Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2165 State: PUBLISHED Published: 2022-07-28T00:41:15 Last Updated: 2024-08-03T00:32:07.964Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in URL formatting in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/06/stable-channel-update-for-desktop_21.html - https://crbug.com/1250993 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/ -
s.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5BQRTR4SIUNIHLLPWTGYSDNQK7DYCRSB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H2C4XOJVIILDXTOSMWJXHSQNEXFWSOD7/ - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-2166 State: PUBLISHED Published: 2022-11-16T00:00:00.000Z Last Updated: 2025-04-29T20:30:40.434Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: mastodon Products: mastodon/mastodon Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository mastodon/mastodon prior to 4.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/2f96f990-01c2-44ea-ae47-58bdb3aa455b - https://github.com/mastodon/mastodon/commit/21fd25a269cca742af431f0d13299e139f267346
CVE ID: CVE-2022-2167 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-07T13:25:48.460Z Vendors: Unknown Products: Newspaper Problem Types: CWE-79 Description: The Newspaper WordPress theme before 12 does not sanitise a parameter before outputting it back in an HTML attribute via an AJAX action, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ad35fbae-1e90-47a0-b1d2-f8d91a5db90e
CVE ID: CVE-2022-2168 State: PUBLISHED Published: 2022-07-17T10:36:46 Last Updated: 2024-08-03T00:32:08.598Z Vendors: Unknown Products: Download Manager Problem Types: CWE-79 Description: The Download Manager WordPress plugin before 3.2.44 does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/66789b32-049e-4440-8b19-658649851010
CVE ID: CVE-2022-2169 State: PUBLISHED Published: 2022-07-17T10:36:52 Last Updated: 2024-08-03T00:32:08.553Z Vendors: Unknown Products: Loading Page with Loading Screen Problem Types: CWE-79 Description: The Loading Page with Loading Screen WordPress plugin before 1.0.83 does not escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a9f4aab7-b42b-4bb6-b05d-05407f935230
CVE ID: CVE-2022-2170 State: PUBLISHED Published: 2022-08-01T12:49:17 Last Updated: 2024-08-03T00:32:08.642Z Vendors: Unknown Products: Microsoft Advertising Universal Event Tracking (UET) Problem Types: CWE-79 Description: The Microsoft Advertising Universal Event Tracking (UET) WordPress plugin before 1.0.4 does not sanitise and escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Due to the nature of this plugin, well crafted XSS can also leak into the frontpage. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6eaef938-ce98-4d57-8a1d
dditional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6eaef938-ce98-4d57-8a1d-fa9d1ae3d6ed
CVE ID: CVE-2022-2171 State: PUBLISHED Published: 2022-08-01T12:49:33 Last Updated: 2024-08-03T00:32:07.973Z Vendors: Unknown Products: Progressive License Problem Types: CWE-352 Description: The Progressive License WordPress plugin through 1.1.0 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the settings, this could lead to Stored XSS issue which will be triggered in the frontend as well. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/11937296-7ecf-4b94-b274-06f7990dbede
CVE ID: CVE-2022-2172 State: PUBLISHED Published: 2022-08-22T14:59:50 Last Updated: 2024-08-03T00:32:08.540Z Vendors: Unknown Products: LinkWorth Plugin Problem Types: CWE-352 Description: The LinkWorth WordPress plugin before 3.3.4 does not implement nonce checks, which could allow attackers to make a logged in admin change settings via a CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bfb6ed12-ae64-4075-9d0b-5620e998df74 - https://plugins.trac.wordpress.org/changeset?new=2754739%40linkworth-wp-plugin&old=2750802%40linkworth-wp-plugin#file8
CVE ID: CVE-2022-2173 State: PUBLISHED Published: 2022-07-17T10:36:59 Last Updated: 2024-08-03T00:32:08.615Z Vendors: Unknown Products: Advanced Database Cleaner Problem Types: CWE-79 Description: The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/86bfe0cc-a579-43d6-a26b-6e06000251f6
CVE ID: CVE-2022-2174 State: PUBLISHED Published: 2022-06-22T12:00:38 Last Updated: 2024-08-03T00:32:07.996Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.18. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ac68e3fc-8cf1-4a62-90ee-95c4b2bad607 - https://github.com/microweber/microweber/commit/c51285f791e48e536111cd57a9544ccbf7f33961
CVE ID: CVE-2022-2175 State: PUBLISHED Published: 2022-06-23T00:00:00 Last Updated: 2024-08-03T00:32:09.074Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-126 Description: Buffer Over-read in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7f0481c2-8b57-4324-b47c-795d1ea67e55 - https://github.com/vim/vim/commit/6046aded8da002b08d380db29de2ba0268b6616e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/list/packag
lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/ - https://security.gentoo.org/glsa/202208-32 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2176 State: REJECTED Published: N/A Last Updated: 2023-02-23T17:53:23.864Z Description: No description available.
CVE ID: CVE-2022-2177 State: PUBLISHED Published: 2022-09-20T10:40:14.798Z Last Updated: 2025-05-27T18:07:34.604Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Kayrasoft Products: Kayrasoft Problem Types: CWE-89 Description: Kayrasoft product before version 2 has an unauthenticated SQL Injection vulnerability. This is fixed in version 2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-22-0630
CVE ID: CVE-2022-2178 State: PUBLISHED Published: 2023-03-06T11:43:42.077Z Last Updated: 2025-03-05T19:41:17.512Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Saysis Products: Starcities Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saysis Computer Starcities allows Cross-Site Scripting (XSS).This issue affects Starcities: before 1.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0128
CVE ID: CVE-2022-2179 State: PUBLISHED Published: 2022-07-20T15:36:33.007Z Last Updated: 2025-04-16T16:14:37.655Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Rockwell Automation Products: MicroLogix 1400, MicroLogix 1100 Problem Types: CWE-1021 Description: The X-Frame-Options header in Rockwell Automation MicroLogix 1100/1400 Versions 21.007 and prior is not configured in the HTTP response, which could allow clickjacking attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-188-01 - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135994
CVE ID: CVE-2022-2180 State: PUBLISHED Published: 2022-08-15T08:36:24 Last Updated: 2024-08-03T00:32:08.913Z Vendors: Unknown Products: greyd_suite Problem Types: CWE-434 Description: The GREYD.SUITE WordPress theme does not properly validate uploaded custom font packages, and does not perform any authorization or csrf checks, allowing an unauthenticated attacker to upload arbitrary files including php source files, leading to possible remote code execution (RCE). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c330f92b-1e21-414f-b316-d5e97cb62bd1
CVE ID: CVE-2022-2181 State: PUBLISHED Published: 2022-08-01T12:49:47 Last Updated: 2024-08-03T00:32:08.747Z Vendors: Unknown Products: Advanced WordPress Reset Problem Types: CWE-79 Description: The Advanced WordPress Reset WordPress plugin before 1.6 does not escape some generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/68ddf343-6e69-44a7-bd33-72004053d41e
CVE ID: CVE-2022-2182 State: PUBLISHED Published: 2022-06-23T00:00:00 Last Updated: 2024-08-03T00:32:08.598Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/238d8650-3beb-4831-a8f7-6f0b597a6fb8 - https://github.com/vim/vim/commit/f7c7c3fad6d2135d558f3b36d0d1a943118aeb5e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/l
nnounce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/ - https://security.gentoo.org/glsa/202208-32 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2183 State: PUBLISHED Published: 2022-06-23T00:00:00 Last Updated: 2024-08-03T00:32:08.693Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d74ca3f9-380d-4c0a-b61c-11113cc98975 - https://github.com/vim/vim/commit/8eba2bd291b347e3008aa9e565652d51ad638cfa - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/list/pack
40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/ - https://security.gentoo.org/glsa/202208-32 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2184 State: PUBLISHED Published: 2022-08-01T12:50:04 Last Updated: 2024-08-03T00:32:08.609Z Vendors: Unknown Products: CAPTCHA 4WP Problem Types: CWE-22, CWE-352 Description: The CAPTCHA 4WP WordPress plugin before 7.1.0 lets user input reach a sensitive require_once call in one of its admin-side templates. This can be abused by attackers, via a Cross-Site Request Forgery attack to run arbitrary code on the server. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e777784f-5ba0-4966-be27-e0a0cbbfe056
CVE ID: CVE-2022-2185 State: PUBLISHED Published: 2022-07-01T15:50:03 Last Updated: 2024-08-03T00:32:08.558Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of special elements used in a command ('command injection') in GitLab Description: A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https:/
afted project leading to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/366088 - https://hackerone.com/reports/1609965 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2185.json
CVE ID: CVE-2022-2186 State: PUBLISHED Published: 2022-07-17T10:37:07 Last Updated: 2024-08-03T00:32:08.635Z Vendors: Unknown Products: Simple Post Notes Problem Types: CWE-79 Description: The Simple Post Notes WordPress plugin before 1.7.6 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b766103a-7f91-4d91-9f9c-bff4bfd53f57
CVE ID: CVE-2022-2187 State: PUBLISHED Published: 2022-07-17T10:37:14 Last Updated: 2024-08-03T00:32:08.696Z Vendors: Unknown Products: Contact Form 7 Captcha Problem Types: CWE-79 Description: The Contact Form 7 Captcha WordPress plugin before 0.1.2 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4fd2f1ef-39c6-4425-8b4d-1a332dabac8d
CVE ID: CVE-2022-2188 State: PUBLISHED Published: 2022-11-07T11:26:55.535Z Last Updated: 2025-05-08T16:02:49.245Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) Vendors: Trellix Products: DXL Broker Problem Types: cwe-274: Privilege Escalation Description: Privilege escalation vulnerability in DXL Broker for Windows prior to 6.0.0.280 allows local users to gain elevated privileges by exploiting weak directory controls in the logs directory. This can lead to a denial-of-service attack on the DXL Broker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10383
CVE ID: CVE-2022-2189 State: PUBLISHED Published: 2022-07-25T12:47:12 Last Updated: 2024-08-03T00:32:08.665Z Vendors: Unknown Products: WP Video Lightbox Problem Types: CWE-79 Description: The WP Video Lightbox WordPress plugin before 1.9.5 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b6ed4d64-ee98-41bd-a97a-8350c2a8a546
CVE ID: CVE-2022-2190 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-07T13:24:51.319Z Vendors: Unknown Products: Gallery Plugin for WordPress – Envira Photo Gallery Problem Types: CWE-79 Description: The Gallery Plugin for WordPress plugin before 1.8.4.7 does not escape the $_SERVER['REQUEST_URI'] parameter before outputting it back in an attribute, which could lead to Reflected Cross-Site Scripting in old web browsers Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1af4beb6-ba16-429b-acf2-43f9594f5ace
CVE ID: CVE-2022-2191 State: PUBLISHED Published: 2022-07-07T20:45:16 Last Updated: 2024-08-03T00:32:08.749Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-404, CWE-664 Description: In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA-8mpp-f3f7-xc28 - https://security.netapp.com/advisory/ntap-20220909-0003/
CVE ID: CVE-2022-2192 State: PUBLISHED Published: 2022-07-19T14:07:38 Last Updated: 2024-08-03T00:32:08.717Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: HYPR Products: HYPR Server Problem Types: CWE-425 Description: Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate privileges via path tampering in the Magic Link page. This issue affects: HYPR Server versions later than 6.10; version 6.15.1 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.hypr.com/security-advisories/
CVE ID: CVE-2022-2193 State: PUBLISHED Published: 2022-07-19T14:07:50 Last Updated: 2024-08-03T00:32:08.887Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: HYPR Products: HYPR Server Problem Types: CWE-280 Description: Insecure Direct Object Reference vulnerability in HYPR Server before version 6.14.1 allows remote authenticated attackers to add a FIDO2 authenticator to arbitrary accounts via parameter tampering in the Device Manager page. This issue affects: HYPR Server versions prior to 6.14.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.hypr.com/security-advisories/
CVE ID: CVE-2022-2194 State: PUBLISHED Published: 2022-07-17T10:37:22 Last Updated: 2024-08-03T00:32:08.626Z Vendors: Unknown Products: Accept Stripe Payments Problem Types: CWE-79 Description: The Accept Stripe Payments WordPress plugin before 2.0.64 does not sanitize and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ecf4b707-dea9-42d0-9ade-d788a9f97190
CVE ID: CVE-2022-2196 State: PUBLISHED Published: 2023-01-09T10:59:53.099Z Last Updated: 2025-02-13T16:28:57.097Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L) Vendors: Linux Products: Linux Kernel Problem Types: CWE-1188 Description: A regression exists in the Linux Kernel within KVM: nVMX that allowed for speculative execution attacks. L2 can carry out Spectre v2 attacks on L1 due to L1 thinking it doesn't need retpolines or IBPB after running L2 due to KVM (L0) advertising eIBRS support to L1. An attacker at L2 with code execution can execute code on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a Addition
ode on an indirect branch on the host machine. We recommend upgrading to Kernel 6.2 or past commit 2e7eab81425a Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kernel.dance/#2e7eab81425a - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2e7eab81425ad6c875f2ed47c0ce01e78afc38a5 - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE ID: CVE-2022-2197 State: PUBLISHED Published: 2022-06-30T18:42:40.979Z Last Updated: 2025-04-16T16:15:38.584Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Exemys Products: RME1-AI firmware Problem Types: CWE-287 Description: By using a specific credential string, an attacker with network access to the device’s web interface could circumvent the authentication scheme and perform administrative operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-01
CVE ID: CVE-2022-2198 State: PUBLISHED Published: 2022-08-22T15:00:17 Last Updated: 2024-08-03T00:32:08.752Z Vendors: Unknown Products: WPQA Builder Problem Types: CWE-639 Description: The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displaying private messages, allowing any logged in user to read other users private message using the message id, which can easily be brute forced. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/867248f2-d497-4ea8-b3f8-0f2e8aaaa2bd
CVE ID: CVE-2022-2199 State: PUBLISHED Published: 2022-07-20T15:24:14.804Z Last Updated: 2025-04-16T17:51:30.330Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: MiCODUS Products: MV720 Problem Types: CWE-79 Description: The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain control by tricking a user into making a request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01
CVE ID: CVE-2022-2200 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:03:42.078Z Vendors: Mozilla Products: Firefox, Firefox ESR, Thunderbird Problem Types: Undesired attributes could be set as part of prototype pollution Description: If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. This vulnerability affects Firefox < 102, Firefox ESR < 91.11, Thunderbird < 102, and Thunderbird < 91.11. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-24/ - https:/
ram Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-24/ - https://www.mozilla.org/security/advisories/mfsa2022-26/ - https://www.mozilla.org/security/advisories/mfsa2022-25/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1771381
CVE ID: CVE-2022-2206 State: PUBLISHED Published: 2022-06-26T00:00:00 Last Updated: 2024-08-03T00:32:08.643Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/01d01e74-55d0-4d9e-878e-79ba599be668 - https://github.com/vim/vim/commit/e178af5a586ea023622d460779fdcabbbfac0908 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/list/pack