Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3067 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T16:05:44.923Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in the Import functionality of GitLab CE/EE affecting all versions starting from 14.4 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1. It was possible for an authenticated user to read arbitrary projects' content given the project's ID. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
ent given the project's ID. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/372165 - https://hackerone.com/reports/1685822 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3067.json
CVE ID: CVE-2022-3068 State: PUBLISHED Published: 2022-09-21T11:55:09.000Z Last Updated: 2025-05-28T15:21:53.799Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: octoprint Products: octoprint/octoprint Problem Types: CWE-269 Description: Improper Privilege Management in GitHub repository octoprint/octoprint prior to 1.8.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f45c24cb-9104-4c6e-a9e1-5c7e75e83884 - https://github.com/octoprint/octoprint/commit/ef95ef1c101b79394f134e8fce000e6bae046571
CVE ID: CVE-2022-3069 State: PUBLISHED Published: 2022-09-26T12:35:39.000Z Last Updated: 2025-05-22T14:06:02.674Z Vendors: Unknown Products: WordLift – AI powered SEO – Schema Problem Types: CWE-79 Description: The WordLift WordPress plugin before 3.37.2 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a9918dfd-389c-43eb-afcc-03d29b42b369
CVE ID: CVE-2022-3070 State: PUBLISHED Published: 2022-09-26T12:35:40.000Z Last Updated: 2025-05-22T14:04:50.201Z Vendors: Unknown Products: Generate PDF using Contact Form 7 Problem Types: CWE-79 Description: The Generate PDF WordPress plugin before 3.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cd8d71d1-030e-4ad4-866e-75d242883c6c
CVE ID: CVE-2022-3071 State: PUBLISHED Published: 2022-09-26T15:01:37.000Z Last Updated: 2025-05-21T15:18:24.129Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted UI interaction. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/08/stable-channel-update-for-desktop_30.html - https://crbug.com/1333995 - https://security.gentoo.org/glsa/202209-23 - https://lists.fe
l-update-for-desktop_30.html - https://crbug.com/1333995 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-3072 State: PUBLISHED Published: 2022-09-01T07:30:12 Last Updated: 2024-08-03T01:00:10.776Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: francoisjacquet Products: francoisjacquet/rosariosis Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 8.9.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9755ae6a-b08b-40a0-8089-c723b2d9ca52 - https://github.com/francoisjacquet/rosariosis/commit/dcd3b86156bf9e981944e1a9e01ea23d8ad7c83a
CVE ID: CVE-2022-3073 State: PUBLISHED Published: 2022-12-14T08:17:08.816Z Last Updated: 2025-04-17T20:21:13.344Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Quanos Products: Schema ST4 example web templates Problem Types: CWE-79 Description: Quanos "SCHEMA ST4" example web templates in version Bootstrap 2019 v2/2021 v1/2022 v1/2022 SP1 v1 or below are prone to JavaScript injection allowing a remote attacker to hijack existing sessions to e.g. other web services in the same environment or execute scripts in the users browser environment. The affected script is '*-schema.js'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
. The affected script is '*-schema.js'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/de/advisories/VDE-2022-056/
CVE ID: CVE-2022-3074 State: PUBLISHED Published: 2022-09-26T12:35:41.000Z Last Updated: 2025-05-22T14:04:06.028Z Vendors: Unknown Products: Slider Hero with Animation, Video Background Problem Types: CWE-79 Description: The Slider Hero WordPress plugin before 8.4.4 does not escape the slider Name, which could allow high-privileged users to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/90ebaedc-89df-413f-b22e-753d4dd5e1c3
CVE ID: CVE-2022-3075 State: PUBLISHED Published: 2022-09-26T15:01:38.000Z Last Updated: 2025-10-21T23:15:34.094Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://crbug.com/1358134 - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop.html - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/arch
able-channel-update-for-desktop.html - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-3076 State: PUBLISHED Published: 2022-09-26T12:35:42.000Z Last Updated: 2025-05-22T15:41:20.288Z Vendors: Unknown Products: CM Download Manager Problem Types: CWE-434 Description: The CM Download Manager WordPress plugin before 2.8.6 allows high privilege users such as admin to upload arbitrary files by setting the any extension via the plugin's setting, which could be used by admins of multisite blog to upload PHP files for example. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d18e695b-4d6e-4ff6-a060-312594a0d2bd
CVE ID: CVE-2022-3077 State: PUBLISHED Published: 2022-09-09T14:39:54 Last Updated: 2024-08-03T01:00:10.711Z Vendors: n/a Products: kernel Problem Types: CWE-120 Description: A buffer overflow vulnerability was found in the Linux kernel Intel’s iSMT SMBus host controller driver in the way it handled the I2C_SMBUS_BLOCK_PROC_CALL case (via the ioctl I2C_SMBUS) with malicious input data. This flaw could allow a local user to crash the system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/690b2549b19563ec5ad53e5c82f6a944d910086e
CVE ID: CVE-2022-3078 State: PUBLISHED Published: 2022-09-01T20:52:56 Last Updated: 2024-08-03T01:00:10.691Z Vendors: n/a Products: Kernel Problem Types: CWE-476 Description: An issue was discovered in the Linux kernel through 5.16-rc6. There is a lack of check after calling vzalloc() and lack of free after allocation in drivers/media/test-drivers/vidtv/vidtv_s302m.c. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v5.19-rc2&id=e6a21a14106d9718aa4f8e115b1e474888eeba44
CVE ID: CVE-2022-3079 State: PUBLISHED Published: 2022-09-20T10:10:17.000Z Last Updated: 2025-05-29T14:09:35.704Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: FESTO Products: Control block CPX-CEC-C1 (no. 567347), Control block CPX-CMXX (no. 555667) Problem Types: CWE-269 Description: Festo control block CPX-CEC-C1 and CPX-CMXX in multiple versions allow unauthenticated, remote access to critical webpage functions which may cause a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-036
CVE ID: CVE-2022-3080 State: PUBLISHED Published: 2022-09-21T10:15:29.861874Z Last Updated: 2024-09-17T01:56:40.440Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: In BIND 9.16.14 -> 9.16.32, 9.18.0 -> 9.18.6, versions 9.16.14-S1 -> 9.16.32-S1 of the BIND Supported Preview Edition, and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, a BIND 9 resolver can crash when stale cache and stale answers are enabled, option stale-answer-client-timeout is set to 0 and there is a stale CNAME in the cache for an incoming query. Description: By sending specific queries to the resolver, an attacker can cause named to crash.
for an incoming query. Description: By sending specific queries to the resolver, an attacker can cause named to crash. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://kb.isc.org/docs/cve-2022-3080 - http://www.openwall.com/lists/oss-security/2022/09/21/3 - https://www.debian.org/security/2022/dsa-5235 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CV4GQWBPF7Y52J2FA24U6UMHQAOXZEF7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap
ssage/MRHB6J4Z7BKH4HPEKG5D35QGRD6ANNMT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YZJQNUASODNVAWZV6STKG5SD6XIJ446S/ - https://security.gentoo.org/glsa/202210-25 - https://security.netapp.com/advisory/ntap-20240621-0002/
CVE ID: CVE-2022-3082 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T15:58:45.218Z Vendors: Unknown Products: miniOrange Discord Integration Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The miniOrange Discord Integration WordPress plugin before 2.1.6 does not have authorisation and CSRF in some of its AJAX actions, allowing any logged in users, such as subscriber to call them, and disable the app for example Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a91d0501-c2a9-4c6c-b5da-b3fc29442a4f
CVE ID: CVE-2022-3083 State: PUBLISHED Published: 2023-02-01T20:51:54.498Z Last Updated: 2025-01-16T21:58:19.964Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L) Vendors: Landis+Gyr Products: E850 (ZMQ200) Problem Types: CWE-784 Description: All versions of Landis+Gyr E850 (ZMQ200) are vulnerable to CWE-784: Reliance on Cookies Without Validation and Integrity. The device's web application navigation depends on the value of the session cookie. The web application could become inaccessible for the user if an attacker changes the cookie values. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisor
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-026-07
CVE ID: CVE-2022-3084 State: PUBLISHED Published: 2022-12-07T23:00:22.514Z Last Updated: 2025-04-16T17:41:02.767Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GE Products: CIMPLICITY Problem Types: CWE-824 Description: GE CIMPICITY versions 2022 and prior is vulnerable when data from a faulting address controls code flow starting at gmmiObj!CGmmiRootOptionTable, which could allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04
CVE ID: CVE-2022-3085 State: PUBLISHED Published: 2023-01-18T23:22:02.789Z Last Updated: 2025-01-16T21:59:24.907Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Tellus Lite V-Simulator Problem Types: CWE-121 Description: Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-354-01
CVE ID: CVE-2022-3086 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-16T17:42:11.399Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Cradlepoint Products: IBR600 Problem Types: CWE-77 Description: Cradlepoint IBR600 NCOS versions 6.5.0.160bc2e and prior are vulnerable to shell escape, which enables local attackers with non-superuser credentials to gain full, unrestrictive shell access which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-02
CVE ID: CVE-2022-3087 State: PUBLISHED Published: 2023-01-16T23:46:24.860Z Last Updated: 2025-01-16T22:01:32.300Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Fuji Electric Products: Tellus Lite V-Simulator Problem Types: CWE-787 Description: Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-354-01
CVE ID: CVE-2022-3088 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-16T17:42:25.272Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Moxa Products: UC-8100A-ME-T System Imaage, UC-2100 System Image, UC-2100-W System Image, UC-3100 System Image, UC-5100 System Image, UC-8100 System Image, UC-8100-ME-T System Image, UC-8200 System Image, AIG-300 System Image, UC-8410A with Debian 9 System Image, UC-8580 with Debian 9 System Image, UC-8540 with Debian 9 System Image, DA-662C-16-LX (GLB) System Image Problem Types: CWE-250 Description: UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2
E-250 Description: UC-8100A-ME-T System Image: Versions v1.0 to v1.6, UC-2100 System Image: Versions v1.0 to v1.12, UC-2100-W System Image: Versions v1.0 to v 1.12,&nbsp;UC-3100 System Image: Versions v1.0 to v1.6,&nbsp;UC-5100 System Image: Versions v1.0 to v1.4, UC-8100 System Image: Versions v3.0 to v3.5, UC-8100-ME-T System Image: Versions v3.0 and v3.1, UC-8200 System Image: v1.0 to v1.5, AIG-300 System Image: v1.0 to v1.4, UC-8410A with Debian 9 System Image: Versions v4.0.2 and v4.1.2, UC-8580 with Debian 9 System Image: Versions v2.0 and v2.1, UC-8540 with Debian 9 System Image: Versions v2.0 and v2.1, and DA-662C-16-LX (GLB) System Image: Versions v1.0.2 to v1.1.2 of Moxa's ARM-base
System Image: Versions v2.0 and v2.1, and DA-662C-16-LX (GLB) System Image: Versions v1.0.2 to v1.1.2 of Moxa's ARM-based computers have an execution with unnecessary privileges vulnerability, which could allow an attacker with user-level privileges to gain root privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-05
CVE ID: CVE-2022-3089 State: PUBLISHED Published: 2023-02-13T16:28:57.920Z Last Updated: 2025-01-16T21:57:29.500Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H) Vendors: EnOcean Products: Smartserver Problem Types: CWE-798 Description: Echelon SmartServer 2.2 with i.LON Vision 2.2 stores cleartext credentials in a file, which could allow an attacker to obtain cleartext usernames and passwords of the SmartServer. If the attacker obtains the file, then the credentials could be used to control the web user interface and file transfer protocol (FTP) server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/usc
rver. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-037-01
CVE ID: CVE-2022-3090 State: PUBLISHED Published: 2022-11-17T21:55:37.791Z Last Updated: 2025-04-16T16:06:05.099Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Red Lion Controls Products: Crimson 3.0, Crimson 3.1, Crimson 3.2 Problem Types: CWE-22 Description: Red Lion Controls Crimson 3.0 versions 707.000 and prior, Crimson 3.1 versions 3126.001 and prior, and Crimson 3.2 versions 3.2.0044.0 and prior are vulnerable to path traversal. When attempting to open a file using a specific path, the user's password hash is sent to an arbitrary host. This could allow an attacker to obtain user credential hashes. Additional Analyst Notes: - CVE Program Container: - C
t. This could allow an attacker to obtain user credential hashes. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-321-01
CVE ID: CVE-2022-3091 State: PUBLISHED Published: 2023-01-17T16:21:57.537Z Last Updated: 2025-01-16T22:01:20.020Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: RONDS Products: Equipment Predictive Maintenance Solution Problem Types: CWE-200 Description: RONDS EPM version 1.19.5 has a vulnerability in which a function could allow unauthenticated users to leak credentials. In some circumstances, an attacker can exploit this vulnerability to execute operating system (OS) commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02
CVE ID: CVE-2022-3092 State: PUBLISHED Published: 2022-12-07T23:01:34.391Z Last Updated: 2025-04-16T17:40:47.032Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: GE Products: CIMPLICITY Problem Types: CWE-787 Description: GE CIMPICITY versions 2022 and prior is vulnerable to an out-of-bounds write, which could allow an attacker to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-326-04
CVE ID: CVE-2022-3093 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T16:35:03.426Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Tesla Products: Model 3 Problem Types: CWE-367 Description: This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ice_updater update mechanism. The issue results from the lack of proper validation of user-supplied firmware. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463. Additional Analyst Notes: - CVE Prog
erage this vulnerability to execute code in the context of root. Was ZDI-CAN-17463. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1188/
CVE ID: CVE-2022-3094 State: PUBLISHED Published: 2023-01-25T21:34:52.983Z Last Updated: 2025-04-01T13:48:37.944Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND 9 Problem Types: n/a Description: Sending a flood of dynamic DNS updates may cause `named` to allocate large amounts of memory. This, in turn, may cause `named` to exit due to a lack of free memory. We are not aware of any cases where this has been exploited. Memory is allocated prior to the checking of access permissions (ACLs) and is retained during the processing of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not perm
g of a dynamic update from a client whose access credentials are accepted. Memory allocated to clients that are not permitted to send updates is released immediately upon rejection. The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes. If a dynamic update is REFUSED, memory will be released again very quickly. Therefore it is only likely to be possible to degrade or stop `named` by sending a flood of unaccepted dynamic updates comparable in magnitude to a query flood intended to achieve the same detrimental outcome. BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memor
utcome. BIND 9.11 and earlier branches are also affected, but through exhaustion of internal resources rather than memory constraints. This may reduce performance but should not be a significant problem for most servers. Therefore we don't intend to address this for BIND versions prior to BIND 9.16. This issue affects BIND 9 versions 9.16.0 through 9.16.36, 9.18.0 through 9.18.10, 9.19.0 through 9.19.8, and 9.16.8-S1 through 9.16.36-S1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.isc.org/docs/cve-2022-3094
CVE ID: CVE-2022-3095 State: PUBLISHED Published: 2022-10-27T00:00:00.000Z Last Updated: 2025-04-21T13:47:41.466Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Google LLC Products: Dart Problem Types: CWE-20 Description: The implementation of backslash parsing in the Dart URI class for versions prior to 2.18 and Flutter versions prior to 3.30 differs from the WhatWG URL standards. Dart uses the RFC 3986 syntax, which creates incompatibilities with the '\' characters in URIs, which can lead to auth bypass in webapps interpreting URIs. We recommend updating Dart or Flutter to mitigate the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP
recommend updating Dart or Flutter to mitigate the issue. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dart-lang/sdk/blob/master/CHANGELOG.md#2182---2022-09-28
CVE ID: CVE-2022-3096 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T15:46:38.482Z Vendors: Unknown Products: WP Total Hacks Problem Types: CWE-862, CWE-79 Description: The WP Total Hacks WordPress plugin through 4.7.2 does not prevent low privilege users from modifying the plugin's settings. This could allow users such as subscribers to perform Stored Cross-Site Scripting attacks against other users, like administrators, due to the lack of sanitisation and escaping as well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/46996537-a874-4b2e-9cd7-7d0832f9704d