Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4289 State: PUBLISHED Published: 2023-03-09T00:00:00 Last Updated: 2024-08-03T01:34:50.021Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version 15.9 before 15.9.2. Google IAP details in Prometheus integration were not hidden, could be leaked from instance, group, or project settings to other users. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/384580 - https://ha
Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/384580 - https://hackerone.com/reports/1780770 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4289.json - https://security.netapp.com/advisory/ntap-20240415-0004/
CVE ID: CVE-2022-4290 State: PUBLISHED Published: 2023-10-20T07:29:31.288Z Last Updated: 2024-09-12T14:08:24.110Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: karevn Products: Cyr to Lat enhanced Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The Cyr to Lat plugin for WordPress is vulnerable to authenticated SQL Injection via the 'ctl_sanitize_title' function in versions up to, and including, 3.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This potentially allows authenticated users with the ability to add or
sufficient preparation on the existing SQL query. This potentially allows authenticated users with the ability to add or modify terms or tags to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. A partial patch became available in version 3.6 and the issue was fully patched in version 3.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c9c29130-1b42-4edd-ad62-6f635e03ae31?source=cve - https://plugins.trac.wordpress.org/browser/cyr3lat/trunk/cyr-to-lat.php?rev=1117224#L69
CVE ID: CVE-2022-4291 State: PUBLISHED Published: 2022-12-07T23:45:04.707Z Last Updated: 2025-04-14T17:57:54.578Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: NortonLifelock Products: Avast Antivirus Problem Types: CWE-119 Description: The aswjsflt.dll library from Avast Antivirus windows contained a potentially exploitable heap corruption vulnerability that could enable an attacker to bypass the sandbox of the application it was loaded into, if applicable. This issue was fixed in version 18.0.1478 of the Script Shield Component. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/ex
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE ID: CVE-2022-4292 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-14T17:55:19.634Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.0882. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/da3d4c47-e57a-451e-993d-9df0ed31f57b - https://github.com/vim/vim/commit/c3d27ada14acd02db357f2d16347acc22cb17e93 - https://security.netapp.com/advisory/ntap-20230113-0005/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mess
sory/ntap-20230113-0005/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WYC22GGZ6QA66HLNLHCTAJU265TT3O33/ - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-4293 State: PUBLISHED Published: 2022-12-05T00:00:00.000Z Last Updated: 2025-04-14T17:56:49.676Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-1077 Description: Floating Point Comparison with Incorrect Operator in GitHub repository vim/vim prior to 9.0.0804. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/385a835f-6e33-4d00-acce-ac99f3939143 - https://github.com/vim/vim/commit/cdef1cefa2a440911c727558562f83ed9b00e16b - https://security.netapp.com/advisory/ntap-20230203-0007/ - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-4294 State: PUBLISHED Published: 2023-01-10T09:14:47.102Z Last Updated: 2025-04-08T14:54:30.415Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: NortonLifelock (GenDigital) Products: Norton Antivirus Windows Eraser Engine, Avira Security , Avast Antivirus, AVG Antivirus Problem Types: CWE-269 Description: Norton, Avira, Avast and AVG Antivirus for Windows may be susceptible to a Privilege Escalation vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated access to resources that are normally protected from an application or user. Additional Analyst Notes: - CVE Program Con
access to resources that are normally protected from an application or user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE ID: CVE-2022-4295 State: PUBLISHED Published: 2023-01-16T15:38:09.605Z Last Updated: 2025-04-08T20:12:17.343Z Vendors: Unknown Products: Show All Comments Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Show All Comments WordPress plugin before 7.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a logged in high privilege users such as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4ced1a4d-0c1f-42ad-8473-241c68b92b56
CVE ID: CVE-2022-4296 State: PUBLISHED Published: 2022-12-06T00:00:00.000Z Last Updated: 2025-04-15T13:08:37.367Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: TP-Link Products: TL-WR740N Problem Types: CWE-404 Description: A vulnerability classified as problematic has been found in TP-Link TL-WR740N. Affected is an unknown function of the component ARP Handler. The manipulation leads to resource consumption. The attack needs to be done within the local network. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214812. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
of this vulnerability is VDB-214812. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.youtube.com/watch?v=D--fb-cesmA - https://vuldb.com/?id.214812
CVE ID: CVE-2022-4297 State: PUBLISHED Published: 2023-01-02T21:49:08.397Z Last Updated: 2025-04-11T13:39:48.376Z Vendors: Unknown Products: WP AutoComplete Search Problem Types: CWE-89 SQL Injection Description: The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users, leading to an unauthenticated SQL injection Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e2dcc76c-65ac-4cd6-a5c9-6d813b5ac26d - http://packetstormsecurity.com/files/173293/WordPress-WP-AutoComplete-Search-1.0.4-SQL-Injection.ht
-a5c9-6d813b5ac26d - http://packetstormsecurity.com/files/173293/WordPress-WP-AutoComplete-Search-1.0.4-SQL-Injection.html
CVE ID: CVE-2022-4298 State: PUBLISHED Published: 2023-01-02T21:49:31.907Z Last Updated: 2025-04-10T18:40:15.104Z Vendors: Unknown Products: Wholesale Market Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Wholesale Market WordPress plugin before 2.2.1 does not have authorisation check, as well as does not validate user input used to generate system path, allowing unauthenticated attackers to download arbitrary file from the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7485ad23-6ea4-4018-88b1-174312a0a478
CVE ID: CVE-2022-4299 State: PUBLISHED Published: 2023-01-16T15:38:12.110Z Last Updated: 2025-04-04T20:25:59.005Z Vendors: Unknown Products: Metricool Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Metricool WordPress plugin before 1.18 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/169c5611-ed10-4cc3-bd07-09b365adf303
CVE ID: CVE-2022-4300 State: PUBLISHED Published: 2022-12-06T00:00:00.000Z Last Updated: 2025-04-15T13:08:28.689Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: FastCMS Problem Types: CWE-707 Description: A vulnerability was found in FastCMS. It has been rated as critical. This issue affects some unknown processing of the file /template/edit of the component Template Handler. The manipulation leads to injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-214901 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
ntifier VDB-214901 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Ha0Liu/cveAdd/blob/developer/fastcms%E6%A8%A1%E7%89%88%E6%B3%A8%E5%85%A5/fastcms%20template%20injection%20vulnerability.md - https://vuldb.com/?id.214901
CVE ID: CVE-2022-4301 State: PUBLISHED Published: 2023-01-09T22:13:37.475Z Last Updated: 2025-04-09T19:19:48.209Z Vendors: Unknown Products: Sunshine Photo Cart Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Sunshine Photo Cart WordPress plugin before 2.9.15 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a8dca528-fb70-44f3-8149-21385039179d
CVE ID: CVE-2022-4302 State: PUBLISHED Published: 2023-01-02T21:49:18.707Z Last Updated: 2025-04-10T18:59:42.356Z Vendors: Unknown Products: White Label CMS Problem Types: CWE-502 Deserialization of Untrusted Data Description: The White Label CMS WordPress plugin before 2.5 unserializes user input provided via the settings, which could allow high-privilege users such as admin to perform PHP Object Injection when a suitable gadget is present. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b7707a15-0987-4051-a8ac-7be2424bcb01
CVE ID: CVE-2022-4303 State: PUBLISHED Published: 2023-01-23T14:31:49.652Z Last Updated: 2025-04-02T14:51:02.032Z Vendors: Unknown Products: WP Limit Login Attempts Problem Types: CWE-290 Authentication Bypass by Spoofing Description: The WP Limit Login Attempts WordPress plugin through 2.6.4 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based restrictions on login forms. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8428a5e1-dbef-4516-983f-f95605c6dd09
CVE ID: CVE-2022-4304 State: PUBLISHED Published: 2023-02-08T19:04:28.890Z Last Updated: 2025-11-04T19:14:12.161Z Vendors: OpenSSL Products: OpenSSL Problem Types: timing based side channel attack Description: A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack. To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-mast
5, RSA-OEAP and RSASVE. For example, in a TLS connection, RSA is commonly used by a client to send an encrypted pre-master secret to the server. An attacker that had observed a genuine connection between a client and a server could use this flaw to send trial messages to the server and record the time taken to process them. After a sufficiently large number of messages the attacker could recover the pre-master secret used for the original connection and thus be able to decrypt the application data sent over that connection. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://security.gentoo.org/g
- CISA ADP Vulnrichment: References: - https://www.openssl.org/news/secadv/20230207.txt - https://security.gentoo.org/glsa/202402-08
CVE ID: CVE-2022-4305 State: PUBLISHED Published: 2023-01-23T14:31:57.132Z Last Updated: 2025-04-03T19:19:19.996Z Vendors: Unknown Products: Login as User or Customer Problem Types: CWE-269 Improper Privilege Management Description: The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/286d972d-7bda-455c-a226-fd9ce5f925bd
CVE ID: CVE-2022-4306 State: PUBLISHED Published: 2023-01-30T20:31:30.627Z Last Updated: 2025-03-27T20:43:15.489Z Vendors: Unknown Products: Panda Pods Repeater Field Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Panda Pods Repeater Field WordPress plugin before 1.5.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against a user having at least Contributor permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/18d7f9af-7267-4723-9d6f-05b895c94dbe
CVE ID: CVE-2022-4307 State: PUBLISHED Published: 2023-01-23T14:31:29.119Z Last Updated: 2025-04-02T15:24:55.434Z Vendors: Unknown Products: پلاگین پرداخت دلخواه Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The پلاگین پرداخت دلخواه WordPress plugin before 2.9.3 does not sanitise and escape some parameters, allowing unauthenticated attackers to send a request with XSS payloads, which will be triggered when a high privilege users such as admin visits a page from the plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4000ba69-d73f-4c5b-a299-82898304cebb
CVE ID: CVE-2022-4308 State: PUBLISHED Published: 2023-04-19T11:56:32.348Z Last Updated: 2025-02-05T15:05:16.492Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Secomea Products: GateManager Problem Types: CWE-256 Description: Plaintext Storage of a Password vulnerability in Secomea GateManager (USB wizard) allows Authentication abuse on SiteManager, if the generated file is leaked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.secomea.com/support/cybersecurity-advisory/
CVE ID: CVE-2022-4309 State: PUBLISHED Published: 2023-01-16T15:38:10.531Z Last Updated: 2025-04-07T16:49:44.016Z Vendors: Unknown Products: Subscribe2 Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Subscribe2 WordPress plugin before 10.38 does not have CSRF check when deleting users, which could allow attackers to make a logged in admin delete arbitrary users by knowing their email via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1965f53d-c94e-4322-9059-49de69df1051
CVE ID: CVE-2022-4310 State: PUBLISHED Published: 2023-01-09T22:13:26.488Z Last Updated: 2025-04-09T19:23:59.359Z Vendors: Unknown Products: Slimstat Analytics Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Slimstat Analytics WordPress plugin before 4.9.3 does not sanitise and escape the URI when logging requests, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against logged in admin viewing the logs Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b1aef75d-0c84-4702-83fc-11f0e98a0821
CVE ID: CVE-2022-4311 State: PUBLISHED Published: 2022-12-12T17:08:30.847Z Last Updated: 2025-04-14T17:59:59.779Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ARC Informatique Products: PcVue Problem Types: CWE-532 Description: An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This could allow a user with access to the log files to discover connection strings of data sources configured for the DbConnect, which could include credentials. Successful exploitation of this vulnerability could allow other users unauthorized access to the underlying data sources. Additional Analyst Notes: - CVE Program
ity could allow other users unauthorized access to the underlying data sources. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1165-security-bulletin-2022-6
CVE ID: CVE-2022-4312 State: PUBLISHED Published: 2022-12-12T17:10:22.202Z Last Updated: 2025-04-14T18:00:16.760Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: ARC Informatique Products: PcVue Problem Types: CWE-312 Description: A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could allow an unauthorized user with access the email and short messaging service (SMS) accounts configuration files to discover the associated simple mail transfer protocol (SMTP) account credentials and the SIM card PIN code. Successful exploitation of this vulnerability could allow an unauthorized user access to the und
the SIM card PIN code. Successful exploitation of this vulnerability could allow an unauthorized user access to the underlying email account and SIM card. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.pcvuesolutions.com/support/index.php/en/security-bulletin/1171-security-bulletin-2022-7
CVE ID: CVE-2022-4313 State: PUBLISHED Published: 2023-03-15T00:00:00.000Z Last Updated: 2025-02-27T18:35:57.540Z Vendors: n/a Products: Tenable.io, Tenable.sc and Nessus Problem Types: Remote Code Execution Description: A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, could manipulate audit policy variables to execute arbitrary commands on credentialed scan targets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/tns-2023-14
CVE ID: CVE-2022-4314 State: PUBLISHED Published: 2022-12-06T00:00:00.000Z Last Updated: 2025-04-14T17:57:21.110Z Severity: MEDIUM (CVSS 6 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-269 Description: Improper Privilege Management in GitHub repository ikus060/rdiffweb prior to 2.5.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b2dc504d-92ae-4221-a096-12ff223d95a8 - https://github.com/ikus060/rdiffweb/commit/b2df3679564d0daa2856213bb307d3e34bd89a25
CVE ID: CVE-2022-4315 State: PUBLISHED Published: 2023-03-08T00:00:00.000Z Last Updated: 2025-03-04T15:58:11.641Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headers with every request on the authentication page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/384995 - https://hackerone.com/reports/1767525 - https://gitlab.com/gitlab-org/cves/-/blob/maste
lab-org/gitlab/-/issues/384995 - https://hackerone.com/reports/1767525 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4315.json
CVE ID: CVE-2022-4317 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-02-28T17:26:25.536Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: DAST Problem Types: Information exposure in DAST Description: An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request headers in redirects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/384997 - https://hackerone.com/reports/1767533 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4317.json
CVE ID: CVE-2022-4318 State: PUBLISHED Published: 2023-09-25T19:23:02.119Z Last Updated: 2024-08-03T01:34:50.124Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.11, Red Hat OpenShift Container Platform 4.12, Red Hat Enterprise Linux 9 Problem Types: CWE-538 Description: A vulnerability was found in cri-o. This issue allows the addition of arbitrary lines into /etc/passwd by use of a specially crafted environment variable. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:1033 - https://access.redhat.com/errata/RHSA-2023:1
Container: References: - https://access.redhat.com/errata/RHSA-2023:1033 - https://access.redhat.com/errata/RHSA-2023:1503 - https://access.redhat.com/security/cve/CVE-2022-4318 - https://bugzilla.redhat.com/show_bug.cgi?id=2152703
CVE ID: CVE-2022-4320 State: PUBLISHED Published: 2023-01-16T15:37:53.536Z Last Updated: 2025-04-04T18:15:02.876Z Vendors: Unknown Products: WordPress Events Calendar Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f1244c57-d886-4a6e-8cdb-18404e8c153c
CVE ID: CVE-2022-4321 State: PUBLISHED Published: 2023-02-06T19:59:27.705Z Last Updated: 2025-03-26T18:35:27.548Z Vendors: Unknown Products: PDF Generator for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The PDF Generator for WordPress plugin before 1.1.2 includes a vendored dompdf example file which is susceptible to Reflected Cross-Site Scripting and could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6ac1259c-86d9-428b-ba98-7f3d07910644