Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
| Passwordless login.This issue affects miniOrange's Google Authenticator – WordPress Two Factor Authentication – 2FA , Two Factor, OTP SMS and Email | Passwordless login: from n/a through 5.6.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/miniorange-2-factor-authentication/wordpress-miniorange-two-factor-authentication-plugin-5-6-1-sensitive-data-exposure-vulnerability?_s_id=cve
CVE ID: CVE-2022-44590 State: PUBLISHED Published: 2022-11-09T21:14:28.257604Z Last Updated: 2024-09-16T17:27:46.217Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: James Lao Products: Simple Video Embedder (WordPress plugin) Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in James Lao's Simple Video Embedder plugin <= 2.2 on WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/simple-video-embedder/wordpress-simple-video-embedder-plugin-2-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/plugins/s
video-embedder-plugin-2-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/plugins/simple-video-embedder/
CVE ID: CVE-2022-44591 State: PUBLISHED Published: 2022-11-17T22:09:58.706495Z Last Updated: 2024-09-16T19:31:40.040Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: One Week | One Tool Products: Anthologize (WordPress plugin) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Anthologize plugin <= 0.8.0 on WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/anthologize/wordpress-anthologize-plugin-0-8-0-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-44593 State: PUBLISHED Published: 2024-06-21T15:56:46.714Z Last Updated: 2024-08-03T13:54:03.957Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: SolidWP Products: Solid Security Problem Types: CWE-348 Description: Use of Less Trusted Source vulnerability in SolidWP Solid Security allows HTTP DoS.This issue affects Solid Security: from n/a through 9.3.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/better-wp-security/wordpress-solid-security-plugin-9-3-1-ip-spoofing-leading-to-denial-of-service-vulnerability?_s_id=cve
CVE ID: CVE-2022-44594 State: PUBLISHED Published: 2023-04-23T09:02:00.078Z Last Updated: 2025-01-10T18:47:11.097Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Codebangers Products: All in One Time Clock Lite Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Codebangers All in One Time Clock Lite plugin <= 1.3.320 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/aio-time-clock-lite/wordpress-all-in-one-time-clock-lite-plugin-1-3-320-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-44595 State: PUBLISHED Published: 2024-03-21T17:12:32.657Z Last Updated: 2024-08-09T20:15:26.378Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Melapress Products: WP 2FA Problem Types: CWE-287 Description: Improper Authentication vulnerability in Melapress WP 2FA allows Authentication Bypass.This issue affects WP 2FA: from n/a through 2.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-2fa/wordpress-wp2fa-plugin-2-2-0-broken-authentication-vulnerability?_s_id=cve
CVE ID: CVE-2022-44606 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T13:59:22.509Z Vendors: UNIMO Technology Co., Ltd Products: UDR-JA1604/UDR-JA1608/UDR-JA1616 Problem Types: OS Command Injection Description: OS command injection vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.unimo.co.jp/table_notice/index.php?act=1&resid=1666831567-004418 - https://jvn.jp/en/vu/JVNVU94514762/index.html
CVE ID: CVE-2022-44607 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:21:23.594Z Description: No description available.
CVE ID: CVE-2022-44608 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T13:56:53.043Z Vendors: Cybozu, Inc. Products: Cybozu Remote Service Problem Types: Uncontrolled Resource Consumption Description: Uncontrolled resource consumption vulnerability in Cybozu Remote Service 4.0.0 to 4.0.3 allows a remote authenticated attacker to consume huge storage space, which may result in a denial-of-service (DoS) condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cs.cybozu.co.jp/2022/007754.html - https://jvn.jp/en/jp/JVN87895771/index.html
CVE ID: CVE-2022-44609 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:21:25.010Z Description: No description available.
CVE ID: CVE-2022-44610 State: PUBLISHED Published: 2023-05-10T13:17:13.986Z Last Updated: 2025-01-24T17:36:08.919Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: n/a Products: Intel(R) DCM software Problem Types: escalation of privilege, CWE-287 Description: Improper authentication in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00806.html
CVE ID: CVE-2022-44611 State: PUBLISHED Published: 2023-08-11T02:37:00.887Z Last Updated: 2025-02-13T16:33:41.662Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L) Vendors: n/a Products: Intel(R) Processors Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via adjacent access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00813.html - https://security.netapp.com/advisory/ntap-20230824-0001/
CVE ID: CVE-2022-44612 State: PUBLISHED Published: 2023-08-11T02:37:21.903Z Last Updated: 2024-10-04T13:05:38.879Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Unison(TM) software Problem Types: information disclosure, CWE-798 Description: Use of hard-coded credentials in some Intel(R) Unison(TM) software before version 10.12 may allow an authenticated user user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00897.html
CVE ID: CVE-2022-44613 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:21:26.448Z Description: No description available.
CVE ID: CVE-2022-44614 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:21:27.900Z Description: No description available.
CVE ID: CVE-2022-44617 State: PUBLISHED Published: 2023-02-06T00:00:00.000Z Last Updated: 2025-03-25T20:05:14.184Z Vendors: n/a Products: libXpm Problem Types: CWE-20 Description: A flaw was found in libXpm. When processing a file with width of 0 and a very large height, some parser functions will be called repeatedly and can lead to an infinite loop, resulting in a Denial of Service in the application linked to the library. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2160193 - https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28 - https://gitlab.freedesktop.org/xorg/lib/libxpm
/gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/f80fa6ae47ad4a5beacb28 - https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9 - https://lists.x.org/archives/xorg-announce/2023-January/003312.html - https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html
CVE ID: CVE-2022-44618 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:21:29.328Z Description: No description available.
CVE ID: CVE-2022-44619 State: PUBLISHED Published: 2023-05-10T13:17:11.901Z Last Updated: 2025-01-27T18:00:58.397Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) DCM software Problem Types: escalation of privilege, CWE-922 Description: Insecure storage of sensitive information in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00806.html
CVE ID: CVE-2022-44620 State: PUBLISHED Published: 2022-12-07T00:00:00.000Z Last Updated: 2025-04-23T13:55:14.349Z Vendors: UNIMO Technology Co., Ltd Products: UDR-JA1604/UDR-JA1608/UDR-JA1616 Problem Types: Improper Authentication Description: Improper authentication vulnerability in UDR-JA1604/UDR-JA1608/UDR-JA1616 firmware versions 71x10.1.107112.43A and earlier allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.unimo.co.jp/table_notice/index.php?act=1&resid=1666831567-004418 - https://jvn.jp/en/vu/JVNVU94514762/index.html
CVE ID: CVE-2022-44621 State: PUBLISHED Published: 2022-12-30T10:31:52.614Z Last Updated: 2025-04-11T14:45:20.170Z Vendors: Apache Software Foundation Products: Apache Kylin Problem Types: Command injection Description: Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/7ctchj24dofgsj9g1rg1245cms9myb34
CVE ID: CVE-2022-44622 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-02T14:09:55.418Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-284 Description: In JetBrains TeamCity version between 2021.2 and 2022.10 access permissions for secure token health items were excessive Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-44623 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-04-30T18:52:54.855Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-538 Description: In JetBrains TeamCity version before 2022.10, Project Viewer could see scrambled secure values in the MetaRunner settings Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-44624 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-02T19:33:33.094Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: JetBrains Products: TeamCity Problem Types: CWE-532 Description: In JetBrains TeamCity version before 2022.10, Password parameters could be exposed in the build log if they contained special characters Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jetbrains.com/privacy-security/issues-fixed/
CVE ID: CVE-2022-44625 State: PUBLISHED Published: 2023-04-13T11:29:41.873Z Last Updated: 2025-02-19T21:33:30.775Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Zephilou Products: Cyklodev WP Notify Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting') vulnerability in Zephilou Cyklodev WP Notify plugin <= 1.2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cyklodev-wp-notify/wordpress-cyklodev-wp-notify-plugin-1-2-1-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-44626 State: PUBLISHED Published: 2024-03-25T11:15:37.560Z Last Updated: 2024-08-03T13:54:03.931Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Squirrly Products: SEO Plugin by Squirrly SEO Problem Types: CWE-862 Description: Missing Authorization vulnerability in Squirrly SEO Plugin by Squirrly SEO.This issue affects SEO Plugin by Squirrly SEO: from n/a through 12.1.20. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/squirrly-seo/wordpress-squirrly-seo-peaks-plugin-12-1-20-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2022-44627 State: PUBLISHED Published: 2022-11-03T19:30:57.618Z Last Updated: 2025-02-20T19:56:49.000Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: David Cole Products: Simple SEO (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in David Cole Simple SEO plugin <= 1.8.12 on WordPress allows attackers to create or delete sitemaps. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/cds-simple-seo/#developers - https://patchstack.com/database/vulnerability/cds-simple-seo/wordpress-simple-seo-plugin-1-8-12-cross-site-request-fo
- https://patchstack.com/database/vulnerability/cds-simple-seo/wordpress-simple-seo-plugin-1-8-12-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-44628 State: PUBLISHED Published: 2022-11-03T19:32:26.430Z Last Updated: 2025-02-20T19:56:42.245Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: JumpDEMAND Inc. Products: 4ECPS Web Forms (WordPress plugin) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in JumpDEMAND Inc. 4ECPS Web Forms plugin <= 0.2.17 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/4ecps-webforms/wordpress-4ecps-web-forms-plugin-0-2-17-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/pl
ss-4ecps-web-forms-plugin-0-2-17-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve - https://wordpress.org/plugins/4ecps-webforms/
CVE ID: CVE-2022-44629 State: PUBLISHED Published: 2023-08-10T09:40:08.635Z Last Updated: 2024-09-25T16:45:06.055Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Catalyst Connect Products: Catalyst Connect Zoho CRM Client Portal Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin <= 2.0.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/catalyst-connect-client-portal/wordpress-catalyst-connect-zoho-crm-client-portal-plugin-2-0-0-auth-stored-cross-site
ity/catalyst-connect-client-portal/wordpress-catalyst-connect-zoho-crm-client-portal-plugin-2-0-0-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-44631 State: PUBLISHED Published: 2023-04-23T08:48:09.641Z Last Updated: 2025-01-10T18:49:58.348Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: 1app Technologies, Inc Products: 1app Business Forms Problem Types: CWE-79 Description: Auth. (author+) Stored Cross-Site Scripting (XSS) vulnerability in 1app Technologies, Inc 1app Business Forms plugin <= 1.0.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/1app-business-forms/wordpress-1app-business-forms-plugin-1-0-0-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-44632 State: PUBLISHED Published: 2023-04-18T13:18:50.051Z Last Updated: 2025-01-10T18:50:32.594Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Denis Buka Products: Content Repeater – Custom Posts Simplified Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Denis Buka Content Repeater – Custom Posts Simplified plugin <= 1.1.13 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/content-repeater/wordpress-content-repeater-plugin-1-1-13-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-44633 State: PUBLISHED Published: 2024-03-21T17:44:27.827Z Last Updated: 2024-08-03T13:54:04.012Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: YITH Products: YITH WooCommerce Gift Cards Premium Problem Types: CWE-862 Description: Missing Authorization vulnerability in YITH YITH WooCommerce Gift Cards Premium.This issue affects YITH WooCommerce Gift Cards Premium: from n/a through 3.23.1. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/yith-woocommerce-gift-cards-premium/wordpress-yith-woocommerce-gift-cards-premium-plugin-3-23-1-unauth-gift-card-creati
/yith-woocommerce-gift-cards-premium/wordpress-yith-woocommerce-gift-cards-premium-plugin-3-23-1-unauth-gift-card-creation-leading-to-stored-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-44634 State: PUBLISHED Published: 2022-11-18T21:58:16.612Z Last Updated: 2025-02-20T19:51:34.424Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: VillaTheme Products: S2W – Import Shopify to WooCommerce (WordPress plugin) Problem Types: Local File Inclusion (LFI) Description: Auth. (admin+) Arbitrary File Read vulnerability in S2W – Import Shopify to WooCommerce plugin <= 1.1.12 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/import-shopify-to-woocommerce/wordpress-s2w-import-shopify-to-woocommerce-plugin-1-1-12-auth-local-file-inclusion-lfi
ty/import-shopify-to-woocommerce/wordpress-s2w-import-shopify-to-woocommerce-plugin-1-1-12-auth-local-file-inclusion-lfi-vulnerability?_s_id=cve - https://wordpress.org/plugins/import-shopify-to-woocommerce/#developers
CVE ID: CVE-2022-44635 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:51:14.718Z Vendors: Apache Software Foundation Products: Apache Fineract Problem Types: CWE-22 Description: Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. This issue affects Apache Fineract version 1.8.0 and prior versions. We recommend users to upgrade to 1.8.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/t8q6fmh3o6yqmy69qtqxppk9yg9wfybg - http://www.openwa
ISA ADP Vulnrichment: References: - https://lists.apache.org/thread/t8q6fmh3o6yqmy69qtqxppk9yg9wfybg - http://www.openwall.com/lists/oss-security/2022/11/29/3
CVE ID: CVE-2022-44636 State: PUBLISHED Published: 2022-12-13T00:00:00.000Z Last Updated: 2025-04-22T03:23:50.706Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Samsung TV (2021 and 2022 model) smart remote control allows attackers to enable microphone access via Bluetooth spoofing when a user is activating remote control by pressing a button. This is fixed in xxx72510, E9172511 for 2021 models, xxxA1000, 4x2A0200 for 2022 models. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://samsung.com - https://samsungtvbounty.com/securityUpdates
CVE ID: CVE-2022-44637 State: PUBLISHED Published: 2022-12-12T00:00:00.000Z Last Updated: 2025-04-23T13:53:41.810Z Vendors: n/a Products: n/a Problem Types: n/a Description: Redmine before 4.2.9 and 5.0.x before 5.0.4 allows persistent XSS in its Textile formatter due to improper sanitization in Redcloth3 Textile-formatted fields. Depending on the configuration, this may require login as a registered user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.redmine.org/projects/redmine/wiki/Security_Advisories
CVE ID: CVE-2022-44638 State: PUBLISHED Published: 2022-11-03T00:00:00.000Z Last Updated: 2025-05-02T19:12:26.755Z Vendors: n/a Products: n/a Problem Types: n/a Description: In libpixman in Pixman before 0.42.2, there is an out-of-bounds write (aka heap-based buffer overflow) in rasterize_edges_8 due to an integer overflow in pixman_sample_floor_y. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.freedesktop.org/pixman/pixman/-/issues/63 - http://www.openwall.com/lists/oss-security/2022/11/05/1 - https://lists.debian.org/debian-lts-announce/2022/11/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fe
rg/debian-lts-announce/2022/11/msg00008.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BY4OPSIB33ETNUXZY2UPZ4NGQ3OKDY4D/ - https://www.debian.org/security/2022/dsa-5276 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AJ5VY2VYXE4WTRGQ6LMGLF6FV3SY37YE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUJ2BULJTZ2BMSKQHB6US674P55UCWWS/ - http://packetstormsecurity.com/files/170121/pixman-pixman_sample_floor_y-Integer-Overflow.html
CVE ID: CVE-2022-44640 State: PUBLISHED Published: 2022-12-25T00:00:00.000Z Last Updated: 2025-04-15T13:20:13.623Z Vendors: n/a Products: n/a Problem Types: n/a Description: Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/heimdal/heimdal/security/advisories/GHSA-88pm-hfmq-7vv4 - https://security.netapp.com/advisory/ntap-20230216-0008/ - https://security.gentoo.org/glsa/202310-06
CVE ID: CVE-2022-44641 State: PUBLISHED Published: 2022-11-18T00:00:00.000Z Last Updated: 2025-04-29T19:02:39.780Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Linaro Automated Validation Architecture (LAVA) before 2022.11, users with valid credentials can submit crafted XMLRPC requests that cause a recursive XML entity expansion, leading to excessive use of memory on the server and a Denial of Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.lavasoftware.org/archives/list/lava-announce%40lists.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY/ - https://www.debian.org/security/2023/dsa-5318 - https://lis
.lavasoftware.org/thread/WHXGQMIZAPW3GCQEXYHC32N2ZAAAIYCY/ - https://www.debian.org/security/2023/dsa-5318 - https://lists.debian.org/debian-lts-announce/2023/01/msg00016.html