Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0846 State: PUBLISHED Published: 2022-03-28T17:23:28 Last Updated: 2024-08-02T23:40:04.572Z Vendors: Unknown Products: SpeakOut! Email Petitions Problem Types: CWE-89 Description: The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b030296d-688e-44a4-a48a-140375f2c5f4
CVE ID: CVE-2022-0847 State: PUBLISHED Published: 2022-03-07T00:00:00.000Z Last Updated: 2025-10-21T23:15:44.668Z Vendors: n/a Products: kernel Problem Types: CWE-665 Description: A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values. An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=206
t Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2060795 - https://dirtypipe.cm4all.com/ - http://packetstormsecurity.com/files/166230/Dirty-Pipe-SUID-Binary-Hijack-Privilege-Escalation.html - http://packetstormsecurity.com/files/166229/Dirty-Pipe-Linux-Privilege-Escalation.html - http://packetstormsecurity.com/files/166258/Dirty-Pipe-Local-Privilege-Escalation.html - https://www.suse.com/support/kb/doc/?id=000020603 - https://security.netapp.com/advisory/ntap-20220325-0005/ - https://cert-portal.siemens.com/productcert/pdf/ssa-222547.pdf - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015 - http://packetstorms
m/productcert/pdf/ssa-222547.pdf - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0015 - http://packetstormsecurity.com/files/176534/Linux-4.20-KTLS-Read-Only-Write.html
CVE ID: CVE-2022-0848 State: PUBLISHED Published: 2022-03-04T08:25:10 Last Updated: 2024-08-02T23:40:04.503Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: part-db Products: part-db/part-db Problem Types: CWE-78 Description: OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3e91685f-cfb9-4ee4-abaf-9b712a8fd5a6 - https://github.com/part-db/part-db/commit/9cd4eee393028aa4cab70fcbac284b0028c0bc95 - http://packetstormsecurity.com/files/166217/part-db-0.5.11-Remote-Code-Execution.html
CVE ID: CVE-2022-0849 State: PUBLISHED Published: 2022-03-05T09:30:12 Last Updated: 2024-08-02T23:40:04.511Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-416 Description: Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/29c5f76e-5f1f-43ab-a0c8-e31951e407b6 - https://github.com/radareorg/radare2/commit/10517e3ff0e609697eb8cde60ec8dc999ee5ea24
CVE ID: CVE-2022-0850 State: PUBLISHED Published: 2022-08-29T14:03:05 Last Updated: 2024-08-02T23:40:04.478Z Vendors: n/a Products: kernel Problem Types: CWE-200 Description: A vulnerability was found in linux kernel, where an information leak occurs via ext4_extent_header to userspace. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2060606 - https://syzkaller.appspot.com/bug?id=78e9ad0e6952a3ca16e8234724b2fa92d041b9b8 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ce3aba43599f0b50adbebff133df8d08a3d5fffe - https://access.redhat.com/security/cve/CVE-2022-0850
CVE ID: CVE-2022-0851 State: PUBLISHED Published: 2022-08-29T14:03:05 Last Updated: 2024-08-02T23:40:04.571Z Vendors: n/a Products: convert2rhel Problem Types: CWE-200 Description: There is a flaw in convert2rhel. When the --activationkey option is used with convert2rhel, the activation key is subsequently passed to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the activation key via the process command line via e.g. htop or ps. The specific impact varies upon the subscription, but generally this would allow an attacker to register systems purchased by the victim until discovered; a form of fraud. This could occur regardless of
n attacker to register systems purchased by the victim until discovered; a form of fraud. This could occur regardless of how the activation key is supplied to convert2rhel because it involves how convert2rhel provides it to subscription-manager. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2060217 - https://access.redhat.com/security/cve/CVE-2022-0851
CVE ID: CVE-2022-0852 State: PUBLISHED Published: 2022-08-29T14:03:05 Last Updated: 2024-08-02T23:40:04.490Z Vendors: n/a Products: convert2rhel Problem Types: CWE-359 Description: There is a flaw in convert2rhel. convert2rhel passes the Red Hat account password to subscription-manager via the command line, which could allow unauthorized users locally on the machine to view the password via the process command line via e.g. htop or ps. The specific impact varies upon the privileges of the Red Hat account in question, but it could affect the integrity, availability, and/or data confidentiality of other systems that are administered by that account. This occurs regardless of how the password i
ata confidentiality of other systems that are administered by that account. This occurs regardless of how the password is supplied to convert2rhel. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2060129 - https://issues.redhat.com/browse/RHELC-432 - https://github.com/oamg/convert2rhel/pull/492 - https://github.com/oamg/convert2rhel/commit/8d72fb030ed31116fdb256b327d299337b000af4 - https://access.redhat.com/security/cve/CVE-2022-0852
CVE ID: CVE-2022-0853 State: PUBLISHED Published: 2022-03-11T17:54:27 Last Updated: 2024-08-02T23:40:04.530Z Vendors: n/a Products: jboss-client Problem Types: Memory Leakage Description: A flaw was found in JBoss-client. The vulnerability occurs due to a memory leak on the JBoss client-side, when using UserTransaction repeatedly and leads to information leakage vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2060725 - https://github.com/ByteHackr/CVE-2022-0853
CVE ID: CVE-2022-0854 State: PUBLISHED Published: 2022-03-23T19:46:15 Last Updated: 2024-08-02T23:40:04.528Z Vendors: n/a Products: Kernel Problem Types: CWE-200 Description: A memory leak flaw was found in the Linux kernel’s DMA subsystem, in the way a user calls DMA_FROM_DEVICE. This flaw allows a local user to read random memory from the kernel space. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/kernel/dma/swiotlb.c?h=v5.17-rc8&id=aa6f8dcbab473f3a3c7454b74caa46d36cdc5d13 - https://www.debian.org/security/2022/dsa-5161 - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - https://
://www.debian.org/security/2022/dsa-5161 - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - https://www.debian.org/security/2022/dsa-5173
CVE ID: CVE-2022-0855 State: PUBLISHED Published: 2022-03-04T18:25:08 Last Updated: 2024-08-02T23:40:04.527Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: microweber-dev Products: microweber-dev/whmcs_plugin Problem Types: CWE-41 Description: Improper Resolution of Path Equivalence in GitHub repository microweber-dev/whmcs_plugin prior to 0.0.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/511879b0-cdaa-4c03-af92-deb54d46284a - https://github.com/microweber-dev/whmcs_plugin/commit/2e7a11d332db79cc52ccda00455a15f4dc6147ff
CVE ID: CVE-2022-0856 State: PUBLISHED Published: 2022-03-08T00:00:00 Last Updated: 2024-08-02T23:40:04.515Z Vendors: n/a Products: libcaca Problem Types: CWE-369 Description: libcaca is affected by a Divide By Zero issue via img2txt, which allows a remote malicious user to cause a Denial of Service Additional Analyst Notes: - CVE Program Container: References: - https://github.com/cacalabs/libcaca/issues/65 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTDRPVX3HCYLQCLMQ6NNSRC3B7L6WGUM/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/B3E5GF2LSX2ZEY5JZNM7HXJMLHMY436X/ - https://lists.fedora
rchives/list/package-announce%40lists.fedoraproject.org/message/B3E5GF2LSX2ZEY5JZNM7HXJMLHMY436X/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MFOFTTMHO666HB3TVHBMCES6GCKG5PPG/
CVE ID: CVE-2022-0857 State: PUBLISHED Published: 2022-03-23T14:15:19 Last Updated: 2024-08-02T23:40:04.563Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: McAfee,LLC Products: McAfee ePolicy Orchestrator (ePO) Problem Types: CWE-79 Description: A reflected cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited access to sensitive information and limited ability to alter some information in ePO due to the area of the User I
mited access to sensitive information and limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE ID: CVE-2022-0858 State: PUBLISHED Published: 2022-03-23T14:20:19.000Z Last Updated: 2025-04-23T18:44:46.821Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: McAfee,LLC Products: McAfee ePolicy Orchestrator (ePO) Problem Types: CWE-79 Description: A cross-site scripting (XSS) vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to potentially obtain access to an ePO administrator's session by convincing the attacker to click on a carefully crafted link. This would lead to limited ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in. Additio
ability to alter some information in ePO due to the area of the User Interface the vulnerability is present in. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE ID: CVE-2022-0859 State: PUBLISHED Published: 2022-03-23T14:20:12 Last Updated: 2024-08-02T23:40:04.552Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: McAfee,LLC Products: McAfee ePolicy Orchestrator (ePO) Problem Types: CWE-522 Description: McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a local attacker to point an ePO server to an arbitrary SQL server during the restoration of the ePO server. To achieve this the attacker would have to be logged onto the server hosting the ePO server (restricted to administrators) and to know the SQL server password. Additional Analyst Notes: - CVE Program Container: References: - https://
strators) and to know the SQL server password. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE ID: CVE-2022-0860 State: PUBLISHED Published: 2022-03-11T12:50:10 Last Updated: 2024-08-02T23:40:04.519Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: cobbler Products: cobbler/cobbler Problem Types: CWE-285 Description: Improper Authorization in GitHub repository cobbler/cobbler prior to 3.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c458b868-63df-414e-af10-47e3745caa1d - https://github.com/cobbler/cobbler/commit/9044aa990a94752fa5bd5a24051adde099280bfa - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DYWYHWVVRUSPCV5SWBOSAMQJQLTSBTKY/ - https://lists.fe
rg/archives/list/package-announce%40lists.fedoraproject.org/message/DYWYHWVVRUSPCV5SWBOSAMQJQLTSBTKY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D4KCNZYBQC2FM5SEEDRQZO4LRZ4ZECMG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYSHMF6MEIITFAG7EJ3IQKVUN7MDV2XM/
CVE ID: CVE-2022-0861 State: PUBLISHED Published: 2022-03-23T14:25:19 Last Updated: 2024-08-02T23:40:04.557Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: McAfee,LLC Products: McAfee ePolicy Orchestrator (ePO) Problem Types: CWE-611 Description: A XML Extended entity vulnerability in McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote administrator attacker to upload a malicious XML file through the extension import functionality. The impact is limited to some access to confidential information and some ability to alter data. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index
ty to alter data. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE ID: CVE-2022-0862 State: PUBLISHED Published: 2022-03-23T14:25:12 Last Updated: 2024-08-02T23:40:04.495Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: McAfee,LLC Products: McAfee ePolicy Orchestrator (ePO) Problem Types: CWE-522 Description: A lack of password change protection vulnerability in a depreciated API of McAfee Enterprise ePolicy Orchestrator (ePO) prior to 5.10 Update 13 allows a remote attacker to change the password of a compromised session without knowing the existing user's password. This functionality was removed from the User Interface in ePO 10 and the API has now been disabled. Other protection is in place to reduce the likelihood of t
e User Interface in ePO 10 and the API has now been disabled. Other protection is in place to reduce the likelihood of this being successful through sending a link to a logged in user. Additional Analyst Notes: - CVE Program Container: References: - https://kc.mcafee.com/corporate/index?page=content&id=SB10379
CVE ID: CVE-2022-0863 State: PUBLISHED Published: 2022-06-13T12:41:37 Last Updated: 2024-08-02T23:40:04.479Z Vendors: Unknown Products: WP SVG Icons Problem Types: CWE-434 Description: The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a30212a0-c910-4657-aee1-4a2d72c77983
CVE ID: CVE-2022-0864 State: PUBLISHED Published: 2022-04-04T15:35:53 Last Updated: 2024-08-02T23:40:04.563Z Vendors: Unknown Products: UpdraftPlus WordPress Backup Plugin Problem Types: CWE-79 Description: The UpdraftPlus WordPress Backup Plugin WordPress plugin before 1.22.9 does not sanitise and escape the updraft_interval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7337543f-4c2c-4365-aebf-3423e9d2f872 - http://packetstormsecurity.com/files/166631/WordPress-UpdraftPlus-Cross-Site-Scripting.html
CVE ID: CVE-2022-0865 State: PUBLISHED Published: 2022-03-07T00:00:00 Last Updated: 2024-08-02T23:40:04.554Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Reachable assertion in libtiff Description: Reachable Assertion in tiffcp in libtiff 4.3.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit 5e180045. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/385 - https://gitlab.com/libtiff/libtiff/-/merge_requests/306 - https://gitlab.com/gitlab-org/cves/-/blob/mas
f/-/issues/385 - https://gitlab.com/libtiff/libtiff/-/merge_requests/306 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0865.json - https://www.debian.org/security/2022/dsa-5108 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZQ4E654ZYUUUQNBKYQFXNK2CV3CPWTM2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNT2GFNRLOMKJ5KXM6JIHKBNBFDVZPD3/ - https://security.gentoo.org/glsa/202210-10 - https://security.netapp.com/advisory/ntap-20221228-0008/
CVE ID: CVE-2022-0866 State: PUBLISHED Published: 2022-05-10T20:20:35 Last Updated: 2024-08-02T23:40:04.505Z Vendors: n/a Products: Wildfly Problem Types: CWE-863 Description: This is a concurrency issue that can result in the wrong caller principal being returned from the session context of an EJB that is configured with a RunAs principal. In particular, the org.jboss.as.ejb3.component.EJBComponent class has an incomingRunAsIdentity field. This field is used by the org.jboss.as.ejb3.security.RunAsPrincipalInterceptor to keep track of the current identity prior to switching to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity fi
to a new identity created using the RunAs principal. The exploit consist that the EJBComponent#incomingRunAsIdentity field is currently just a SecurityIdentity. This means in a concurrent environment, where multiple users are repeatedly invoking an EJB that is configured with a RunAs principal, it's possible for the wrong the caller principal to be returned from EJBComponent#getCallerPrincipal. Similarly, it's also possible for EJBComponent#isCallerInRole to return the wrong value. Both of these methods rely on incomingRunAsIdentity. Affects all versions of JBoss EAP from 7.1.0 and all versions of WildFly 11+ when Elytron is enabled. Additional Analyst Notes: - CVE Program Container: Refere
7.1.0 and all versions of WildFly 11+ when Elytron is enabled. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2060929#c0
CVE ID: CVE-2022-0867 State: PUBLISHED Published: 2022-05-16T14:30:29 Last Updated: 2024-08-02T23:40:04.554Z Vendors: Unknown Products: Pricing Table Plugin Problem Types: CWE-89 Description: The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/62803aae-9896-410b-9398-3497a838e494
CVE ID: CVE-2022-0868 State: PUBLISHED Published: 2022-03-06T15:20:09 Last Updated: 2024-08-02T23:40:04.559Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: medialize Products: medialize/uri.js Problem Types: CWE-601 Description: Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5f4db013-64bd-4a6b-9dad-870c296b0b02 - https://github.com/medialize/uri.js/commit/a8166fe02f3af6dc1b2b888dcbb807155aad9509
CVE ID: CVE-2022-0869 State: PUBLISHED Published: 2022-03-06T09:20:09 Last Updated: 2024-08-02T23:40:04.524Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: nitely Products: nitely/spirit Problem Types: CWE-601 Description: Multiple Open Redirect in GitHub repository nitely/spirit prior to 0.12.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ed335a88-f68c-4e4d-ac85-f29a51b03342 - https://github.com/nitely/spirit/commit/8f32f89654d6c30d56e0dd167059d32146fb32ef
CVE ID: CVE-2022-0870 State: PUBLISHED Published: 2022-03-11T10:40:09 Last Updated: 2024-08-02T23:40:04.563Z Severity: MEDIUM (CVSS 5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: gogs Products: gogs/gogs Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531 - https://github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb
CVE ID: CVE-2022-0871 State: PUBLISHED Published: 2022-03-11T00:00:00 Last Updated: 2024-08-02T23:40:04.494Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: gogs Products: gogs/gogs Problem Types: CWE-862 Description: Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62 - https://github.com/gogs/gogs/commit/64102be2c90e1b47dbdd379873ba76c80d4b0e78
CVE ID: CVE-2022-0873 State: PUBLISHED Published: 2022-05-16T14:30:31 Last Updated: 2024-08-02T23:40:04.561Z Vendors: Unknown Products: Gmedia Photo Gallery Problem Types: CWE-79 Description: The Gmedia Photo Gallery WordPress plugin before 1.20.0 does not sanitise and escape the Album's name before outputting it in pages/posts with a media embed, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered-html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d5ce4b8a-9aa5-4df8-b521-c2105990a87e
CVE ID: CVE-2022-0874 State: PUBLISHED Published: 2022-05-09T16:50:38 Last Updated: 2024-08-02T23:40:04.506Z Vendors: Unknown Products: WP Social Buttons Problem Types: CWE-79 Description: The WP Social Buttons WordPress plugin through 2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/36cdd130-9bb7-4274-bac6-07d00008d810
CVE ID: CVE-2022-0875 State: PUBLISHED Published: 2022-06-27T08:55:54 Last Updated: 2024-08-02T23:40:04.480Z Vendors: Unknown Products: Google Authenticator Problem Types: CWE-352 Description: The Google Authenticator WordPress plugin before 1.0.5 does not have CSRF check when saving its settings, and does not sanitise as well as escape them, allowing attackers to make a logged in admin change them and perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fefc1411-594d-465b-aeb9-78c141b23762
CVE ID: CVE-2022-0876 State: PUBLISHED Published: 2022-04-25T15:51:11 Last Updated: 2024-08-02T23:40:04.574Z Vendors: Unknown Products: Social comments by WpDevArt Problem Types: CWE-79 Description: The Social comments by WpDevArt WordPress plugin before 2.5.0 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/73be6e92-ea37-4416-977d-52ee2afa022a