Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1398 State: PUBLISHED Published: 2022-05-16T14:30:53 Last Updated: 2024-08-03T00:03:06.251Z Vendors: Unknown Products: External Media without Import Problem Types: CWE-918 Description: The External Media without Import WordPress plugin through 1.1.2 does not have any authorisation and does to ensure that medias added via URLs are external medias, which could allow any authenticated users, such as subscriber to perform blind SSRF attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5440d177-e995-403e-b2c9-42ceda14579e
CVE ID: CVE-2022-1399 State: PUBLISHED Published: 2022-08-16T23:20:10.751857Z Last Updated: 2024-09-16T23:51:14.975Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Device42 Products: CMDB Problem Types: CWE-88 Description: An Argument Injection or Modification vulnerability in the "Change Secret" username field as used in the Discovery component of Device42 CMDB allows a local attacker to run arbitrary code on the appliance with root privileges. This issue affects: Device42 CMDB version 18.01.00 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-
es: - CVE Program Container: References: - https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/
CVE ID: CVE-2022-1400 State: PUBLISHED Published: 2022-08-16T23:25:12.477882Z Last Updated: 2024-09-16T22:36:19.528Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: Device42 Products: CMDB Problem Types: CWE-321 Description: Use of Hard-coded Cryptographic Key vulnerability in the WebReportsApi.dll of Exago Web Reports, as used in the Device42 Asset Management Appliance, allows an attacker to leak session IDs and elevate privileges. This issue affects: Device42 CMDB versions prior to 18.01.00. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/
CVE ID: CVE-2022-1401 State: PUBLISHED Published: 2022-08-16T23:30:36.607838Z Last Updated: 2024-09-17T02:11:37.189Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: Device42 Products: CMDB Problem Types: CWE-863 Description: Improper Access Control vulnerability in the /Exago/WrImageResource.adx route as used in Device42 Asset Management Appliance allows an unauthenticated attacker to read sensitive server files with root permissions. This issue affects: Device42 CMDB versions prior to 18.01.00. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-applia
iner: References: - https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/
CVE ID: CVE-2022-1402 State: PUBLISHED Published: 2022-04-29T16:10:21.935Z Last Updated: 2025-04-16T17:54:41.180Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: ASDA-Soft Problem Types: CWE-125 Description: ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-01
CVE ID: CVE-2022-1403 State: PUBLISHED Published: 2022-04-29T16:11:09.167Z Last Updated: 2025-04-16T17:54:33.892Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: ASDA-Soft Problem Types: CWE-787 Description: ASDA-Soft: Version 5.4.1.0 and prior does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds write condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-111-01
CVE ID: CVE-2022-1404 State: PUBLISHED Published: 2022-08-31T15:33:03.604Z Last Updated: 2025-04-16T16:11:36.584Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Delta Electronics Products: CNCSoft Problem Types: CWE-125 Description: Delta Electronics CNCSoft (All versions prior to 1.01.32) does not properly sanitize input while processing a specific project file, allowing a possible out-of-bounds read condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-01
CVE ID: CVE-2022-1405 State: PUBLISHED Published: 2022-08-31T15:33:03.773Z Last Updated: 2025-04-16T17:49:25.404Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: CNCSoft Problem Types: CWE-121 Description: CNCSoft: All versions prior to 1.01.32 does not properly sanitize input while processing a specific project file, allowing a possible stack-based buffer overflow condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-01
CVE ID: CVE-2022-1406 State: PUBLISHED Published: 2022-05-11T14:42:27 Last Updated: 2024-08-03T00:03:06.362Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper input validation in GitLab Description: Improper input validation in GitLab CE/EE affecting all versions from 8.12 prior to 14.8.6, all versions from 14.9.0 prior to 14.9.4, and 14.10.0 allows a Developer to read protected Group or Project CI/CD variables by importing a malicious project Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353958 - https://hackerone.com/reports/1485381 - https://gitl
eferences: - https://gitlab.com/gitlab-org/gitlab/-/issues/353958 - https://hackerone.com/reports/1485381 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1406.json
CVE ID: CVE-2022-1407 State: PUBLISHED Published: 2022-05-16T14:30:55 Last Updated: 2024-08-03T00:03:06.287Z Vendors: Unknown Products: VikBooking Hotel Booking Engine & PMS Problem Types: CWE-352 Description: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not have CSRF check in place when adding a tracking campaign, and does not escape the campaign fields when outputting them In attributes. As a result, attackers could make a logged in admin add tracking campaign with XSS payloads in them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/19a9e266-daf6-4cc5-a300-2b5436b6d07d
CVE ID: CVE-2022-1408 State: PUBLISHED Published: 2022-05-16T14:30:56 Last Updated: 2024-08-03T00:03:06.293Z Vendors: Unknown Products: VikBooking Hotel Booking Engine & PMS Problem Types: CWE-79 Description: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not escape various settings before outputting them in attributes, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/48dccf4c-07e0-4877-867d-f8f43aeb5705
CVE ID: CVE-2022-1409 State: PUBLISHED Published: 2022-05-16T14:30:58 Last Updated: 2024-08-03T00:03:06.223Z Vendors: Unknown Products: VikBooking Hotel Booking Engine & PMS Problem Types: CWE-434 Description: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.8 does not properly validate images, allowing high privilege users such as administrators to upload PHP files disguised as images and containing malicious PHP code Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1330f8f7-4a59-4e9d-acae-21656a4101fe
CVE ID: CVE-2022-1410 State: PUBLISHED Published: 2022-08-16T23:30:18.676392Z Last Updated: 2024-09-16T22:35:09.293Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Device42 Products: CMDB Problem Types: CWE-78 Description: OS Command Injection vulnerability in the db_optimize component of Device42 Asset Management Appliance allows an authenticated attacker to execute remote code on the device. This issue affects: Device42 CMDB version 18.01.00 and prior versions. Additional Analyst Notes: - CVE Program Container: References: - https://www.bitdefender.com/blog/labs/a-red-team-perspective-on-the-device42-asset-management-appliance/
CVE ID: CVE-2022-1411 State: PUBLISHED Published: 2022-05-05T10:30:12 Last Updated: 2024-08-03T00:03:05.854Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-434 Description: Unrestructed file upload in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Attacker can send malicious files to the victims is able to retrieve the stored data from the web application without that data being made safe to render in the browser and steals victim's cookie leads to account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/75c7cf0
to account takeover. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/75c7cf09-d118-4f91-9686-22b142772529 - https://github.com/yetiforcecompany/yetiforcecrm/commit/bf69c427260011ffca42f7b6935bb54080c54124
CVE ID: CVE-2022-1412 State: PUBLISHED Published: 2022-06-13T12:41:48 Last Updated: 2024-08-03T00:03:06.254Z Vendors: Unknown Products: Log WP_Mail Problem Types: CWE-732 Incorrect Permission Assignment for Critical Resource Description: The Log WP_Mail WordPress plugin through 0.1 saves sent email in a publicly accessible directory using predictable filenames, allowing any unauthenticated visitor to obtain potentially sensitive information like generated passwords. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ee10f21f-4476-4f3d-85ed-94d438c61ec2
CVE ID: CVE-2022-1413 State: PUBLISHED Published: 2022-05-19T17:11:12 Last Updated: 2024-08-03T00:03:06.276Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Missing password field masking in GitLab Description: Missing input masking in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 causes potentially sensitive integration properties to be disclosed in the web interface Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353720 - https://gitlab.com/gitlab-
- CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353720 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1413.json
CVE ID: CVE-2022-1414 State: PUBLISHED Published: 2022-10-19T00:00:00.000Z Last Updated: 2025-05-09T14:55:15.555Z Vendors: n/a Products: 3scale-amp-system Problem Types: CWE-1173 Description: 3scale API Management 2 does not perform adequate sanitation for user input in multiple fields. An authenticated user could use this flaw to inject scripts and possibly gain access to sensitive information or conduct further attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2076794 - https://access.redhat.com/security/cve/CVE-2022-1414
CVE ID: CVE-2022-1415 State: PUBLISHED Published: 2023-09-11T20:20:23.745Z Last Updated: 2024-09-25T19:54:35.795Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: RHPAM 7.13.1 async, Red Hat build of Apache Camel for Spring Boot, Red Hat build of Quarkus, Red Hat Decision Manager 7, Red Hat Integration Camel K, Red Hat Integration Camel Quarkus, Red Hat JBoss Data Grid 7, Red Hat JBoss Data Virtualization 6, Red Hat JBoss Enterprise Application Platform 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat JBoss Fuse 6, Red Hat JBoss Fuse 7, Red Hat JBoss Fuse Service Works 6,
ise Application Platform Expansion Pack, Red Hat JBoss Fuse 6, Red Hat JBoss Fuse 7, Red Hat JBoss Fuse Service Works 6, Red Hat Process Automation 7 Problem Types: CWE-502 Description: A flaw was found where some utility classes in Drools core did not use proper safeguards when deserializing data. This flaw allows an authenticated attacker to construct malicious serialized objects (usually called gadgets) and achieve code execution on the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2022:6813 - https://access.redhat.com/security/cve/CVE-2022-1415 - https://bugzilla.redhat.com/show_bug.cgi?id=2065505
CVE ID: CVE-2022-1416 State: PUBLISHED Published: 2022-05-19T17:10:07 Last Updated: 2024-08-03T00:03:06.264Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: Missing sanitization of data in Pipeline error messages in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows for rendering of attacker controlled HTML tags and CSS styling Additional Analyst Notes: - CVE Program Container: References: - https://gitl
acker controlled HTML tags and CSS styling Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/342988 - https://hackerone.com/reports/1362405 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1416.json
CVE ID: CVE-2022-1417 State: PUBLISHED Published: 2022-05-10T20:30:36 Last Updated: 2024-08-03T00:03:06.201Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: Improper access control in GitLab CE/EE affecting all versions starting from 8.12 before 14.8.6, all versions starting from 14.9 before 14.9.4, and all versions starting from 14.10 before 14.10.1 allows non-project members to access contents of Project Members-only Wikis via malicious CI jobs Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/297282 - https://h
l Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/297282 - https://hackerone.com/reports/1075586 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1417.json
CVE ID: CVE-2022-1418 State: PUBLISHED Published: 2022-05-16T14:30:59 Last Updated: 2024-08-03T00:03:06.245Z Vendors: Unknown Products: Social Stickers Problem Types: CWE-79, CWE-352 Description: The Social Stickers WordPress plugin through 2.2.9 does not have CSRF checks in place when updating its Social Network settings, and does not escape some of these fields, which could allow attackers to make a logged-in admin change them and lead to Stored Cross-Site Scripting issues. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3851e61e-f462-4259-af0a-8d832809d559
CVE ID: CVE-2022-1419 State: PUBLISHED Published: 2022-05-31T17:59:18 Last Updated: 2024-08-03T00:03:06.207Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: The root cause of this vulnerability is that the ioctl$DRM_IOCTL_MODE_DESTROY_DUMB can decrease refcount of *drm_vgem_gem_object *(created in *vgem_gem_dumb_create*) concurrently, and *vgem_gem_dumb_create *will access the freed drm_vgem_gem_object. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2077560 - https://www.debian.org/security/2022/dsa-5173
CVE ID: CVE-2022-1420 State: PUBLISHED Published: 2022-04-21T00:00:00 Last Updated: 2024-08-03T00:03:06.320Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4774. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a4323ef8-90ea-4e1c-90e9-c778f0ecf326 - https://github.com/vim/vim/commit/8b91e71441069b1dde9ac9ff9d9a829b1b4aecca - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6E457NYOIRWBJHKB7ON44UY5AVTG4HU/ - https://lists.fedoraproject
/list/package-announce%40lists.fedoraproject.org/message/X6E457NYOIRWBJHKB7ON44UY5AVTG4HU/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KVPZVE2CIE2NGCHZDMEHPBWN3LK2UQAA/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1421 State: PUBLISHED Published: 2022-06-06T08:50:57 Last Updated: 2024-08-03T00:03:06.294Z Vendors: Unknown Products: Discy Problem Types: CWE-352 Description: The Discy WordPress theme before 5.2 lacks CSRF checks in some AJAX actions, allowing an attacker to make a logged in admin change arbitrary 's settings including payment methods via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a7a24e8e-9056-4967-bcad-b96cc0c5b249
CVE ID: CVE-2022-1422 State: PUBLISHED Published: 2022-06-06T08:50:59 Last Updated: 2024-08-03T00:03:06.274Z Vendors: Unknown Products: Discy Problem Types: CWE-352 Description: The Discy WordPress theme before 5.2 does not check for CSRF tokens in the AJAX action discy_reset_options, allowing an attacker to trick an admin into resetting the site settings back to defaults. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/29aff4bf-1691-4dc1-a670-1f2c9a765a3b
CVE ID: CVE-2022-1423 State: PUBLISHED Published: 2022-05-19T17:12:32 Last Updated: 2024-08-03T00:03:06.294Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: Improper access control in the CI/CD cache mechanism in GitLab CE/EE affecting all versions starting from 1.0.2 before 14.8.6, all versions from 14.9.0 before 14.9.4, and all versions from 14.10.0 before 14.10.1 allows a malicious actor with Developer privileges to perform cache poisoning leading to arbitrary code execution in protected branches Additional Analyst Notes: - CVE Program Container: References: - https://gitl
trary code execution in protected branches Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/330047 - https://hackerone.com/reports/1182375 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1423.json
CVE ID: CVE-2022-1424 State: PUBLISHED Published: 2022-06-06T08:51:00 Last Updated: 2024-08-03T00:03:06.104Z Vendors: Unknown Products: Ask me Problem Types: CWE-352 Description: The Ask me WordPress theme before 6.8.2 does not perform CSRF checks for any of its AJAX actions, allowing an attacker to trick logged in users to perform various actions on their behalf on the site. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/147b4097-dec8-4542-b122-7b237db81c05
CVE ID: CVE-2022-1425 State: PUBLISHED Published: 2022-05-16T14:31:01 Last Updated: 2024-08-03T00:03:06.282Z Vendors: Unknown Products: WPQA Builder Plugin Problem Types: CWE-639 Description: The WPQA Builder Plugin WordPress plugin before 5.2, used as a companion plugin for the Discy and Himer , does not validate that the message_id of the wpqa_message_view ajax action belongs to the requesting user, leading to any user being able to read messages for any other users via a Insecure Direct Object Reference (IDOR) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b110e2f7-4aa3-47b5-a8f2-0a7fe53cc467
CVE ID: CVE-2022-1426 State: PUBLISHED Published: 2022-05-11T14:35:42 Last Updated: 2024-08-03T00:03:06.238Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authentication in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 12.6 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly authenticating a user that had some certain amount of information which allowed an user to authenticate without a personal access token. Additional Analyst Notes: - CVE Program Container: References: - https://g
authenticate without a personal access token. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/296866 - https://hackerone.com/reports/1070097 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1426.json
CVE ID: CVE-2022-1427 State: PUBLISHED Published: 2022-04-22T23:35:09 Last Updated: 2024-08-03T00:03:06.197Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-125 Description: Out-of-bounds Read in mrb_obj_is_kind_of in in GitHub repository mruby/mruby prior to 3.2. # Impact: Possible arbitrary code execution if being exploited. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/23b6f0a9-64f5-421e-a55f-b5b7a671f301 - https://github.com/mruby/mruby/commit/a4d97934d51cb88954cc49161dc1d151f64afb6b
CVE ID: CVE-2022-1428 State: PUBLISHED Published: 2022-05-11T14:40:27 Last Updated: 2024-08-03T00:03:06.260Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Allocation of resources without limits or throttling in GitLab Description: An issue has been discovered in GitLab affecting all versions before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was incorrectly verifying throttling limits for authenticated package requests which resulted in limits not being enforced. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab
in limits not being enforced. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/342481 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1428.json
CVE ID: CVE-2022-1429 State: PUBLISHED Published: 2022-04-22T09:10:10 Last Updated: 2024-08-03T00:03:06.261Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-89 Description: SQL injection in GridHelperService.php in GitHub repository pimcore/pimcore prior to 10.3.6. This vulnerability is capable of steal the data Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/cfba30b4-85fa-4499-9160-cd6e3119310e - https://github.com/pimcore/pimcore/commit/523a735ab94f004459b84ffdfd3db784586bbd82
CVE ID: CVE-2022-1430 State: PUBLISHED Published: 2022-05-18T10:00:14 Last Updated: 2024-08-03T00:03:06.267Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: octoprint Products: octoprint/octoprint Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository octoprint/octoprint prior to 1.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0cd30d71-1e32-4a0b-b4c3-faaa1907b541 - https://github.com/octoprint/octoprint/commit/8087528e4a7ddd15c7d95ff662deb5ef7de90045