Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://groups.google.com/g/kubernetes-security-announce/c/iUd550j7kjA - https://github.com/kubernetes/kubernetes/issues/113756 - https://security.netapp.com/advisory/ntap-20230511-0004/
CVE ID: CVE-2022-3165 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T20:12:28.401Z Vendors: n/a Products: QEMU Problem Types: CWE-191 Description: An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/qemu-project/qemu/-/commit/d307040b18 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I36LK
mmit/d307040b18 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I36LKZA7Z65J3LJU2P37LVTWDFTXBMPU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTY7TVHX62OJWF6IOBCIGLR2N5K4QN3E/ - https://security.netapp.com/advisory/ntap-20221223-0006/
CVE ID: CVE-2022-3166 State: PUBLISHED Published: 2022-12-16T19:59:25.261Z Last Updated: 2025-04-17T15:30:27.677Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Rockwell Automation Products: MicroLogix 1100, MicroLogix 1400-B/C, MicroLogix 1400-A Problem Types: CWE-924 Description: Rockwell Automation was made aware that the webservers of the Micrologix 1100 and 1400 controllers contain a vulnerability that may lead to a denial-of-service condition. The security vulnerability could be exploited by an attacker with network access to the affected systems by sending TCP packets to webserver and closing it abruptly which would cause a denial-of-service condition
ted systems by sending TCP packets to webserver and closing it abruptly which would cause a denial-of-service condition for the web server application on the device Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137678
CVE ID: CVE-2022-3167 State: PUBLISHED Published: 2022-09-08T18:35:09 Last Updated: 2024-08-03T01:00:10.609Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-1021 Description: Improper Restriction of Rendered UI Layers or Frames in GitHub repository ikus060/rdiffweb prior to 2.4.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e5c2625b-34cc-4805-8223-80f2689e4e5c - https://github.com/ikus060/rdiffweb/commit/7294bb7466532762c93d711211e5958940c1b428
CVE ID: CVE-2022-3168 State: REJECTED Published: N/A Last Updated: 2023-03-01T00:00:00 Description: No description available.
CVE ID: CVE-2022-3169 State: PUBLISHED Published: 2022-09-09T00:00:00 Last Updated: 2024-08-03T01:00:10.578Z Vendors: n/a Products: Kernel Problem Types: CWE-20 Description: A flaw was found in the Linux kernel. A denial of service flaw may occur if there is a consecutive request of the NVME_IOCTL_RESET and the NVME_IOCTL_SUBSYS_RESET through the device file of the driver, resulting in a PCIe link disconnect. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.kernel.org/show_bug.cgi?id=214771 - https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html
CVE ID: CVE-2022-3170 State: PUBLISHED Published: 2022-09-13T15:36:36 Last Updated: 2024-08-03T01:00:10.503Z Vendors: n/a Products: kernel Problem Types: CWE-125 Description: An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a specially crafted name through ioctl() interface and crash the system or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/6ab55ec0a938c7f943a4edba3d6514f775983887 - https://github.com/torvalds/linux/commit/5934d9a0383619c1
rvalds/linux/commit/6ab55ec0a938c7f943a4edba3d6514f775983887 - https://github.com/torvalds/linux/commit/5934d9a0383619c14df91af8fd76261dc3de2f5f
CVE ID: CVE-2022-3171 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-04-21T13:47:57.569Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: Google LLC Products: Protocolbuffers Problem Types: CWE-20 Description: A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of service attack. Inputs containing multiple instances of non-repeated embedded messages with repeated or unknown fields causes objects to be converted back-n-forth between mutable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versio
utable and immutable forms, resulting in potentially long garbage collection pauses. We recommend updating to the versions mentioned above. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-h4h5-3hr4-j3g2 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3/ - https://security.gentoo.org/glsa/202301-09 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP/
CVE ID: CVE-2022-3172 State: PUBLISHED Published: 2023-11-03T18:11:53.835Z Last Updated: 2025-02-13T16:32:41.378Z Severity: MEDIUM (CVSS 5.1 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Kubernetes Products: kube-apiserver Problem Types: CWE-918 Description: A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could lead to the client performing unexpected actions as well as forwarding the client's API server credentials to third parties. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kubernetes/kubernetes/issues/112513 - https://groups.google.com/g/kubernetes-security-
References: - https://github.com/kubernetes/kubernetes/issues/112513 - https://groups.google.com/g/kubernetes-security-announce/c/_aLzYMpPRak - https://security.netapp.com/advisory/ntap-20231221-0005/
CVE ID: CVE-2022-3173 State: PUBLISHED Published: 2022-09-17T06:50:08 Last Updated: 2024-08-03T01:00:10.627Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-287 Description: Improper Authentication in GitHub repository snipe/snipe-it prior to 6.0.10. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6d8ffcc6-c6e3-4385-8ead-bdbbbacf79e9 - https://github.com/snipe/snipe-it/commit/dcab1381e7ee0b7fd1df3a34750dbff4b79185b2
CVE ID: CVE-2022-3174 State: PUBLISHED Published: 2022-09-13T09:20:16 Last Updated: 2024-08-03T01:00:10.758Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-614 Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d8a32bd6-c76d-4140-a5ca-ef368a3058ce - https://github.com/ikus060/rdiffweb/commit/f2de2371c5e13ce1c6fd6f9a1ed3e5d46b93cd7e
CVE ID: CVE-2022-3175 State: PUBLISHED Published: 2022-09-13T09:20:10 Last Updated: 2024-08-03T01:00:10.532Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-756 Description: Missing Custom Error Page in GitHub repository ikus060/rdiffweb prior to 2.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c40badc3-c9e7-4b69-9e2e-2b9f05865159 - https://github.com/ikus060/rdiffweb/commit/233befc33bdc45d4838c773d5aed4408720504c5
CVE ID: CVE-2022-3176 State: PUBLISHED Published: 2022-09-16T13:55:09.907Z Last Updated: 2025-04-21T13:49:18.998Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-416 Description: There exists a use-after-free in io_uring in the Linux kernel. Signalfd_poll() and binder_poll() use a waitqueue whose lifetime is the current task. It will send a POLLFREE notification to all waiters before the queue is freed. Unfortunately, the io_uring poll doesn't handle POLLFREE. This allows a use-after-free to occur if a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit f
a signalfd or binder fd is polled with io_uring poll, and the waitqueue gets freed. We recommend upgrading past commit fc78b2fc21f10c4c9c4d5d659a685710ffa63659 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kernel.dance/#fc78b2fc21f10c4c9c4d5d659a685710ffa63659 - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit?h=linux-5.4.y&id=fc78b2fc21f10c4c9c4d5d659a685710ffa63659 - https://www.debian.org/security/2022/dsa-5257 - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html - https://security.netapp.com/advisory/ntap-20230216-0003/
CVE ID: CVE-2022-3178 State: PUBLISHED Published: 2022-09-12T16:30:12 Last Updated: 2024-08-03T01:00:10.671Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-126 Description: Buffer Over-read in GitHub repository gpac/gpac prior to 2.1.0-DEV. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f022fc50-3dfd-450a-ab47-3d75d2bf44c0 - https://github.com/gpac/gpac/commit/77510778516803b7f7402d7423c6d6bef50254c3
CVE ID: CVE-2022-3179 State: PUBLISHED Published: 2022-09-13T16:35:09 Last Updated: 2024-08-03T01:00:10.567Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.4.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ikus060/rdiffweb/commit/233befc33bdc45d4838c773d5aed4408720504c5 - https://huntr.dev/bounties/58eae29e-3619-449d-9bba-fdcbabcba5fe
CVE ID: CVE-2022-3180 State: PUBLISHED Published: 2025-02-11T21:38:57.038Z Last Updated: 2025-03-14T17:01:41.718Z Vendors: Jack Hopman Products: WPGateway Problem Types: CWE-290 Description: The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/09/psa-zero-day-vulnerability-in-wpgateway-actively-exploited-in-the-wild/ - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpgateway/wpgateway-35-unauthenticated-privilege-escal
/www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/wpgateway/wpgateway-35-unauthenticated-privilege-escalation
CVE ID: CVE-2022-3181 State: PUBLISHED Published: 2022-11-02T20:11:14.114Z Last Updated: 2025-04-16T16:06:13.490Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Trihedral Products: VTScada Problem Types: CWE-20 Description: An Improper Input Validation vulnerability exists in Trihedral VTScada version 12.0.38 and prior. A specifically malformed HTTP request could cause the affected VTScada to crash. Both local area network (LAN)-only and internet facing systems are affected. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-300-04
CVE ID: CVE-2022-3182 State: PUBLISHED Published: 2022-09-13T19:27:28 Last Updated: 2024-08-03T01:00:10.542Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-284 Description: Improper Access Control vulnerability in the Duo SMS two-factor of Devolutions Remote Desktop Manager 2022.2.14 and earlier allows attackers to bypass the application lock. This issue affects: Devolutions Remote Desktop Manager version 2022.2.14 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://devolutions.net/security/advisories/DEVO-2022-0007
CVE ID: CVE-2022-3183 State: PUBLISHED Published: 2022-12-21T22:24:46.297Z Last Updated: 2025-04-15T19:36:19.949Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dataprobe Products: iBoot-PDU FW Problem Types: CWE-78 Description: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provided by the user, which may expose the affected to an OS command injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03
CVE ID: CVE-2022-3184 State: PUBLISHED Published: 2022-12-21T22:26:26.255Z Last Updated: 2025-04-15T19:35:52.739Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Dataprobe Products: iBoot-PDU FW Problem Types: CWE-22 Description: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated users to access an old PHP page vulnerable to directory traversal, which may allow a user to write a file to the webroot directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03
CVE ID: CVE-2022-3185 State: PUBLISHED Published: 2022-12-21T22:28:05.014Z Last Updated: 2025-04-15T19:34:45.192Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dataprobe Products: iBoot-PDU FW Problem Types: CWE-200 Description: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product exposes sensitive data concerning the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03
CVE ID: CVE-2022-3186 State: PUBLISHED Published: 2022-12-21T22:28:58.579Z Last Updated: 2025-04-15T19:34:02.557Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Dataprobe Products: iBoot-PDU FW Problem Types: CWE-284 Description: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the affected product allows an attacker to access the device’s main management page from the cloud. This feature enables users to remotely connect devices, however, the current implementation permits users to access other device's information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.g
nformation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03
CVE ID: CVE-2022-3187 State: PUBLISHED Published: 2022-12-21T22:29:36.679Z Last Updated: 2025-04-15T19:32:49.187Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dataprobe Products: iBoot-PDU FW Problem Types: CWE-285 Description: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where certain PHP pages only validate when a valid connection is established with the database. However, these PHP pages do not verify the validity of a user. Attackers could leverage this lack of verification to read the state of outlets. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscer
ts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03
CVE ID: CVE-2022-3188 State: PUBLISHED Published: 2022-12-21T22:30:19.937Z Last Updated: 2025-04-15T19:21:30.734Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Dataprobe Products: iBoot-PDU FW Problem Types: CWE-863 Description: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where unauthenticated users could open PHP index pages without authentication and download the history file from the device; the history file includes the latest actions completed by specific users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03
CVE ID: CVE-2022-3189 State: PUBLISHED Published: 2022-12-21T22:30:58.192Z Last Updated: 2025-04-15T17:51:42.720Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Dataprobe Products: iBoot-PDU FW Problem Types: CWE-918 Description: Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specially crafted PHP script could use parameters from a HTTP request to create a URL capable of changing the host parameter. The changed host parameter in the HTTP could point to another host that will send a request to the host or IP specified in the changed host parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
t or IP specified in the changed host parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-03
CVE ID: CVE-2022-3190 State: PUBLISHED Published: 2022-09-13T00:00:00.000Z Last Updated: 2025-11-03T21:46:20.009Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: SharkFest Foundation Products: Wireshark Problem Types: Loop with unreachable exit condition ('infinite loop') in Wireshark Description: Infinite loop in the F5 Ethernet Trailer protocol dissector in Wireshark 3.6.0 to 3.6.7 and 3.4.0 to 3.4.15 allows denial of service via packet injection or crafted capture file Additional Analyst Notes: - CVE Program Container: References: - https://www.wireshark.org/security/wnpa-sec-2022-06.html - https://gitlab.com/wireshark/wireshark/-/issues/18307 - https://g
s://www.wireshark.org/security/wnpa-sec-2022-06.html - https://gitlab.com/wireshark/wireshark/-/issues/18307 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3190.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YR5LIOF5VKS4DC2NQWXTMPPXOYJC46XC/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CH4NUKZKPY4MFQHFBTONJK2AWES4DFDA/
CVE ID: CVE-2022-3191 State: PUBLISHED Published: 2022-11-01T02:09:13.688Z Last Updated: 2025-05-02T18:34:33.877Z Severity: MEDIUM (CVSS 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Hitachi Products: Hitachi Ops Center Analyzer Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File vulnerability in Hitachi Ops Center Analyzer on Linux (Virtual Strage Software Agent component) allows local users to gain sensitive information. This issue affects Hitachi Ops Center Analyzer: from 10.8.1-00 before 10.9.0-00 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/inf
CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2022-134/index.html
CVE ID: CVE-2022-3192 State: PUBLISHED Published: 2023-03-31T16:13:13.149Z Last Updated: 2025-02-11T18:40:07.850Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ABB Products: AC500 V2 Problem Types: CWE-754 Description: Improper Input Validation vulnerability in ABB AC500 V2 PM5xx allows Client-Server Protocol Manipulation.This issue affects AC500 V2: from 2.0.0 before 2.8.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=3ADR011162&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-3193 State: PUBLISHED Published: 2022-09-28T18:01:30.000Z Last Updated: 2025-05-20T20:18:28.559Z Vendors: n/a Products: ovirt-engine Problem Types: CWE-79 Description: An HTML injection/reflected Cross-site scripting (XSS) vulnerability was found in the ovirt-engine. A parameter "error_description" fails to sanitize the entry, allowing the vulnerability to trigger on the Windows Service Accounts home pages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2126353
CVE ID: CVE-2022-3194 State: PUBLISHED Published: 2024-01-16T15:53:36.500Z Last Updated: 2025-06-02T15:10:22.999Z Vendors: Unknown Products: Dokan Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Dokan WordPress plugin before 3.6.4 allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/85e32913-dc2a-44c9-addd-7abde618e995/
CVE ID: CVE-2022-3195 State: PUBLISHED Published: 2022-09-26T00:00:00.000Z Last Updated: 2025-05-22T14:25:23.886Z Vendors: Google Products: Chrome Problem Types: Out of bounds write Description: Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://crbug.com/1358381 - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package
for-desktop_14.html - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-3196 State: PUBLISHED Published: 2022-09-26T00:00:00.000Z Last Updated: 2025-05-21T20:32:19.523Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html - https://crbug.com/1358090 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists
90 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/