Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
erences: - https://starlabs.sg/advisories/22/22-0216/ - https://bugzilla.redhat.com/show_bug.cgi?id=2036953 - https://gitlab.com/qemu-project/qemu/-/issues/972 - https://gitlab.com/qemu-project/qemu/-/commit/4367a20cc4 - https://access.redhat.com/security/cve/CVE-2022-0216 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTY7TVHX62OJWF6IOBCIGLR2N5K4QN3E/
CVE ID: CVE-2022-0217 State: PUBLISHED Published: 2022-08-26T17:25:47 Last Updated: 2024-08-02T23:18:42.807Z Vendors: n/a Products: prosody Problem Types: CWE-776 Description: It was discovered that an internal Prosody library to load XML based on libexpat does not properly restrict the XML features allowed in parsed XML data. Given suitable attacker input, this results in expansion of recursive entity references from DTDs (CWE-776). In addition, depending on the libexpat version used, it may also allow injections using XML External Entity References (CWE-611). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2040639 - https://proso
nalyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2040639 - https://prosody.im/security/advisory_20220113/ - https://prosody.im/security/advisory_20220113/1.patch
CVE ID: CVE-2022-0218 State: PUBLISHED Published: 2022-02-04T22:29:24.000Z Last Updated: 2025-02-10T14:54:50.879Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: codemiq Products: WP HTML Mail Problem Types: CWE-862, CWE-79 Description: The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file, in versions up to and including 3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to
3.0.9. This makes it possible for attackers with no privileges to execute the endpoint and add malicious JavaScript to a vulnerable WordPress site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/01/unauthenticated-xss-vulnerability-patched-in-html-email-template-designer-plugin/ - https://plugins.trac.wordpress.org/changeset/2656984/wp-html-mail/trunk/includes/class-template-designer.php
CVE ID: CVE-2022-0219 State: PUBLISHED Published: 2022-01-20T16:30:11 Last Updated: 2024-08-02T23:18:42.982Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: skylot Products: skylot/jadx Problem Types: CWE-611 Description: Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0d093863-29e8-4dd7-a885-64f76d50bf5e - https://github.com/skylot/jadx/commit/d22db30166e7cb369d72be41382bb63ac8b81c52
CVE ID: CVE-2022-0220 State: PUBLISHED Published: 2022-02-01T12:21:41 Last Updated: 2024-08-02T23:18:42.785Z Vendors: Unknown Products: WordPress GDPR Problem Types: CWE-116 Improper Encoding or Escaping of Output Description: The check_privacy_settings AJAX action of the WordPress GDPR WordPress plugin before 1.9.27, available to both unauthenticated and authenticated users, responds with JSON data without an "application/json" content-type. Since an HTML payload isn't properly escaped, it may be interpreted by a web browser led to this endpoint. Javascript code may be executed on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated use
cuted on a victim's browser. Due to v1.9.26 adding a CSRF check, the XSS is only exploitable against unauthenticated users (as they all share the same nonce) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a91a01b9-7e36-4280-bc50-f6cff3e66059
CVE ID: CVE-2022-0221 State: PUBLISHED Published: 2022-03-28T16:25:26 Last Updated: 2024-08-02T23:18:42.853Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: SCADAPack Workbench Problem Types: CWE-611 Description: A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information disclosure when opening a malicious solution file provided by an attacker with SCADAPack Workbench. This could be exploited to pass data from local files to a remote system controlled by an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior) Additional Analyst Notes: - CVE Program Containe
y an attacker. Affected Product: SCADAPack Workbench (6.6.8a and prior) Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2022-087-01/
CVE ID: CVE-2022-0222 State: PUBLISHED Published: 2022-11-22T00:00:00.000Z Last Updated: 2025-04-29T15:24:51.881Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Schneider Electric Products: Modicon M340 CPUs, Modicon M340 X80 Ethernet Communication modules: BMXNOE0100 (H) BMXNOE0110 (H) BMXNOR0200H RTU Problem Types: CWE-269 Description: A CWE-269: Improper Privilege Management vulnerability exists that could cause a denial of service of the Ethernet communication of the controller when sending a specific request over SNMP. Affected products: Modicon M340 CPUs(BMXP34* versions prior to V3.40), Modicon M340 X80 Ethernet Communication modules:BMXNOE0100 (H), BM
: Modicon M340 CPUs(BMXP34* versions prior to V3.40), Modicon M340 X80 Ethernet Communication modules:BMXNOE0100 (H), BMXNOE0110 (H), BMXNOR0200H RTU(BMXNOE* all versions)(BMXNOR* versions prior to v1.7 IR24) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.se.com/us/en/download/document/SEVD-2022-102-02/
CVE ID: CVE-2022-0223 State: PUBLISHED Published: 2023-01-30T00:00:00.000Z Last Updated: 2025-02-05T20:09:13.271Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Schneider Electric Products: EcoStruxure Power Commission Problem Types: CWE-22 Description: A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could allow an attacker to create or overwrite critical files that are used to execute code, such as programs or libraries and cause unauthenticated code execution. Affected Products: EcoStruxure Power Commission (Versions prior to V2.22) Additional Analyst Notes: - CVE Program Container: - CISA
oducts: EcoStruxure Power Commission (Versions prior to V2.22) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.schneider-electric.com/files?p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2022-165-05_EcoStruxure_Power_Commission_Security_Notification.pdf
CVE ID: CVE-2022-0224 State: PUBLISHED Published: 2022-01-14T17:35:09 Last Updated: 2024-08-02T23:18:42.826Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L) Vendors: dolibarr Products: dolibarr/dolibarr Problem Types: CWE-89 Description: dolibarr is vulnerable to Improper Neutralization of Special Elements used in an SQL Command Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f1d1ce3e-ca92-4c7b-b1b8-934e28eaa486 - https://github.com/dolibarr/dolibarr/commit/b9b45fb50618aa8053961f50bc8604b188d0ea79
CVE ID: CVE-2022-0225 State: PUBLISHED Published: 2022-08-26T17:25:46 Last Updated: 2024-08-02T23:18:42.951Z Vendors: n/a Products: keycloak Problem Types: CWE-79 Description: A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS) attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2040268 - https://github.com/keycloak/keycloak/security/advisories/GHSA-755v-r4x4-qf7m
CVE ID: CVE-2022-0226 State: PUBLISHED Published: 2022-01-14T19:00:11 Last Updated: 2024-08-02T23:18:42.894Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-352 Description: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/635d0abf-7680-47f6-a277-d9a91471c73f - https://github.com/livehelperchat/livehelperchat/commit/f59ffb02984c0ce2fbb19ac39365066507de9370
CVE ID: CVE-2022-0227 State: REJECTED Published: 2022-02-04T22:32:59 Last Updated: 2022-04-04T11:50:09 Description: No description available.
CVE ID: CVE-2022-0228 State: PUBLISHED Published: 2022-02-21T10:46:06 Last Updated: 2024-08-02T23:18:42.904Z Vendors: Unknown Products: Popup Builder – Create highly converting, mobile friendly marketing popups. Problem Types: CWE-89 Description: The Popup Builder WordPress plugin before 4.0.7 does not validate and properly escape the orderby and order parameters before using them in a SQL statement in the admin dashboard, which could allow high privilege users to perform SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2659117 - https://wpscan.com/vulnerability/22facac2-52f4-4e5f-be59-1d2934b260d9
CVE ID: CVE-2022-0229 State: PUBLISHED Published: 2022-03-21T18:55:42 Last Updated: 2024-08-02T23:18:42.888Z Vendors: Unknown Products: miniOrange's Google Authenticator Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The miniOrange's Google Authenticator WordPress plugin before 5.5 does not have proper authorisation and CSRF checks when handling the reconfigureMethod, and does not validate the parameters passed to it properly. As a result, unauthenticated users could delete arbitrary options from the blog, making it unusable. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d70c5335-4c01-44
able. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d70c5335-4c01-448d-85fc-f8e75b104351
CVE ID: CVE-2022-0230 State: PUBLISHED Published: 2022-03-14T14:41:23 Last Updated: 2024-08-02T23:18:42.957Z Vendors: Unknown Products: Better WordPress Google XML Sitemaps (support Sitemap Index, Multi-site and Google News) Problem Types: CWE-79 Description: The Better WordPress Google XML Sitemaps WordPress plugin through 1.4.1 does not sanitise and escape its logs when outputting them in the admin dashboard, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks against admins Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c73316d2-ae6a-42db-935b-b8b03a7e4363
CVE ID: CVE-2022-0231 State: PUBLISHED Published: 2022-01-14T12:05:10 Last Updated: 2024-08-02T23:18:42.876Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-352 Description: livehelperchat is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/adaf98cf-60ab-40e0-aa3b-42ba0d3b7cbf - https://github.com/livehelperchat/livehelperchat/commit/6ad1349dc5e7503b00c5017499a0a895d7654a61
CVE ID: CVE-2022-0232 State: PUBLISHED Published: 2022-01-18T16:52:25.000Z Last Updated: 2025-01-31T18:55:33.845Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: User Registration, Login & Landing Pages – LeadMagic Products: User Registration, Login & Landing Pages – LeadMagic Problem Types: CWE-79 Description: The User Registration, Login & Landing Pages WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the loader_text parameter found in the ~/includes/templates/landing-page.php file which allows attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7. This
s attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.2.7. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0232 - https://github.com/BigTiger2020/2022/blob/main/User%20Registration%20Xss.md - https://plugins.trac.wordpress.org/browser/custom-landing-pages-leadmagic/tags/1.2.6/includes/templates/landing-page.php#L35
CVE ID: CVE-2022-0233 State: PUBLISHED Published: 2022-01-18T16:52:28.000Z Last Updated: 2025-02-13T20:42:23.285Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ProfileGrid – User Profiles, Memberships, Groups and Communities Products: ProfileGrid – User Profiles, Memberships, Groups and Communities Problem Types: CWE-79 Description: The ProfileGrid – User Profiles, Memberships, Groups and Communities WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the pm_user_avatar and pm_cover_image parameters found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such
ers found in the ~/admin/class-profile-magic-admin.php file which allows attackers with authenticated user access, such as subscribers, to inject arbitrary web scripts into their profile, in versions up to and including 1.2.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/BigTiger2020/2022/blob/main/ProfileGrid%20Xss.md - https://plugins.trac.wordpress.org/browser/profilegrid-user-profiles-groups-and-communities/tags/4.7.4/admin/class-profile-magic-admin.php#L961 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0233
CVE ID: CVE-2022-0234 State: PUBLISHED Published: 2022-02-21T10:46:08 Last Updated: 2024-08-02T23:18:42.918Z Vendors: Unknown Products: WOOCS – Currency Switcher for WooCommerce. Professional and Free multi currency plugin – Pay in selected currency Problem Types: CWE-79 Description: The WOOCS WordPress plugin before 1.3.7.5 does not sanitise and escape the woocs_in_order_currency parameter of the woocs_get_products_price_html AJAX action (available to both unauthenticated and authenticated users) before outputting it back in the response, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fd568a1f-bd5
Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fd568a1f-bd51-41bb-960d-f8573b84527b - https://plugins.trac.wordpress.org/changeset/2659191
CVE ID: CVE-2022-0235 State: PUBLISHED Published: 2022-01-16T00:00:00 Last Updated: 2024-08-02T23:18:42.930Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: node-fetch Products: node-fetch/node-fetch Problem Types: CWE-200 Description: node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7 - https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10 - https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf - https://lists.debian.org/debian-lts-announce/2022/12/msg00
ps://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf - https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html
CVE ID: CVE-2022-0236 State: PUBLISHED Published: 2022-01-18T16:52:22.000Z Last Updated: 2025-01-31T18:56:49.316Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: vjinfotech Products: WP Import Export, WP Import Export Lite Problem Types: CWE-862 Description: The WP Import Export WordPress plugin (both free and premium versions) is vulnerable to unauthenticated sensitive data disclosure due to a missing capability check on the download function wpie_process_file_download found in the ~/includes/classes/class-wpie-general.php file. This made it possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which ca
possible for unauthenticated attackers to download any imported or exported information from a vulnerable site which can contain sensitive information like user data. This affects versions up to, and including, 3.9.15. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0236 - https://plugins.trac.wordpress.org/changeset/2649762/wp-import-export-lite/trunk/includes/classes/class-wpie-general.php - https://github.com/qurbat/CVE-2022-0236
CVE ID: CVE-2022-0237 State: PUBLISHED Published: 2022-03-17T22:30:16.553739Z Last Updated: 2024-09-16T20:01:39.262Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Rapid7 Products: Insight Agent Problem Types: CWE-264 Description: Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80. Additional Analyst Notes: - CVE Program Container: References:
ssue was fixed in Rapid7 Insight Agent version 3.1.3.80. Additional Analyst Notes: - CVE Program Container: References: - https://docs.rapid7.com/release-notes/insightagent/20220225/ - https://gist.github.com/n2dez/05d43c616f2b403e84ee55d4d7aab251
CVE ID: CVE-2022-0238 State: PUBLISHED Published: 2022-01-16T10:35:10 Last Updated: 2024-08-02T23:18:42.984Z Severity: MEDIUM (CVSS 4.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N) Vendors: phoronix-test-suite Products: phoronix-test-suite/phoronix-test-suite Problem Types: CWE-352 Description: phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/63f24b24-4af2-47b8-baea-7ad5f4db3633 - https://github.com/phoronix-test-suite/phoronix-test-suite/commit/5755b3bf979cd04caa6feee07e403a5be5ac320e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
caa6feee07e403a5be5ac320e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57V2CSFU5MKWKL6RJUKMXSD4PCRFTMMQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BU7E6OOZCXS3ZWHOQ2AR7MKM56IN2R6R/
CVE ID: CVE-2022-0239 State: PUBLISHED Published: 2022-01-17T06:15:11 Last Updated: 2024-08-23T14:38:48.375Z Severity: MEDIUM (CVSS 4.7 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: stanfordnlp Products: stanfordnlp/corenlp Problem Types: CWE-611 Description: corenlp is vulnerable to Improper Restriction of XML External Entity Reference Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a717aec2-5646-4a5f-ade0-dadc25736ae3 - https://github.com/stanfordnlp/corenlp/commit/1940ffb938dc4f3f5bc5f2a2fd8b35aabbbae3dd
CVE ID: CVE-2022-0240 State: PUBLISHED Published: 2022-01-17T13:35:10 Last Updated: 2024-08-02T23:18:42.889Z Severity: MEDIUM (CVSS 6.2 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-476 Description: mruby is vulnerable to NULL Pointer Dereference Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5857eced-aad9-417d-864e-0bdf17226cbb - https://github.com/mruby/mruby/commit/31fa3304049fc406a201a72293cce140f0557dca
CVE ID: CVE-2022-0242 State: PUBLISHED Published: 2022-01-17T18:15:11 Last Updated: 2024-08-02T23:18:42.888Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: crater-invoice Products: crater-invoice/crater Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/19f3e5f7-b419-44b1-9c37-7e4404cbec94 - https://github.com/crater-invoice/crater/commit/dcb3ddecb9f4cde622cc42c51a2760747797624f
CVE ID: CVE-2022-0243 State: PUBLISHED Published: 2022-01-19T19:20:10 Last Updated: 2024-08-02T23:18:42.966Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:L) Vendors: orchardcms Products: orchardcms/orchardcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/orchardcms/orchardcore/commit/218f25ddfadb66a54de7a82dffe3ab2e4ab7c4b4 - https://huntr.dev/bounties/fa538421-ae55-4288-928f-4e96aaed5803
CVE ID: CVE-2022-0244 State: PUBLISHED Published: 2022-01-18T16:52:00 Last Updated: 2024-08-02T23:18:42.896Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting with 14.5. Arbitrary file read was possible by importing a group was due to incorrect handling of file. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/349524 - https://hackerone.com/reports/1439593 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0244.json
CVE ID: CVE-2022-0245 State: PUBLISHED Published: 2022-01-18T05:15:10 Last Updated: 2024-08-02T23:18:42.847Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository livehelperchat/livehelperchat prior to 2.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6a6aca72-32b7-45b3-a8ba-9b400b2d669c - https://github.com/livehelperchat/livehelperchat/commit/c2fa19afeb8b1ea927fea3fd452515c95f289fb9
CVE ID: CVE-2022-0246 State: PUBLISHED Published: 2022-04-11T14:40:40 Last Updated: 2024-08-02T23:18:42.823Z Vendors: Unknown Products: iQ Block Country Problem Types: CWE-73 Description: The settings of the iQ Block Country WordPress plugin before 1.2.13 can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process, existence of a file is checked. If the file exists, it is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip
is deleted without any security control by only considering the name of the extracted file. This behavior leads to "Zip Slip" vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/892802b1-26e2-4ce1-be6f-71ce29687776
CVE ID: CVE-2022-0247 State: PUBLISHED Published: 2022-02-25T11:10:09.000Z Last Updated: 2025-04-21T13:56:03.802Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) Vendors: Google LLC Products: Fuchsia Problem Types: CWE-732 Description: An issue exists in Fuchsia where VMO data can be modified through access to copy-on-write snapshots. A local attacker could modify objects in the VMO that they do not have permission to. We recommend upgrading past commit d97c05d2301799ed585620a9c5c739d36e7b5d3d or any of the listed versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fuchsia.googlesource.com/fuchsia/+/d97c05d2301799