Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ows arbitrary access to any services running on the device that may be inadvertently listening via IPv6, such as the SSH and Telnet servers spawned on ports 22 and 23 by default. This misconfiguration could allow an attacker to interact with services only intended to be accessible by clients on the local network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.tenable.com/security/research/tra-2022-36%2C - https://www.synacktiv.com/en/publications/cool-vulns-dont-live-long-netgear-and-pwn2own.html
CVE ID: CVE-2022-4391 State: PUBLISHED Published: 2023-01-09T22:13:45.697Z Last Updated: 2025-04-09T18:30:40.057Z Vendors: Unknown Products: Vision Interactive For WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Vision Interactive For WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c0c37787-3c4c-42d5-bb75-5d4ed3e7aa2b
CVE ID: CVE-2022-4392 State: PUBLISHED Published: 2023-01-09T22:13:28.879Z Last Updated: 2025-04-09T19:12:13.378Z Vendors: Unknown Products: iPanorama 360 WordPress Virtual Tour Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The iPanorama 360 WordPress Virtual Tour Builder plugin through 1.6.29 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c298e3dc-09a7-40bb-a361-f49af4bce77e
CVE ID: CVE-2022-4393 State: PUBLISHED Published: 2023-01-09T22:13:29.648Z Last Updated: 2024-08-03T01:41:44.361Z Vendors: Unknown Products: ImageLinks Interactive Image Builder for WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The ImageLinks Interactive Image Builder for WordPress plugin through 1.5.3 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0bd4f370-f9f8-43ee-8f20-96e899a1efb5
CVE ID: CVE-2022-4394 State: PUBLISHED Published: 2023-01-09T22:13:34.481Z Last Updated: 2025-04-09T18:48:59.818Z Vendors: Unknown Products: iPages Flipbook For WordPress Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The iPages Flipbook For WordPress plugin through 1.4.6 does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8edbdea1-f9bb-407a-bcd1-fff3e146984c
CVE ID: CVE-2022-4395 State: PUBLISHED Published: 2023-01-30T20:31:42.219Z Last Updated: 2025-03-27T19:55:55.299Z Vendors: Unknown Products: Membership For WooCommerce Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/80407ac4-8ce3-4df7-9c41-007b69045c40
CVE ID: CVE-2022-4396 State: PUBLISHED Published: 2022-12-10T00:00:00.000Z Last Updated: 2025-04-15T13:06:36.949Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: RDFlib Products: pyrdfa3 Problem Types: CWE-707 Description: A vulnerability was found in RDFlib pyrdfa3 and classified as problematic. This issue affects the function _get_option of the file pyRdfa/__init__.py. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e. It is recommended to apply a patch to fix this issue. The identifier VDB-215249 was assigned to this vulnerability. NOTE: This vulnerability o
pply a patch to fix this issue. The identifier VDB-215249 was assigned to this vulnerability. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/RDFLib/pyrdfa3/pull/40 - https://github.com/RDFLib/pyrdfa3/commit/ffd1d62dd50d5f4190013b39cedcdfbd81f3ce3e - https://vuldb.com/?id.215249
CVE ID: CVE-2022-4397 State: PUBLISHED Published: 2022-12-10T00:00:00.000Z Last Updated: 2025-04-15T13:06:27.280Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: morontt Products: zend-blog-number-2 Problem Types: CWE-863 Description: A vulnerability was found in morontt zend-blog-number-2. It has been classified as problematic. Affected is an unknown function of the file application/forms/Comment.php of the component Comment Handler. The manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The name of the patch is 36b2d4abe20a6245e4f8df7a4b14e130b24d429d. It is recommended to apply a patch to fix this issue. VDB-21
e of the patch is 36b2d4abe20a6245e4f8df7a4b14e130b24d429d. It is recommended to apply a patch to fix this issue. VDB-215250 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/morontt/zend-blog-number-2/commit/36b2d4abe20a6245e4f8df7a4b14e130b24d429d - https://vuldb.com/?id.215250
CVE ID: CVE-2022-4398 State: PUBLISHED Published: 2022-12-10T00:00:00.000Z Last Updated: 2025-04-14T17:58:32.150Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-190 Description: Integer Overflow or Wraparound in GitHub repository radareorg/radare2 prior to 5.8.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/c6f8d3ef-5420-4eba-9a5f-aba5e2b5fea2 - https://github.com/radareorg/radare2/commit/b53a1583d05c3a5bfe5fa60da133fe59dfbb02b8
CVE ID: CVE-2022-4399 State: PUBLISHED Published: 2022-12-10T00:00:00.000Z Last Updated: 2025-04-15T13:06:16.628Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: TicklishHoneyBee Products: nodau Problem Types: CWE-707 Description: A vulnerability was found in TicklishHoneyBee nodau. It has been rated as critical. Affected by this issue is some unknown functionality of the file src/db.c. The manipulation of the argument value/name leads to sql injection. The name of the patch is 7a7d737a3929f335b9717ddbd31db91151b69ad2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215252. Additional Analyst Notes: - CVE Pro
apply a patch to fix this issue. The identifier of this vulnerability is VDB-215252. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/TicklishHoneyBee/nodau/pull/26 - https://github.com/TicklishHoneyBee/nodau/commit/7a7d737a3929f335b9717ddbd31db91151b69ad2 - https://vuldb.com/?id.215252
CVE ID: CVE-2022-4400 State: PUBLISHED Published: 2022-12-11T00:00:00.000Z Last Updated: 2025-04-15T13:06:07.648Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: zbl1996 Products: FS-Blog Problem Types: CWE-707 Description: A vulnerability was found in zbl1996 FS-Blog and classified as problematic. This issue affects some unknown processing of the component Title Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-215267. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/zbl1996/FS-Blog/issues/I5Y6ZQ - https
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/zbl1996/FS-Blog/issues/I5Y6ZQ - https://vuldb.com/?id.215267
CVE ID: CVE-2022-4401 State: PUBLISHED Published: 2022-12-11T00:00:00 Last Updated: 2024-10-15T17:12:56.238Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: pallidlight Products: online-course-selection-system Problem Types: CWE-707 Description: A vulnerability was found in pallidlight online-course-selection-system. It has been classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-215268. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/pallidlight/online-cours
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/pallidlight/online-course-selection-system/issues/I5XNHW - https://vuldb.com/?id.215268
CVE ID: CVE-2022-4402 State: PUBLISHED Published: 2022-12-11T00:00:00.000Z Last Updated: 2025-04-15T13:05:54.321Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: RainyGao Products: DocSys Problem Types: CWE-22 Description: A vulnerability classified as critical has been found in RainyGao DocSys 2.02.37. This affects an unknown part of the component ZIP File Decompression Handler. The manipulation leads to path traversal: '../filedir'. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-215271. Additional Analyst Notes: - CVE Program Container: - C
d. The associated identifier of this vulnerability is VDB-215271. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/A-TGAO/MxsDocVul/blob/main/ZipSlipVul.md - https://gitee.com/RainyGao/DocSys/issues/I65IYU - https://vuldb.com/?id.215271
CVE ID: CVE-2022-4403 State: PUBLISHED Published: 2022-12-11T00:00:00.000Z Last Updated: 2025-04-15T13:05:43.751Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Canteen Management System Problem Types: CWE-707 Description: A vulnerability classified as critical was found in SourceCodester Canteen Management System. This vulnerability affects unknown code of the file ajax_represent.php. The manipulation of the argument customer_id leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-215272. Additional Analyst Notes: - CV
closed to the public and may be used. The identifier of this vulnerability is VDB-215272. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.csdn.net/hzwsuki/article/details/128277038 - https://vuldb.com/?id.215272
CVE ID: CVE-2022-4404 State: REJECTED Published: N/A Last Updated: 2024-08-19T15:13:09.560Z Description: No description available.
CVE ID: CVE-2022-4405 State: REJECTED Published: N/A Last Updated: 2024-08-16T19:02:35.679Z Description: No description available.
CVE ID: CVE-2022-4407 State: PUBLISHED Published: 2022-12-11T00:00:00.000Z Last Updated: 2025-04-14T17:58:47.086Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a1649f43-78c9-4927-b313-36911872a84b - https://github.com/thorsten/phpmyfaq/commit/1d73af34bf42764f9f9491c7ba5e9495d70e3ca5
CVE ID: CVE-2022-4408 State: PUBLISHED Published: 2022-12-11T00:00:00.000Z Last Updated: 2025-04-14T17:59:00.454Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2ec4ddd4-de22-4f2d-ba92-3382b452bfea - https://github.com/thorsten/phpmyfaq/commit/e2ea332a2b5e798f2c39203b2489a2dabe831751
CVE ID: CVE-2022-4409 State: PUBLISHED Published: 2022-12-11T00:00:00.000Z Last Updated: 2025-04-14T17:59:13.236Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-614 Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository thorsten/phpmyfaq prior to 3.1.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/5915ed4c-5fe2-42e7-8fac-5dd0d032727c - https://github.com/thorsten/phpmyfaq/commit/8b47f38
CVE ID: CVE-2022-4410 State: PUBLISHED Published: 2022-12-14T21:20:13.722Z Last Updated: 2025-01-23T20:30:40.804Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: mbis Products: Permalink Manager Lite Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Permalink Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including 2.2.20.3 due to improper output escaping on post/page/media titles. This makes it possible for attackers to inject arbitrary web scripts on the permalink-manager page if another plugin or theme is installed on the site that all
inject arbitrary web scripts on the permalink-manager page if another plugin or theme is installed on the site that allows lower privileged users with unfiltered_html the ability to modify post/page titles with malicious web scripts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6cbf9636-9d9d-44d4-b873-8920f2dbb846 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2833667%40permalink-manager&new=2833667%40permalink-manager&sfp_email=&sfph_mail=
CVE ID: CVE-2022-4411 State: REJECTED Published: N/A Last Updated: 2024-08-19T15:13:34.886Z Description: No description available.
CVE ID: CVE-2022-4412 State: REJECTED Published: N/A Last Updated: 2024-08-30T20:11:41.688Z Description: No description available.
CVE ID: CVE-2022-4413 State: PUBLISHED Published: 2022-12-11T00:00:00.000Z Last Updated: 2025-04-14T17:59:26.378Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nuxt Products: nuxt/framework Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository nuxt/framework prior to v3.0.0-rc.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/70ac720d-c932-4ed3-98b1-dd2cbcb90185 - https://github.com/nuxt/framework/commit/253c8f7ee0c0c580c44dedbe9387646264e90a1e
CVE ID: CVE-2022-4414 State: PUBLISHED Published: 2022-12-11T00:00:00.000Z Last Updated: 2025-04-14T17:59:45.267Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: nuxt Products: nuxt/framework Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository nuxt/framework prior to v3.0.0-rc.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/131a41e5-c936-4c3f-84fc-e0e1f0e090b5 - https://github.com/nuxt/framework/commit/19a2cd14929ca9b55720cb81f71687830a9e59a4
CVE ID: CVE-2022-4415 State: PUBLISHED Published: 2023-01-11T00:00:00.000Z Last Updated: 2025-11-03T19:27:41.646Z Vendors: n/a Products: systemd Problem Types: CWE-200 Description: A vulnerability was found in systemd. This security flaw can cause a local information leak due to systemd-coredump not respecting the fs.suid_dumpable kernel setting. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.openwall.com/lists/oss-security/2022/12/21/3 - https://github.com/systemd/systemd/commit/b7641425659243c09473cd8fb3aef2c0d4a3eb9c
CVE ID: CVE-2022-4416 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-15T13:05:24.005Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: RainyGao Products: DocSys Problem Types: CWE-707 Description: A vulnerability was found in RainyGao DocSys. It has been declared as critical. This vulnerability affects the function getReposAllUsers of the file /DocSystem/Repos/getReposAllUsers.do. The manipulation of the argument searchWord/reposId leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-215278 is the identifier assigned to this vulnerability. Additional Analyst
disclosed to the public and may be used. VDB-215278 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitee.com/RainyGao/DocSys/issues/I65QEE - https://vuldb.com/?id.215278
CVE ID: CVE-2022-4417 State: PUBLISHED Published: 2023-01-02T21:49:26.726Z Last Updated: 2025-04-10T18:51:59.902Z Vendors: Unknown Products: WP Cerber Security, Anti-spam & Malware Scan Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The WP Cerber Security, Anti-spam & Malware Scan WordPress plugin before 9.3.3 does not properly block access to the REST API users endpoint when the blog is in a subdirectory, which could allow attackers to bypass the restriction in place and list users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a8c6b077-ff93-4c7b-970f-3be4d7971aa5
CVE ID: CVE-2022-4418 State: PUBLISHED Published: 2023-05-18T09:56:07.275Z Last Updated: 2025-01-22T16:18:21.864Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Acronis Products: Acronis Cyber Protect Home Office Problem Types: CWE-347 Description: Local privilege escalation due to unrestricted loading of unsigned libraries. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40208. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security-advisory.acronis.com/advisories/SEC-4729
CVE ID: CVE-2022-4421 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-15T13:05:14.372Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: rAthena Products: FluxCP Problem Types: CWE-707 Description: A vulnerability was found in rAthena FluxCP. It has been classified as problematic. Affected is an unknown function of the file themes/default/servicedesk/view.php of the component Service Desk Image URL Handler. The manipulation of the argument sslink leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is 8a39b2b2bf28353b3503ff1421862393db15aa7e. It is recommended to apply a patch to fix this is
ly. The name of the patch is 8a39b2b2bf28353b3503ff1421862393db15aa7e. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-215304. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rathena/FluxCP/commit/8a39b2b2bf28353b3503ff1421862393db15aa7e - https://vuldb.com/?id.215304
CVE ID: CVE-2022-4422 State: PUBLISHED Published: 2023-01-10T00:00:00.000Z Last Updated: 2025-04-08T14:40:09.336Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Bulutses Information Technologies Products: Bulutdesk Callcenter Problem Types: CWE-89 Description: Call Center System developed by Bulutses Information Technologies before version 3.0 has an unauthenticated Sql Injection vulnerability. This has been fixed in the version 3.0 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-22-0747
CVE ID: CVE-2022-4424 State: REJECTED Published: N/A Last Updated: 2024-08-30T20:01:28.996Z Description: No description available.
CVE ID: CVE-2022-4425 State: REJECTED Published: N/A Last Updated: 2024-08-19T15:46:19.839Z Description: No description available.
CVE ID: CVE-2022-4426 State: PUBLISHED Published: 2023-01-09T22:13:41.703Z Last Updated: 2025-04-09T18:39:34.162Z Vendors: Unknown Products: Mautic Integration for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, allowing attackers to make a logged in admin change arbitrary blog options via a CSRF attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7d3d6b9c-d1c1-4e23-b891-7c72e4e89c38
CVE ID: CVE-2022-4427 State: PUBLISHED Published: 2022-12-19T08:09:51.646Z Last Updated: 2025-04-14T18:03:54.260Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: OTRS AG Products: OTRS, ((OTRS)) Community Edition Problem Types: CWE-20 Description: Improper Input Validation vulnerability in OTRS AG OTRS, OTRS AG ((OTRS)) Community Edition allows SQL Injection via TicketSearch Webservice This issue affects OTRS: from 7.0.1 before 7.0.40 Patch 1, from 8.0.1 before 8.0.28 Patch 1; ((OTRS)) Community Edition: from 6.0.1 through 6.0.34. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-sec
l Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://otrs.com/release-notes/otrs-security-advisory-2022-15/ - https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
CVE ID: CVE-2022-4428 State: PUBLISHED Published: 2023-01-11T16:49:36.512Z Last Updated: 2025-04-09T13:43:13.391Z Severity: HIGH (CVSS 8.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: Cloudflare Products: WARP Problem Types: CWE-20 Description: support_uri parameter in the WARP client local settings file (mdm.xml) lacked proper validation which allowed for privilege escalation and launching an arbitrary executable on the local machine upon clicking on the "Send feedback" option. An attacker with access to the local file system could use a crafted XML config file pointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust
ointing to a malicious file or set a local path to the executable using Cloudflare Zero Trust Dashboard (for Zero Trust enrolled clients). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/advisories/security/advisories/GHSA-h3j3-fhqg-66rh
CVE ID: CVE-2022-4429 State: PUBLISHED Published: 2023-01-10T09:28:41.375Z Last Updated: 2025-04-08T14:51:04.236Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H) Vendors: NortonLifelock (GenDigital) Products: Avira Security for Windows Problem Types: CWE-428 Description: Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issue was fixed with Avira Security version 1.1.78 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html