.com/show_bug.cgi?id=1832397 - https://kb.cert.org/vuls/id/647177/ -
ppa.github.io/about-bias/ - https://bugzilla.redhat.com/show_bug.cgi?id=1832397 - https://kb.cert.org/vuls/id/647177/ - https://www.debian.org/security/2022/dsa-5173 - https://security.netapp.com/advisory/ntap-20220722-0002/
CVE ID: CVE-2022-1653 State: PUBLISHED Published: 2022-06-27T08:57:22 Last Updated: 2024-08-03T00:10:03.754Z Vendors: Unknown Products: Social Share Buttons by Supsystic Problem Types: CWE-352 Description: The Social Share Buttons by Supsystic WordPress plugin before 2.2.4 does not perform CSRF checks in it's ajax endpoints and admin pages, allowing an attacker to trick any logged in user to manipulate or change the plugin settings, as well as create, delete and rename projects and networks. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/52eff451-8ce3-4ac4-b530-3196aa82db48
CVE ID: CVE-2022-1654 State: PUBLISHED Published: 2022-06-13T13:16:09.000Z Last Updated: 2025-01-31T18:53:07.071Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ArtBees Products: Jupiter X Core, Jupiter Problem Types: CWE-269 Description: Jupiter Theme <= 6.10.1 and JupiterX Core Plugin <= 2.0.7 allow any authenticated attacker, including a subscriber or customer-level attacker, to gain administrative privileges via the "abb_uninstall_template" (both) and "jupiterx_core_cp_uninstall_template" (JupiterX Core Only) AJAX actions Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/05/critic
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/
CVE ID: CVE-2022-1655 State: PUBLISHED Published: 2022-07-22T14:54:02 Last Updated: 2024-08-03T00:10:03.818Z Vendors: n/a Products: OpenStack Problem Types: CWE-732 Description: An Incorrect Permission Assignment for Critical Resource flaw was found in Horizon on Red Hat OpenStack. Horizon session cookies are created without the HttpOnly flag despite HorizonSecureCookies being set to true in the environmental files, possibly leading to a loss of confidentiality and integrity. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/cve-2022-1655
CVE ID: CVE-2022-1656 State: PUBLISHED Published: 2022-06-13T12:41:32.000Z Last Updated: 2025-02-13T20:44:26.903Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: ArtBees Products: Jupiter X Core, Jupiter X Problem Types: CWE-284 Description: Vulnerable versions of the JupiterX Theme (<=2.0.6) allow any logged-in user, including subscriber-level users, to access any of the functions registered in lib/api/api/ajax.php, which also grant access to the jupiterx_api_ajax_ actions registered by the JupiterX Core Plugin (<=2.0.6). This includes the ability to deactivate arbitrary plugins as well as update the theme’s API key. Additional Analyst Notes: - CVE Program
ability to deactivate arbitrary plugins as well as update the theme’s API key. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/
CVE ID: CVE-2022-1657 State: PUBLISHED Published: 2022-06-13T13:06:48.000Z Last Updated: 2025-02-13T20:43:11.271Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ArtBees Products: Jupiter, Jupiter X Problem Types: CWE-22 Description: Vulnerable versions of the Jupiter (<= 6.10.1) and JupiterX (<= 2.0.6) Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion. In the JupiterX theme, the jupiterx_cp_load_pane_action AJAX action present in the lib/admin/control-panel/control-panel.php file calls the load_control_panel_pane function. It is possible to use this action to include any local PHP file via the s
le calls the load_control_panel_pane function. It is possible to use this action to include any local PHP file via the slug parameter. The Jupiter theme has a nearly identical vulnerability which can be exploited via the mka_cp_load_pane_action AJAX action present in the framework/admin/control-panel/logic/functions.php file, which calls the mka_cp_load_pane_action function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/