Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
organization-wide projects. Resources associated with repositories were not impacted, such as repository file content, repository-specific projects, issues, or pull requests. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.7.1 and was fixed in versions 3.3.16, 3.4.11, 3.5.8, 3.6.4, 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1 - https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.16 - https://docs.github.com/en/enterprise-server%403.4/admin/relea
m/en/enterprise-server%403.3/admin/release-notes#3.3.16 - https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.11 - https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.8 - https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.4
CVE ID: CVE-2022-23740 State: PUBLISHED Published: 2022-11-23T00:00:00.000Z Last Updated: 2025-04-28T14:18:58.847Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-88 Description: CRITICAL: An improper neutralization of argument delimiters in a command vulnerability was identified in GitHub Enterprise Server that enabled remote code execution. To exploit this vulnerability, an attacker would need permission to create and build GitHub Pages using GitHub Actions. This vulnerability affected only version 3.7.0 of GitHub Enterprise Server and was fixed in version 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program
ersion 3.7.1. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server%403.7/admin/release-notes#3.7.1
CVE ID: CVE-2022-23741 State: PUBLISHED Published: 2022-12-14T00:00:00.000Z Last Updated: 2025-04-22T16:09:01.149Z Vendors: GitHub Products: GitHub Enterprise Server Problem Types: CWE-863 Description: An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed a scoped user-to-server token to escalate to full admin/owner privileges. An attacker would require an account with admin access to install a malicious GitHub App. This vulnerability was fixed in versions 3.3.17, 3.4.12, 3.5.9, and 3.6.5. This vulnerability was reported via the GitHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
tHub Bug Bounty program. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.github.com/en/enterprise-server%403.3/admin/release-notes#3.3.17 - https://docs.github.com/en/enterprise-server%403.4/admin/release-notes#3.4.12 - https://docs.github.com/en/enterprise-server%403.5/admin/release-notes#3.5.9 - https://docs.github.com/en/enterprise-server%403.6/admin/release-notes#3.6.5
CVE ID: CVE-2022-23742 State: PUBLISHED Published: 2022-05-12T19:23:18 Last Updated: 2024-08-03T03:51:46.018Z Vendors: n/a Products: Check Point Endpoint Security Client for Windows Problem Types: CWE-65 Description: Check Point Endpoint Security Client for Windows versions earlier than E86.40 copy files for forensics reports from a directory with low privileges. An attacker can replace those files with malicious or linked content, such as exploiting CVE-2020-0896 on unpatched systems or using symbolic links. Additional Analyst Notes: - CVE Program Container: References: - https://supportcontent.checkpoint.com/solutions?id=sk178665%2C - https://supportcontent.checkpoint.com/solutions?id=sk17
https://supportcontent.checkpoint.com/solutions?id=sk178665%2C - https://supportcontent.checkpoint.com/solutions?id=sk179132
CVE ID: CVE-2022-23743 State: PUBLISHED Published: 2022-05-11T00:00:00 Last Updated: 2024-08-03T03:51:45.917Z Vendors: n/a Products: ZoneAlarm. Problem Types: CWE-269 Description: Check Point ZoneAlarm before version 15.8.200.19118 allows a local actor to escalate privileges during the upgrade process. In addition, weak permissions in the ProgramData\CheckPoint\ZoneAlarm\Data\Updates directory allow a local attacker the ability to execute an arbitrary file write, leading to execution of code as local system, in ZoneAlarm versions before v15.8.211.192119 Additional Analyst Notes: - CVE Program Container: References: - https://www.zonealarm.com/software/extreme-security/release-history
CVE ID: CVE-2022-23744 State: PUBLISHED Published: 2022-07-07T15:51:44 Last Updated: 2024-08-03T03:51:45.906Z Vendors: n/a Products: Enterprise Endpoint Security Windows Clients. Problem Types: CWE-470 Description: Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection by a local administrator. Additional Analyst Notes: - CVE Program Container: References: - https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk179609
CVE ID: CVE-2022-23745 State: PUBLISHED Published: 2022-07-18T16:09:20 Last Updated: 2024-08-03T03:51:45.916Z Vendors: n/a Products: Checkpoint Harmony Capsule Workspace Problem Types: CWE-1218 Description: A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). This could result in application crashing but could not be used to gather any sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk179646
CVE ID: CVE-2022-23746 State: PUBLISHED Published: 2022-11-30T00:00:00.000Z Last Updated: 2025-04-25T14:31:53.350Z Vendors: n/a Products: Gateway & Management, IPsec VPN blade SNX portal. Problem Types: CWE-307 Description: The IPsec VPN blade has a dedicated portal for downloading and connecting through SSL Network Extender (SNX). If the portal is configured for username/password authentication, it is vulnerable to a brute-force attack on usernames and passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk180271
CVE ID: CVE-2022-23747 State: PUBLISHED Published: 2022-08-17T20:52:26 Last Updated: 2024-08-03T03:51:46.032Z Vendors: n/a Products: Sony Xperia Problem Types: CWE-120 Description: In Sony Xperia series 1, 5, and Pro, an out of bound memory access can occur due to lack of validation of the number of frames being passed during music playback. Additional Analyst Notes: - CVE Program Container: References: - https://cpr-zero.checkpoint.com/vulns/cprid-2191/ - https://research.checkpoint.com/2022/bad-alac-one-codec-to-hack-the-whole-world/
CVE ID: CVE-2022-23748 State: PUBLISHED Published: 2022-11-17T00:00:00.000Z Last Updated: 2025-10-21T23:15:31.225Z Vendors: n/a Products: Audinate Dante Application Library for Windows Problem Types: CWE-114 Description: mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In these scenarios, a malicious attacker could be using the valid and legitimate executable to load malicious files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cpr-zero.checkpoint.com/vulns/cprid-2193/%2C - https://www.audinate.com/learning/faqs/audinate-response-to-
s: - https://cpr-zero.checkpoint.com/vulns/cprid-2193/%2C - https://www.audinate.com/learning/faqs/audinate-response-to-dante-discovery-mdnsresponder-exe-security-issue-cve-2022-23748
CVE ID: CVE-2022-23763 State: PUBLISHED Published: 2022-06-28T13:49:01 Last Updated: 2024-08-03T03:51:45.957Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: DOUZONE BIZON Co.,Ltd Products: NeoRS Problem Types: CWE-346 Description: Origin validation error vulnerability in NeoRS’s ActiveX moudle allows attackers to download and execute arbitrary files. Remote attackers can use this vulerability to encourage users to access crafted web pages, causing damage such as malicious code infections. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66788
CVE ID: CVE-2022-23764 State: PUBLISHED Published: 2022-08-17T20:23:03 Last Updated: 2024-08-03T03:51:46.048Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: TERUTEN Co.,Ltd Products: WebCube Problem Types: CWE-346 Description: The vulnerability causing from insufficient verification procedures for downloaded files during WebCube update. Remote attackers can bypass this verification logic to update both digitally signed and unauthorized files, enabling remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66876
CVE ID: CVE-2022-23765 State: PUBLISHED Published: 2022-08-17T20:24:23 Last Updated: 2024-08-03T03:51:46.056Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: EFM Networks Co.,Ltd Products: NAS1dual, NAS2dual, NAS4dual Problem Types: CWE-352 Description: This vulnerability occured by sending a malicious POST request to a specific page while logged in random user from some family of IPTIME NAS. Remote attackers can steal root privileges by changing the password of the root through a POST request. Additional Analyst Notes: - CVE Program Container: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66877
CVE ID: CVE-2022-23766 State: PUBLISHED Published: 2022-09-19T19:52:07.000Z Last Updated: 2025-05-29T17:44:41.650Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Bluetree Co., Ltd Products: BigFileAgent Problem Types: CWE-20 Description: An improper input validation vulnerability leading to arbitrary file execution was discovered in BigFileAgent. In order to cause arbitrary files to be executed, the attacker makes the victim access a web page d by them or inserts a script using XSS into a general website. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_
ram Container: - CISA ADP Vulnrichment: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66925
CVE ID: CVE-2022-23767 State: PUBLISHED Published: 2022-09-19T19:50:37.000Z Last Updated: 2025-06-03T18:21:40.381Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: HANSSAK Co.,Ltd Products: SecureGate, WebLink Problem Types: CWE-288, CWE-89, CWE-22 Description: This vulnerability of SecureGate is SQL-Injection using login without password. A path traversal vulnerability is also identified during file transfer. An attacker can take advantage of these vulnerabilities to perform various attacks such as obtaining privileges and executing remote code, thereby taking over the victim’s system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
de, thereby taking over the victim’s system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66926
CVE ID: CVE-2022-23768 State: PUBLISHED Published: 2022-09-19T19:48:57.000Z Last Updated: 2025-06-03T18:20:38.436Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Neo Information Systems Co., Ltd Products: Home AP NIS-HAP11AC Problem Types: CWE-284 Description: This Vulnerability in NIS-HAP11AC is caused by an exposed external port for the telnet service. Remote attackers use this vulnerability to induce all attacks such as source code hijacking, remote control of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66928
CVE ID: CVE-2022-23769 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T20:09:24.359Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Secuever Co.,Ltd Products: reverseWall-MDS Problem Types: CWE-287 Description: Remote code execution vulnerability due to insufficient user privilege verification in reverseWall-MDS. Remote attackers can exploit the vulnerability such as stealing account, through remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66962
CVE ID: CVE-2022-23770 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T20:08:09.604Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: WISA corp. Products: Smart Wing CMS Problem Types: CWE-20 Description: This vulnerability could allow a remote attacker to execute remote commands with improper validation of parameters of certain API constructors. Remote attackers could use this vulnerability to execute malicious commands such as directory traversal. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66963
CVE ID: CVE-2022-23771 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-09T14:49:10.046Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: EFM Networks Co., Ltd Products: NAS1dual, NAS2dual, NAS4dual Problem Types: CWE-352 Description: This vulnerability occurs in user accounts creation and deleteion related pages of IPTIME NAS products. The vulnerability could be exploited by a lack of validation when a POST request is made to this page. An attacker can use this vulnerability to or delete user accounts, or to escalate arbitrary user privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
rbitrary user privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66964
CVE ID: CVE-2022-23772 State: PUBLISHED Published: 2022-02-11T00:11:15 Last Updated: 2024-08-03T03:51:46.050Z Vendors: n/a Products: n/a Problem Types: n/a Description: Rat.SetString in math/big in Go before 1.16.14 and 1.17.x before 1.17.7 has an overflow that can lead to Uncontrolled Memory Consumption. Additional Analyst Notes: - CVE Program Container: References: - https://lists.debian.org/debian-lts-announce/2022/04/msg00017.html - https://lists.debian.org/debian-lts-announce/2022/04/msg00018.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ - https://security.netapp.com/advisory/ntap-20220225-0006/ - https://securi
s.google.com/g/golang-announce/c/SUsQn0aSgPQ - https://security.netapp.com/advisory/ntap-20220225-0006/ - https://security.gentoo.org/glsa/202208-02
CVE ID: CVE-2022-23773 State: PUBLISHED Published: 2022-02-11T00:16:08 Last Updated: 2024-08-03T03:51:45.976Z Vendors: n/a Products: n/a Problem Types: n/a Description: cmd/go in Go before 1.16.14 and 1.17.x before 1.17.7 can misinterpret branch names that falsely appear to be version tags. This can lead to incorrect access control if an actor is supposed to be able to create branches but not tags. Additional Analyst Notes: - CVE Program Container: References: - https://www.oracle.com/security-alerts/cpujul2022.html - https://groups.google.com/g/golang-announce/c/SUsQn0aSgPQ - https://security.netapp.com/advisory/ntap-20220225-0006/ - https://security.gentoo.org/glsa/202208-02
CVE ID: CVE-2022-23774 State: PUBLISHED Published: 2022-02-01T05:30:18 Last Updated: 2024-08-03T03:51:45.986Z Vendors: n/a Products: n/a Problem Types: n/a Description: Docker Desktop before 4.4.4 on Windows allows attackers to move arbitrary files. Additional Analyst Notes: - CVE Program Container: References: - https://docs.docker.com/docker-for-windows/release-notes/
CVE ID: CVE-2022-23775 State: PUBLISHED Published: 2022-05-25T15:42:53 Last Updated: 2024-08-03T03:51:46.195Z Vendors: n/a Products: n/a Problem Types: n/a Description: TrueStack Direct Connect 1.4.7 has Incorrect Access Control. Additional Analyst Notes: - CVE Program Container: References: - https://truestack.com/support/ - https://truestack.com/ufaqs/cve-2022-23775-vulnerability-upgrade-to-1-4-10-or-higher-to-fix/
CVE ID: CVE-2022-23779 State: PUBLISHED Published: 2022-03-02T14:31:30 Last Updated: 2024-08-03T03:51:46.004Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. The internal hostname can be discovered by reading HTTP redirect responses. Additional Analyst Notes: - CVE Program Container: References: - https://www.manageengine.com/products/desktop-central/cve-2022-23779.html
CVE ID: CVE-2022-23790 State: PUBLISHED Published: 2023-03-14T08:12:39.727Z Last Updated: 2025-02-27T17:57:20.530Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Firmanet Software and Technology Products: Customer Relation Manager Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS).This issue affects Customer Relation Manager: before 2022.03.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0145
CVE ID: CVE-2022-23791 State: PUBLISHED Published: 2023-03-14T08:13:03.739Z Last Updated: 2025-02-27T17:55:19.960Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Firmanet Software and Technology Products: Customer Relation Manager Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Firmanet Software and Technology Customer Relation Manager allows Cross-Site Scripting (XSS).This issue affects Customer Relation Manager: before 2022.03.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0145
CVE ID: CVE-2022-23793 State: PUBLISHED Published: 2022-03-30T15:20:22.462121Z Last Updated: 2024-09-16T20:59:09.256Z Vendors: Joomla! Project Products: Joomla! CMS, joomla/archive Problem Types: Path Traversal Description: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Extracting an specifilcy crafted tar package could write files outside of the intended path. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/870-20220301-core-zip-slip-within-the-tar-extractor.html - http://packetstormsecurity.com/files/166546/Joomla-4.1.0-Zip-Slip-File-Overwrite-Path-Traversal.html
CVE ID: CVE-2022-23794 State: PUBLISHED Published: 2022-03-30T15:20:24.272061Z Last Updated: 2024-09-17T02:41:10.057Z Vendors: Joomla! Project Products: Joomla! CMS, joomla/filesystem Problem Types: Path Disclosure Description: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Uploading a file name of an excess length causes the error. This error brings up the screen with the path of the source code of the web application. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/871-20220302-core-path-disclosure-within-filesystem-error-messages.html
CVE ID: CVE-2022-23795 State: PUBLISHED Published: 2022-03-30T15:20:26.042065Z Last Updated: 2024-09-16T17:19:08.109Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: Incorrect Access Control Description: An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. A user row was not bound to a specific authentication mechanism which could under very special circumstances allow an account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/872-20220303-core-user-row-are-not-bound-to-a-authentication-mechanism.html
CVE ID: CVE-2022-23796 State: PUBLISHED Published: 2022-03-30T15:20:27.595867Z Last Updated: 2024-09-17T02:27:29.087Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: XSS Description: An issue was discovered in Joomla! 3.7.0 through 3.10.6. Lack of input validation could allow an XSS attack using com_fields. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/873-20220304-core-missing-input-validation-within-com-fields-class-inputs.html
CVE ID: CVE-2022-23797 State: PUBLISHED Published: 2022-03-30T15:20:29.271982Z Last Updated: 2024-09-16T17:28:28.264Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: SQL Injection Description: An issue was discovered in Joomla! 3.0.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate filtering on the selected Ids on an request could resulted into an possible SQL injection. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/874-20220305-core-inadequate-filtering-on-the-selected-ids.html
CVE ID: CVE-2022-23798 State: PUBLISHED Published: 2022-03-30T15:20:30.757090Z Last Updated: 2024-09-16T22:19:54.147Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: Open redirect Description: An issue was discovered in Joomla! 2.5.0 through 3.10.6 & 4.0.0 through 4.1.0. Inadequate validation of URLs could result into an invalid check whether an redirect URL is internal or not. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/875-20220306-core-inadequate-validation-of-internal-urls.html
CVE ID: CVE-2022-23799 State: PUBLISHED Published: 2022-03-30T15:20:32.231485Z Last Updated: 2024-09-16T16:37:47.886Z Vendors: Joomla! Project Products: Joomla! CMS, joomla/input Problem Types: Variable Tampering Description: An issue was discovered in Joomla! 4.0.0 through 4.1.0. Under specific circumstances, JInput pollutes method-specific input bags with $_REQUEST data. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/876-20220307-core-variable-tampering-on-jinput-request-data.html
CVE ID: CVE-2022-23800 State: PUBLISHED Published: 2022-03-30T15:20:33.653594Z Last Updated: 2024-09-16T19:35:06.733Z Vendors: Joomla! Project Products: Joomla! CMS, joomla/filter Problem Types: XSS Description: An issue was discovered in Joomla! 4.0.0 through 4.1.0. Inadequate content filtering leads to XSS vulnerabilities in various components. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/877-20220308-core-inadequate-content-filtering-within-the-filter-code.html
CVE ID: CVE-2022-23801 State: PUBLISHED Published: 2022-03-30T15:20:35.023851Z Last Updated: 2024-09-16T19:35:51.135Z Vendors: Joomla! Project Products: Joomla! CMS Problem Types: XSS Description: An issue was discovered in Joomla! 4.0.0 through 4.1.0. Possible XSS atack vector through SVG embedding in com_media. Additional Analyst Notes: - CVE Program Container: References: - https://developer.joomla.org/security-centre/878-20220309-core-xss-attack-vector-through-svg.html