Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2099 State: PUBLISHED Published: 2022-07-17T10:35:52 Last Updated: 2024-08-03T00:24:44.425Z Vendors: Unknown Products: WooCommerce Problem Types: CWE-116 Improper Encoding or Escaping of Output Description: The WooCommerce WordPress plugin before 6.6.0 is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0316e5f3-3302-40e3-8ff4-be3423a3be7b
CVE ID: CVE-2022-2100 State: PUBLISHED Published: 2022-07-17T10:35:58 Last Updated: 2024-08-03T00:24:44.173Z Vendors: Unknown Products: Page Generator Problem Types: CWE-79 Description: The Page Generator WordPress plugin before 1.6.5 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7d8b7871-baa5-4a54-a9e9-2c9d302cdd12
CVE ID: CVE-2022-2101 State: PUBLISHED Published: 2022-07-18T16:13:21 Last Updated: 2024-08-03T00:24:44.260Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: codename065 Products: Download Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `file[files][]` parameter in versions up to, and including, 3.2.46 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts
es it possible for authenticated attackers with contributor level permissions and above to inject arbitrary web scripts on the file's page that will execute whenever an administrator accesses the editor area for the injected file page. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b399929a-db33-419f-9218-b86ee88a9f1a?source=cve - https://packetstormsecurity.com/files/167573/ - https://medium.com/%40andreabocchetti88/download-manager-3-2-43-contributor-cross-site-scripting-fa4970fba45c - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2750339%40download-manager&new=2750339%40download-
gins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2750339%40download-manager&new=2750339%40download-manager&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2101
CVE ID: CVE-2022-2102 State: PUBLISHED Published: 2022-06-24T15:00:33.724Z Last Updated: 2025-04-16T16:16:00.619Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Secheron Products: SEPCOS Control and Protection Relay firmware package Problem Types: CWE-841 Description: Controls limiting uploads to certain file extensions may be bypassed. This could allow an attacker to intercept the initial file upload page response and modify the associated code. This modified code can be forwarded and used by a script loaded later in the sequence, allowing for arbitrary file upload into a location where PHP scripts may be executed. Additional Analyst Notes: - CVE Program
ing for arbitrary file upload into a location where PHP scripts may be executed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE ID: CVE-2022-2103 State: PUBLISHED Published: 2022-06-24T15:00:28.743Z Last Updated: 2025-04-16T16:16:38.589Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Secheron Products: SEPCOS Control and Protection Relay firmware package Problem Types: CWE-284 Description: An attacker with weak credentials could access the TCP port via an open FTP port, allowing an attacker to read sensitive files and write to remotely executable directories. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE ID: CVE-2022-2104 State: PUBLISHED Published: 2022-06-24T15:00:31.124Z Last Updated: 2025-04-16T17:51:54.147Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: Secheron Products: SEPCOS Control and Protection Relay firmware package Problem Types: CWE-269 Description: The www-data (Apache web server) account is configured to run sudo with no password for many commands (including /bin/sh and /bin/bash). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE ID: CVE-2022-2105 State: PUBLISHED Published: 2022-06-24T15:00:31.926Z Last Updated: 2025-04-16T16:16:16.151Z Severity: CRITICAL (CVSS 9.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: Secheron Products: SEPCOS Control and Protection Relay firmware package Problem Types: CWE-841 Description: Client-side JavaScript controls may be bypassed to change user credentials and permissions without authentication, including a “root” user level meant only for the vendor. Web server root level access allows for changing of safety critical parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-1
es: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE ID: CVE-2022-2106 State: PUBLISHED Published: 2022-06-27T16:15:32.000Z Last Updated: 2025-04-16T16:15:46.034Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: Elcomplus Products: SmartICS Problem Types: CWE-23 Description: Elcomplus SmartICS v2.3.4.0 does not validate the filenames sufficiently, which enables authenticated administrator-level users to perform path traversal attacks and specify arbitrary files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-05
CVE ID: CVE-2022-2107 State: PUBLISHED Published: 2022-07-20T15:24:35.820Z Last Updated: 2025-04-16T16:14:52.167Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: MiCODUS Products: MV720 Problem Types: CWE-798 Description: The MiCODUS MV720 GPS tracker API server has an authentication mechanism that allows devices to use a hard-coded master password. This may allow an attacker to send SMS commands directly to the GPS tracker as if they were coming from the GPS owner’s mobile number. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01
CVE ID: CVE-2022-2108 State: PUBLISHED Published: 2022-07-18T16:12:54.000Z Last Updated: 2025-05-05T16:20:27.901Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: wbcomdesigns Products: Wbcom Designs – BuddyPress Group Reviews Problem Types: CWE-862 Missing Authorization Description: The plugin Wbcom Designs – BuddyPress Group Reviews for WordPress is vulnerable to unauthorized settings changes and review modification due to missing capability checks and improper nonce checks in several functions related to said actions in versions up to, and including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the af
d including, 2.8.3. This makes it possible for unauthenticated attackers to modify reviews and plugin settings on the affected site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/397dabc3-5dcf-4d1f-9e24-28af889cb76f?source=cve - https://plugins.trac.wordpress.org/browser/review-buddypress-groups/trunk/includes/bgr-ajax.php#L359 - https://plugins.trac.wordpress.org/changeset/2742109 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2108
CVE ID: CVE-2022-2111 State: PUBLISHED Published: 2022-06-17T10:10:10 Last Updated: 2024-08-03T00:24:44.204Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: inventree Products: inventree/inventree Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository inventree/inventree prior to 0.7.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a0e5c68e-0f75-499b-bd7b-d935fb8c0cd1 - https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f
CVE ID: CVE-2022-2112 State: PUBLISHED Published: 2022-06-17T10:15:16 Last Updated: 2024-08-03T00:24:44.196Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: inventree Products: inventree/inventree Problem Types: CWE-1236 Description: Improper Neutralization of Formula Elements in a CSV File in GitHub repository inventree/inventree prior to 0.7.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f - https://huntr.dev/bounties/e57c36e7-fa39-435f-944a-3a52ee066f73
CVE ID: CVE-2022-2113 State: PUBLISHED Published: 2022-06-17T10:20:10 Last Updated: 2024-08-03T00:24:44.184Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: inventree Products: inventree/inventree Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.7.2. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/inventree/inventree/commit/26bf51c20a1c9b3130ac5dd2e17649bece5ff84f - https://huntr.dev/bounties/4cae8442-c042-43c2-ad89-6f666eaf3d57
CVE ID: CVE-2022-2114 State: PUBLISHED Published: 2022-07-17T10:36:05 Last Updated: 2024-08-03T00:24:44.274Z Vendors: Unknown Products: Data Tables Generator by Supsystic Problem Types: CWE-79 Description: The Data Tables Generator by Supsystic WordPress plugin before 1.10.20 does not sanitise and escape some of its Table settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/59911ba4-fa06-498a-9e7c-0c337cce691c
CVE ID: CVE-2022-2115 State: PUBLISHED Published: 2022-07-25T12:46:58 Last Updated: 2024-08-03T00:24:44.274Z Vendors: Unknown Products: Popup Anything – A Marketing Popup and Lead Generation Conversions Problem Types: CWE-79 Description: The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1f0ae535-c560-4510-ae9a-059e2435ad39
CVE ID: CVE-2022-2116 State: PUBLISHED Published: 2022-08-15T08:35:51 Last Updated: 2024-08-03T00:24:44.325Z Vendors: Unknown Products: Contact Form DB – Elementor Problem Types: CWE-79 Description: The Contact Form DB WordPress plugin before 1.8.0 does not sanitise and escape some parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/01568da4-2ecf-4cf9-8030-31868ce0a87a
CVE ID: CVE-2022-2117 State: PUBLISHED Published: 2022-07-18T16:16:48 Last Updated: 2024-08-03T00:24:44.254Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: webdevmattcrom Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-200 Information Exposure Description: The GiveWP plugin for WordPress is vulnerable to Sensitive Information Disclosure in versions up to, and including, 2.20.2 via the /donor-wall REST-API endpoint which provides unauthenticated users with donor information even when the donor wall is not enabled. This functionality has been completely removed in version 2.20.2. Additional Analyst Notes: - CVE Program Container
led. This functionality has been completely removed in version 2.20.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/addae413-1fc5-427f-a5ef-3da705cbeb5b?source=cve - https://plugins.trac.wordpress.org/changeset/2743833/give/tags/2.21.0/includes/api/class-give-api-v2.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2117
CVE ID: CVE-2022-2118 State: PUBLISHED Published: 2022-07-17T10:36:11 Last Updated: 2024-08-03T00:24:44.265Z Vendors: Unknown Products: 404s Problem Types: CWE-79 Description: The 404s WordPress plugin before 3.5.1 does not sanitise and escape its fields, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9a19af60-d6e6-4fa3-82eb-3636599b814c
CVE ID: CVE-2022-2119 State: PUBLISHED Published: 2022-06-24T15:00:20.534Z Last Updated: 2025-11-03T19:26:43.951Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OFFIS Products: DCMTK Problem Types: CWE-22 Description: OFFIS DCMTK's (All versions prior to 3.6.7) service class provider (SCP) is vulnerable to path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01
CVE ID: CVE-2022-2120 State: PUBLISHED Published: 2022-06-24T15:00:18.707Z Last Updated: 2025-11-03T19:26:45.345Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OFFIS Products: DCMTK Problem Types: CWE-23 Description: OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write DICOM files into arbitrary directories under controlled names. This could allow remote code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01
CVE ID: CVE-2022-2121 State: PUBLISHED Published: 2022-06-24T15:00:19.612Z Last Updated: 2025-11-03T20:34:43.056Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: OFFIS Products: DCMTK Problem Types: CWE-476 Description: OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a denial-of-service condition. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-22-174-01 - https://lists.debian.org/debian-lts-announce/2024/06/msg00022.html
CVE ID: CVE-2022-2122 State: PUBLISHED Published: 2022-07-19T19:10:55 Last Updated: 2024-08-03T00:24:44.188Z Vendors: n/a Products: GStreamer Problem Types: CWE-122 Description: DOS / potential heap overwrite in qtdemux using zlib decompression. Integer overflow in qtdemux element in qtdemux_inflate function which causes a segfault, or could cause a heap overwrite, depending on libc and OS. Depending on the libc used, and the underlying OS capabilities, it could be just a segfault or a heap overwrite. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225 - https://lists.debian.org/debian-lts-announce/2022/08/msg00001
gitlab.freedesktop.org/gstreamer/gstreamer/-/issues/1225 - https://lists.debian.org/debian-lts-announce/2022/08/msg00001.html - https://www.debian.org/security/2022/dsa-5204
CVE ID: CVE-2022-2123 State: PUBLISHED Published: 2022-07-11T12:57:36 Last Updated: 2024-08-03T00:24:44.249Z Vendors: Unknown Products: WP Opt-in Problem Types: CWE-352 Description: The WP Opt-in WordPress plugin through 1.4.1 is vulnerable to CSRF which allows changed plugin settings and can be used for sending spam emails. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/46b634f6-92bc-4e00-a4c0-c25135c61922
CVE ID: CVE-2022-2124 State: PUBLISHED Published: 2022-06-19T00:00:00 Last Updated: 2024-08-03T00:24:44.258Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-126 Description: Buffer Over-read in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8e9e056d-f733-4540-98b6-414bf36e0b42 - https://github.com/vim/vim/commit/2f074f4685897ab7212e25931eeeb0212292829f - https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7C
l - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213443 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/43 - http://seclists.org/fulldisclosure/2022/Oct/45 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2125 State: PUBLISHED Published: 2022-06-19T00:00:00 Last Updated: 2024-08-03T00:24:44.280Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/17dab24d-beec-464d-9a72-5b6b11283705 - https://github.com/vim/vim/commit/0e8e938d497260dd57be67b4966cb27a5f72376f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/l
nnounce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213443 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/43 - http://seclists.org/fulldisclosure/2022/Oct/45 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2126 State: PUBLISHED Published: 2022-06-19T00:00:00 Last Updated: 2024-08-03T00:24:44.233Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8d196d9b-3d10-41d2-9f70-8ef0d08c946e - https://github.com/vim/vim/commit/156d3911952d73b03d7420dc3540215247db0fe8 - https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL
tml - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213443 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/43 - http://seclists.org/fulldisclosure/2022/Oct/45 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2127 State: PUBLISHED Published: 2023-07-20T14:49:49.422Z Last Updated: 2025-11-20T16:09:23.584Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Extended Update Support, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Virtualization 4 for Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Storage 3 Problem Types: CWE-125 Description: An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication,
was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c. When performing NTLM authentication, the client replies to cryptographic challenges back to the server. These replies have variable lengths, and Winbind fails to check the lan manager response length. When Winbind is used for NTLM authentication, a maliciously crafted request can trigger an out-of-bounds read in Winbind, possibly resulting in a crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2023:6667 - https://access.redhat.com/errata/RHSA-2023:7139 - https://access.redhat.com/errata/RHSA-2024:0423 - https://access.redhat.c
ps://access.redhat.com/errata/RHSA-2023:7139 - https://access.redhat.com/errata/RHSA-2024:0423 - https://access.redhat.com/errata/RHSA-2024:0580 - https://access.redhat.com/security/cve/CVE-2022-2127 - https://bugzilla.redhat.com/show_bug.cgi?id=2222791 - https://www.samba.org/samba/security/CVE-2022-2127.html
CVE ID: CVE-2022-2128 State: PUBLISHED Published: 2022-06-20T16:45:16 Last Updated: 2024-08-03T00:24:44.261Z Severity: CRITICAL (CVSS 9.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: polonel Products: polonel/trudesk Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ec40ec76-c7db-4384-a33b-024f3dd21d75 - https://github.com/polonel/trudesk/commit/fb2ef82b0a39d0a560a261e07c3c73ba25332ecb
CVE ID: CVE-2022-2129 State: PUBLISHED Published: 2022-06-19T00:00:00.000Z Last Updated: 2025-11-03T20:34:44.448Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-787 Description: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3aaf06e7-9ae1-454d-b8ca-8709c98e5352 - https://github.com/vim/vim/commit/d6211a52ab9f53b82f884561ed43d2fe4d24ff7d - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/lis
ounce%40lists.fedoraproject.org/message/GFD2A4YLBR7OIRHTL7CK6YNMEIQ264CN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U743FMJGFQ35GBPCQ6OWMVZEJPDFVEWM/ - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html - https://security.gentoo.org/glsa/202305-16