Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-32274 State: PUBLISHED Published: 2022-07-13T13:45:59 Last Updated: 2024-08-03T07:39:50.194Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Transition Scheduler add-on 6.5.0 for Atlassian Jira is prone to stored XSS via the project name to the creation function. Additional Analyst Notes: - CVE Program Container: References: - https://marketplace.atlassian.com/apps/37456/the-scheduler?hosting=server&tab=overview - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-040.txt
CVE ID: CVE-2022-32275 State: PUBLISHED Published: 2022-06-06T18:29:07 Last Updated: 2024-08-03T07:39:50.900Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grafana 8.4.3 allows reading files via (for example) a /dashboard/snapshot/%7B%7Bconstructor.constructor'/.. /.. /.. /.. /.. /.. /.. /.. /etc/passwd URI. NOTE: the vendor's position is that there is no vulnerability; this request yields a benign error page, not /etc/passwd content Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://grafana.com - https://github.com/BrotherOfJhonny/grafana/blob/main/README.md - https://github.com/grafana/grafana/issues/50336 - https://github.com/Bro
m/BrotherOfJhonny/grafana/blob/main/README.md - https://github.com/grafana/grafana/issues/50336 - https://github.com/BrotherOfJhonny/grafana - https://security.netapp.com/advisory/ntap-20220715-0008/ - https://github.com/grafana/grafana/issues/50341#issuecomment-1155252393
CVE ID: CVE-2022-32276 State: PUBLISHED Published: 2022-06-17T11:38:27 Last Updated: 2024-08-03T07:39:50.606Z Vendors: n/a Products: n/a Problem Types: n/a Description: Grafana 8.4.3 allows unauthenticated access via (for example) a /dashboard/snapshot/*?orgId=0 URI. NOTE: the vendor considers this a UI bug, not a vulnerability Additional Analyst Notes: - CVE Program Container: References: - https://github.com/BrotherOfJhonny/grafana/blob/main/README.md - https://github.com/grafana/grafana/issues/50336
CVE ID: CVE-2022-32277 State: PUBLISHED Published: 2022-09-06T00:00:00 Last Updated: 2024-08-03T07:39:50.259Z Vendors: n/a Products: n/a Problem Types: n/a Description: Squiz Matrix CMS 6.20 is vulnerable to an Insecure Direct Object Reference caused by failure to correctly validate authorization when submitting a request to change a user's contact details. NOTE: this is disputed by both the vendor and the original discoverer because it is a site-specific finding, not a finding about the Squiz Matrix CMS product. Additional Analyst Notes: - CVE Program Container: References: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ - https://www.trustwave.com/en-us/resources/blogs/s
: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/ - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/squiz-matrix-cms-authenticated-privilege-escalation-through-idor/
CVE ID: CVE-2022-32278 State: PUBLISHED Published: 2022-06-13T22:01:38 Last Updated: 2024-08-03T07:39:50.931Z Vendors: n/a Products: n/a Problem Types: n/a Description: XFCE 4.16 allows attackers to execute arbitrary code because xdg-open can execute a .desktop file on an attacker-controlled FTP server. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.xfce.org/xfce/exo/-/commit/c71c04ff5882b2866a0d8506fb460d4ef796de9f - https://www.debian.org/security/2022/dsa-5164 - https://lists.debian.org/debian-lts-announce/2022/06/msg00018.html
CVE ID: CVE-2022-32280 State: PUBLISHED Published: 2022-06-15T19:54:41.463Z Last Updated: 2025-02-20T20:18:00.956Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: Xakuro Products: XO Slider (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in Xakuro's XO Slider plugin <= 3.3.2 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/xo-liteslider/#developers - https://patchstack.com/database/vulnerability/xo-liteslider/wordpress-xo-slider-plugin-3-3-2-authenticated-stored-cross-site-s
//patchstack.com/database/vulnerability/xo-liteslider/wordpress-xo-slider-plugin-3-3-2-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-32282 State: PUBLISHED Published: 2022-08-22T18:25:14.535Z Last Updated: 2025-04-15T18:51:16.930Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: WWBN Products: AVideo Problem Types: CWE-836 Description: An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An attacker that owns a users' password hash will be able to use it to directly login into the account, leading to increased privileges. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql -
eferences: - https://github.com/WWBN/AVideo/blob/e04b1cd7062e16564157a82bae389eedd39fa088/updatedb/updateDb.v12.0.sql - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1545
CVE ID: CVE-2022-32283 State: PUBLISHED Published: 2022-08-18T07:12:44 Last Updated: 2024-08-03T07:39:50.529Z Vendors: Cybozu, Inc. Products: Cybozu Office Problem Types: Improper Access Control Description: Browse restriction bypass vulnerability in Cabinet of Cybozu Office 10.0.0 to 10.8.5 allows a remote authenticated attacker to obtain the data of Cabinet via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://cs.cybozu.co.jp/2022/007584.html - https://jvn.jp/en/jp/JVN20573662/index.html
CVE ID: CVE-2022-32284 State: PUBLISHED Published: 2022-07-04T01:50:38 Last Updated: 2024-08-03T07:39:51.055Z Vendors: Yokogawa Electric Corporation Products: Communication Module for Wide Area Communication Router (for AW810D) VI461 Problem Types: Use of Insufficiently Random Values Description: Use of insufficiently random values vulnerability exists in Vnet/IP communication module VI461 of YOKOGAWA Wide Area Communication Router (WAC Router) AW810D, which may allow a remote attacker to cause denial-of-service (DoS) condition by sending a specially crafted packet. Additional Analyst Notes: - CVE Program Container: References: - https://web-material3.yokogawa.com/1/32825/files/YSAR-22-0005-
nal Analyst Notes: - CVE Program Container: References: - https://web-material3.yokogawa.com/1/32825/files/YSAR-22-0005-E.pdf - https://web-material3.yokogawa.com/19/32825/files/YSAR-22-0005-J.pdf - https://jvn.jp/vu/JVNVU95343906/index.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-02
CVE ID: CVE-2022-32285 State: PUBLISHED Published: 2022-06-14T09:22:19 Last Updated: 2024-08-03T07:39:51.062Z Vendors: Siemens Products: Mendix SAML Module (Mendix 7 compatible), Mendix SAML Module (Mendix 8 compatible), Mendix SAML Module (Mendix 9 compatible) Problem Types: CWE-611 Description: A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions < V3.2.3). The affected module is vulnerable to XML External Entity (XXE) attacks due to insufficient input sanitation. This may allow an attacker to disclose confidential dat
ernal Entity (XXE) attacks due to insufficient input sanitation. This may allow an attacker to disclose confidential data under certain circumstances. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-740594.pdf
CVE ID: CVE-2022-32286 State: PUBLISHED Published: 2022-06-14T09:22:20 Last Updated: 2024-08-03T07:39:50.502Z Vendors: Siemens Products: Mendix SAML Module (Mendix 7 compatible), Mendix SAML Module (Mendix 8 compatible), Mendix SAML Module (Mendix 9 compatible) Problem Types: CWE-79 Description: A vulnerability has been identified in Mendix SAML Module (Mendix 7 compatible) (All versions < V1.16.6), Mendix SAML Module (Mendix 8 compatible) (All versions < V2.2.2), Mendix SAML Module (Mendix 9 compatible) (All versions < V3.2.3). In certain configurations SAML module is vulnerable to Cross Site Scripting (XSS) attacks due to insufficient error message sanitation. This could allow an attacker
erable to Cross Site Scripting (XSS) attacks due to insufficient error message sanitation. This could allow an attacker to execute malicious code by tricking users into accessing a malicious link. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-740594.pdf
CVE ID: CVE-2022-32287 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-02T20:24:43.887Z Vendors: Apache Software Foundation Products: Apache UIMA Problem Types: CWE-22 Description: A relative path traversal vulnerability in a FileUtil class used by the PEAR management component of Apache UIMA allows an attacker to create files outside the designated target directory using carefully crafted ZIP entry names. This issue affects Apache UIMA Apache UIMA version 3.3.0 and prior versions. Note that PEAR files should never be installed into an UIMA installation from untrusted sources because PEAR archives are executable plugins that will be able to perform any actions with
lation from untrusted sources because PEAR archives are executable plugins that will be able to perform any actions with the same privileges as the host Java Virtual Machine. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/57vk0d79j94d0lk0vol8xn935yv1shdd - http://www.openwall.com/lists/oss-security/2022/11/03/4
CVE ID: CVE-2022-32288 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:19:33.389Z Description: No description available.
CVE ID: CVE-2022-32289 State: PUBLISHED Published: 2022-07-21T15:29:30.376Z Last Updated: 2025-02-20T20:17:36.812Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Sygnoos Products: Popup Builder (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/popup-builder/#developers - https://patchstack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-0-cross-site-request-forgery-csrf-vulne
tack.com/database/vulnerability/popup-builder/wordpress-popup-builder-plugin-4-1-0-cross-site-request-forgery-csrf-vulnerability-leading-to-popup-status-change
CVE ID: CVE-2022-32290 State: PUBLISHED Published: 2022-07-06T11:12:55 Last Updated: 2024-08-03T07:39:50.385Z Vendors: n/a Products: n/a Problem Types: n/a Description: The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead of only the localhost interface. Therefore, any client on the same network can connect to this TCP port and send HTTP requests. The Mender Client will forward these requests to the Mender Server. Additionally, if mTLS is set up, the Me
TP requests. The Mender Client will forward these requests to the Mender Server. Additionally, if mTLS is set up, the Mender Client will connect to the Mender Server using the device's client certificate, making it possible for the attacker to bypass mTLS authentication and send requests to the Mender Server without direct access to the client certificate and related private key. Accessing the HTTP proxy from the local network doesn't represent a direct threat, because it doesn't expose any device or server-specific data. However, it increases the attack surface and can be a potential vector to exploit other vulnerabilities both on the Client and the Server. Additional Analyst Notes: - CVE P
a potential vector to exploit other vulnerabilities both on the Client and the Server. Additional Analyst Notes: - CVE Program Container: References: - https://northern.tech - https://mender.io/blog/cve-2022-32290-mender-client-listening-on-all-the-interfaces
CVE ID: CVE-2022-32291 State: PUBLISHED Published: 2022-06-05T21:23:45 Last Updated: 2024-08-03T07:39:50.541Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Real Player through 20.1.0.312, attackers can execute arbitrary code by placing a UNC share pathname (for a DLL file) in a RAM file. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Edubr2020/RP_RecordClip_DLL_Hijack
CVE ID: CVE-2022-32292 State: PUBLISHED Published: 2022-08-03T00:00:00 Last Updated: 2024-08-03T07:39:50.610Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ConnMan through 1.41, remote attackers able to send HTTP requests to the gweb component are able to exploit a heap-based buffer overflow in received_data to execute code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1200189 - https://lore.kernel.org/connman/20220801080043.4861-5-wagi%40monom.org/ - https://www.debian.org/security/2022/dsa-5231 - https://security.gentoo.org/glsa/202310-21
CVE ID: CVE-2022-32293 State: PUBLISHED Published: 2022-08-03T00:00:00 Last Updated: 2024-08-03T07:39:50.262Z Vendors: n/a Products: n/a Problem Types: n/a Description: In ConnMan through 1.41, a man-in-the-middle attack against a WISPR HTTP query could be used to trigger a use-after-free in WISPR handling, leading to crashes or code execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.suse.com/show_bug.cgi?id=1200190 - https://lore.kernel.org/connman/20220801080043.4861-3-wagi%40monom.org/ - https://lore.kernel.org/connman/20220801080043.4861-1-wagi%40monom.org/ - https://www.debian.org/security/2022/dsa-5231 - https://security.gentoo.org/glsa/202310-
0043.4861-1-wagi%40monom.org/ - https://www.debian.org/security/2022/dsa-5231 - https://security.gentoo.org/glsa/202310-21
CVE ID: CVE-2022-32294 State: PUBLISHED Published: 2022-07-11T00:00:00 Last Updated: 2024-08-03T07:39:50.523Z Vendors: n/a Products: n/a Problem Types: n/a Description: Zimbra Collaboration Open Source 8.8.15 does not encrypt the initial-login randomly created password (from the "zmprove ca" command). It is visible in cleartext on port UDP 514 (aka the syslog port). NOTE: a third party reports that this cannot be reproduced. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://wiki.zimbra.com/wiki/Zimbra_Security_Advisories - https://wiki.zimbra.com/wiki/Security_Center - https://medium.com/%40soheil.samanabadi/zimbra-8-8-15-zmprove-ca-command-inc
ps://wiki.zimbra.com/wiki/Security_Center - https://medium.com/%40soheil.samanabadi/zimbra-8-8-15-zmprove-ca-command-incorrect-access-control-8088032638e - https://github.com/soheilsamanabadi/vulnerabilitys/blob/main/Zimbra%208.8.15%20zmprove%20ca%20command - https://github.com/soheilsamanabadi/vulnerabilitys/pull/1
CVE ID: CVE-2022-32295 State: PUBLISHED Published: 2022-06-30T23:28:16 Last Updated: 2024-08-03T07:39:50.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: On Ampere Altra and AltraMax devices before SRP 1.09, the Altra reference design of UEFI accesses allows insecure access to SPI-NOR by the OS/hypervisor component. Additional Analyst Notes: - CVE Program Container: References: - https://amperecomputing.com - https://amperecomputing.com/products/security-bulletins/altra-spi-nor-smc-protection-for-ampere-website.html - https://amperecomputing.com/products/security-bulletins/altra-spi-nor-smc.html
CVE ID: CVE-2022-32296 State: PUBLISHED Published: 2022-06-05T21:53:54 Last Updated: 2024-08-03T07:39:50.938Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Linux kernel before 5.17.9 allows TCP servers to identify clients by observing what source ports are used. This occurs because of use of Algorithm 4 ("Double-Hash Port Selection Algorithm") of RFC 6056. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4c2c8f03a5ab7cb04ec64724d7d176d00bcc91e5 - https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.17.9 - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - https://
g/pub/linux/kernel/v5.x/ChangeLog-5.17.9 - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - https://www.debian.org/security/2022/dsa-5173 - https://arxiv.org/abs/2209.12993 - https://github.com/0xkol/rfc6056-device-tracker
CVE ID: CVE-2022-32297 State: PUBLISHED Published: 2022-07-14T19:04:39 Last Updated: 2024-08-03T07:39:50.600Z Vendors: n/a Products: n/a Problem Types: n/a Description: Piwigo v12.2.0 was discovered to contain SQL injection vulnerability via the Search function. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sth276/research/blob/main/piwigo_vul/Second-Order%20SQL%20Injection%20Vulnerabilities%20in%20Piwigo.md
CVE ID: CVE-2022-32298 State: PUBLISHED Published: 2022-07-14T19:12:42 Last Updated: 2024-08-03T07:39:50.934Z Vendors: n/a Products: n/a Problem Types: n/a Description: Toybox v0.8.7 was discovered to contain a NULL pointer dereference via the component httpd.c. This vulnerability can lead to a Denial of Service (DoS) via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/landley/toybox/issues/346
CVE ID: CVE-2022-32299 State: PUBLISHED Published: 2022-06-15T16:21:05 Last Updated: 2024-08-03T07:39:50.719Z Vendors: n/a Products: n/a Problem Types: n/a Description: YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the id parameter at /App/Lib/Action/Admin/SiteAction.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.yuque.com/docs/share/a296c6fe-8af7-4e01-bc14-3ad13d6335ed
CVE ID: CVE-2022-32300 State: PUBLISHED Published: 2022-06-15T16:21:07 Last Updated: 2024-08-03T07:39:50.941Z Vendors: n/a Products: n/a Problem Types: n/a Description: YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the MailSendID parameter at /App/Lib/Action/Admin/MailAction.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.yuque.com/docs/share/bf37643b-9782-4320-9ca9-cf38a331b686
CVE ID: CVE-2022-32301 State: PUBLISHED Published: 2022-06-15T16:21:07 Last Updated: 2024-08-03T07:39:50.983Z Vendors: n/a Products: n/a Problem Types: n/a Description: YoudianCMS v9.5.0 was discovered to contain a SQL injection vulnerability via the IdList parameter at /App/Lib/Action/Home/ApiAction.class.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.yuque.com/docs/share/8864c0c7-ad8e-407f-98d3-104d2f2dd13e
CVE ID: CVE-2022-32302 State: PUBLISHED Published: 2022-06-15T16:21:08 Last Updated: 2024-08-03T07:39:50.641Z Vendors: n/a Products: n/a Problem Types: n/a Description: Theme Park Ticketing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at edit_ticket.php. Additional Analyst Notes: - CVE Program Container: References: - https://www.yuque.com/docs/share/0255145d-8a60-4045-a5d2-fd82232e0faa
CVE ID: CVE-2022-32308 State: PUBLISHED Published: 2022-07-13T19:50:46 Last Updated: 2024-08-03T07:39:50.960Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cross Site Scripting (XSS) vulnerability in uBlock Origin extension before 1.41.1 allows remote attackers to run arbitrary code via a spoofed 'MessageSender.url' to the browser renderer process. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/uBlockOrigin/uBlock-issues/issues/1992
CVE ID: CVE-2022-32310 State: PUBLISHED Published: 2022-07-05T19:27:18 Last Updated: 2024-08-03T07:39:50.367Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in Ingredient Stock Management System v1.0 allows attackers to take over user accounts via a crafted POST request to /isms/classes/Users.php. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/167291/Ingredient-Stock-Management-System-1.0-Account-Takeover.html
CVE ID: CVE-2022-32311 State: PUBLISHED Published: 2022-07-05T19:27:19 Last Updated: 2024-08-03T07:39:50.849Z Vendors: n/a Products: n/a Problem Types: n/a Description: Ingredient Stock Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /isms/admin/stocks/view_stock.php. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/167290/Ingredient-Stock-Management-System-1.0-SQL-Injection.html
CVE ID: CVE-2022-32317 State: PUBLISHED Published: 2022-07-14T00:00:00 Last Updated: 2024-08-03T07:39:50.803Z Vendors: n/a Products: n/a Problem Types: n/a Description: The MPlayer Project v1.5 was discovered to contain a heap use-after-free resulting in a double free in the preinit function at libvo/vo_v4l2.c. This vulnerability can lead to a Denial of Service (DoS) via a crafted file. The device=strdup statement is not executed on every call. Note: This has been disputed by third parties as invalid and not reproduceable. Additional Analyst Notes: - CVE Program Container: References: - https://transfer.sh/m2WcuM/poc_dup.zip - https://bugs.gentoo.org/show_bug.cgi?id=858107 - https://github.c
References: - https://transfer.sh/m2WcuM/poc_dup.zip - https://bugs.gentoo.org/show_bug.cgi?id=858107 - https://github.com/b17fr13nds/MPlayer_cve_poc
CVE ID: CVE-2022-32318 State: PUBLISHED Published: 2022-07-14T19:45:48 Last Updated: 2024-08-03T07:39:50.903Z Vendors: n/a Products: n/a Problem Types: n/a Description: Fast Food Ordering System v1.0 was discovered to contain a persistent cross-site scripting (XSS) vulnerability via the component /ffos/classes/Master.php?f=save_category. Additional Analyst Notes: - CVE Program Container: References: - https://packetstormsecurity.com/files/167309/Fast-Food-Ordering-System-1.0-Cross-Site-Scripting.html
CVE ID: CVE-2022-32320 State: PUBLISHED Published: 2022-07-17T16:24:10 Last Updated: 2024-08-03T07:39:50.890Z Vendors: n/a Products: n/a Problem Types: n/a Description: A Cross-Site Request Forgery (CSRF) in Ferdi through 5.8.1 and Ferdium through 6.0.0-nightly.98 allows attackers to read files via an uploaded file such as a settings/preferences file. Additional Analyst Notes: - CVE Program Container: References: - https://getferdi.com/ - https://github.com/getferdi/ferdi - https://gist.github.com/omriinbar-cyesec/c1179fe99725d2b828b6573c0d110c9c
CVE ID: CVE-2022-32323 State: PUBLISHED Published: 2022-07-14T20:11:45 Last Updated: 2024-08-03T07:39:50.472Z Vendors: n/a Products: n/a Problem Types: n/a Description: AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/autotrace/autotrace/commit/2b44c173027736c64b3f379bd154c41bab745423 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UKZPC4WCDOJ7BPJOMZ46AV27RCABZRYA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4CZVCQH4L7KC5GXLU6SCESXR5TGSKQ2H/
CVE ID: CVE-2022-32324 State: PUBLISHED Published: 2022-07-01T21:18:56 Last Updated: 2024-08-03T07:39:51.042Z Vendors: n/a Products: n/a Problem Types: n/a Description: PDFAlto v0.4 was discovered to contain a heap buffer overflow via the component /pdfalto/src/pdfalto.cc. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kermitt2/pdfalto/issues/144