Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-47160 State: PUBLISHED Published: 2024-01-19T14:50:01.594Z Last Updated: 2025-06-17T21:19:22.585Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Wpmet Products: Wp Social Login and Register Social Counter Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wpmet Wp Social Login and Register Social Counter.This issue affects Wp Social Login and Register Social Counter: from n/a through 1.9.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-social/wordpress-wp-social-plugin-1-9-0-auth-sensitive
t: References: - https://patchstack.com/database/vulnerability/wp-social/wordpress-wp-social-plugin-1-9-0-auth-sensitive-information-disclosure-vulnerability?_s_id=cve
CVE ID: CVE-2022-47161 State: PUBLISHED Published: 2023-05-25T09:04:21.379Z Last Updated: 2025-01-08T22:00:46.839Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: The WordPress.org community Products: Health Check & Troubleshooting Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in The WordPress.Org community Health Check & Troubleshooting plugin <= 1.5.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/health-check/wordpress-health-check-troubleshooting-plugin-1-5-1-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47162 State: PUBLISHED Published: 2023-03-14T06:53:53.535Z Last Updated: 2025-01-13T15:53:07.891Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Dannie Herdyawan Products: DH – Anti AdBlocker Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Dannie Herdyawan DH – Anti AdBlocker plugin <= 36 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dh-anti-adblocker/wordpress-dh-anti-adblocker-plugin-36-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47163 State: PUBLISHED Published: 2023-03-14T06:48:02.141Z Last Updated: 2025-01-13T15:53:14.629Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Tips and Tricks HQ, josh401 Products: WP CSV to Database – Insert CSV file content into WordPress database Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV file content into WordPress plugin <= 2.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-csv-to-database/wordpress-wp-csv-to-database-plugin-2-6-cross
rences: - https://patchstack.com/database/vulnerability/wp-csv-to-database/wordpress-wp-csv-to-database-plugin-2-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-47164 State: PUBLISHED Published: 2023-05-25T08:27:25.137Z Last Updated: 2025-01-08T22:01:58.862Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: MagePeople Team Products: Event Manager and Tickets Selling Plugin for WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce plugin <= 3.7.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mage-eventpress/wordpress-event-manager-and-tickets-selling-plugin-for-woocommerce-plugin-3-7-7-cr
atabase/vulnerability/mage-eventpress/wordpress-event-manager-and-tickets-selling-plugin-for-woocommerce-plugin-3-7-7-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47165 State: PUBLISHED Published: 2023-05-25T09:07:22.356Z Last Updated: 2025-01-08T22:00:35.622Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: CoSchedule Products: CoSchedule Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in CoSchedule plugin <= 3.3.8 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/coschedule-by-todaymade/wordpress-coschedule-plugin-3-3-8-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47166 State: PUBLISHED Published: 2023-03-13T09:09:53.614Z Last Updated: 2025-01-13T15:54:03.286Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: voidCoders Products: Void Contact Form 7 Widget For Elementor Page Builder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in voidCoders Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cf7-widget-elementor/wordpress-void-contact-form-7-widget-for-elementor-page-builder-plugin-2-1-1-cross-site-reque
ility/cf7-widget-elementor/wordpress-void-contact-form-7-widget-for-elementor-page-builder-plugin-2-1-1-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47167 State: PUBLISHED Published: 2023-05-22T09:14:59.811Z Last Updated: 2025-01-08T22:07:56.833Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Aram Kocharyan Products: Crayon Syntax Highlighter Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Aram Kocharyan Crayon Syntax Highlighter plugin <= 2.8.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/crayon-syntax-highlighter/wordpress-crayon-syntax-highlighter-plugin-2-8-4-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47168 State: PUBLISHED Published: 2024-12-13T14:22:10.019Z Last Updated: 2024-12-13T20:49:40.832Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Printful Products: Printful Integration for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in Printful Printful Integration for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Printful Integration for WooCommerce: from n/a through 2.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/printful-shipping-for-woocommerce/vulnerability/wordpress-p
ferences: - https://patchstack.com/database/wordpress/plugin/printful-shipping-for-woocommerce/vulnerability/wordpress-printful-integration-for-woocommerce-plugin-2-2-2-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47169 State: PUBLISHED Published: 2023-07-18T12:09:47.433Z Last Updated: 2024-09-25T17:02:06.990Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: StaxWP Products: Visibility Logic for Elementor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in StaxWP Visibility Logic for Elementor plugin <= 2.3.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/visibility-logic-elementor/wordpress-visibility-logic-for-elementor-plugin-2-3-4-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47170 State: PUBLISHED Published: 2023-03-28T08:09:21.537Z Last Updated: 2025-01-10T19:15:18.499Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Unlimited Elements Products: Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 1.5.48 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/unlimited-elements-for-elementor/wordpress-unlimited-elem
t: References: - https://patchstack.com/database/vulnerability/unlimited-elements-for-elementor/wordpress-unlimited-elements-for-elementor-plugin-1-5-48-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47171 State: PUBLISHED Published: 2023-03-14T06:42:56.973Z Last Updated: 2025-02-19T21:40:59.396Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Paul C. Schroeder Products: IP Vault – WP Firewall Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paul C. Schroeder IP Vault – WP Firewall plugin <= 1.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/ip-vault-wp-firewall/wordpress-ip-vault-wp-firewall-plugin-1-1-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47172 State: PUBLISHED Published: 2023-07-17T14:36:11.962Z Last Updated: 2024-09-30T14:38:03.959Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: HasThemes Products: ShopLentor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.6.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/woolentor-addons/wordpress-shoplentor-plugin-2-6-2-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-47173 State: PUBLISHED Published: 2023-03-23T15:57:29.904Z Last Updated: 2025-01-10T19:16:46.246Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: nasirahmed Products: Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in nasirahmed Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration plugin <= 1.62.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-form-integration/wordpress-connect-contact-form-7-woocommerce-to-google-sheets-other-platforms-advanced-form-integration-plugin-1-62-0-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47174 State: PUBLISHED Published: 2023-05-25T12:17:07.810Z Last Updated: 2025-01-08T21:56:55.330Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WordPress Performance Team Products: Performance Lab Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WordPress Performance Team Performance Lab plugin <= 2.2.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/performance-lab/wordpress-performance-lab-plugin-2-2-0-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47175 State: PUBLISHED Published: 2023-10-06T12:45:56.683Z Last Updated: 2024-09-19T14:54:56.373Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: P Royal Products: Royal Elementor Addons and Templates Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in P Royal Royal Elementor Addons and Templates plugin <= 1.3.75 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/royal-elementor-addons/wordpress-royal-elementor-addons-plugin-1-3-75-multiple-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47176 State: PUBLISHED Published: 2024-12-13T14:22:10.569Z Last Updated: 2024-12-13T21:02:48.666Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Depicter Slider and Popup by Averta Products: Depicter Slider Problem Types: CWE-862 Description: Missing Authorization vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through 1.9.0. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/depicter/vulnerability/wordpress-depicter-slider-plugin-1-7-3-broken
- https://patchstack.com/database/wordpress/plugin/depicter/vulnerability/wordpress-depicter-slider-plugin-1-7-3-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2022-47177 State: PUBLISHED Published: 2023-05-25T09:51:39.536Z Last Updated: 2025-01-08T21:59:58.150Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP Easy Pay Products: WP EasyPay – Square for WordPress Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Easy Pay WP EasyPay – Square for WordPress plugin <= 4.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-easy-pay/wordpress-wp-easypay-square-for-wordpress-plugin-4-0-4-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47178 State: PUBLISHED Published: 2023-05-25T11:49:16.315Z Last Updated: 2025-01-08T21:57:05.433Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Simple Share Buttons Products: Simple Share Buttons Adder Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Simple Share Buttons Simple Share Buttons Adder plugin <= 8.4.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-share-buttons-adder/wordpress-simple-share-buttons-adder-plugin-8-4-6-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47179 State: PUBLISHED Published: 2023-02-28T14:59:41.213Z Last Updated: 2025-01-13T15:55:35.592Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Uwe Jacobs Products: OWM Weather Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Uwe Jacobs OWM Weather plugin <= 5.6.11 leads to post duplication as a draft. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/owm-weather/wordpress-owm-weather-plugin-5-6-11-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47180 State: PUBLISHED Published: 2023-05-24T15:55:57.486Z Last Updated: 2025-01-08T22:03:36.232Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Kopa Theme Products: Kopa Framework Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Kopa Theme Kopa Framework plugin <= 1.3.5 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/kopatheme/wordpress-kopa-framework-plugin-1-3-5-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47181 State: PUBLISHED Published: 2023-11-07T17:23:38.102Z Last Updated: 2025-02-19T21:19:06.953Z Vendors: wpexpertsio Products: Email Templates Customizer and Designer for WordPress and WooCommerce Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in wpexpertsio Email Templates Customizer and Designer for WordPress and WooCommerce email-templates allows Cross Site Request Forgery.This issue affects Email Templates Customizer and Designer for WordPress and WooCommerce: from n/a through 1.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/email-templates
Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/email-templates/wordpress-email-templates-plugin-1-4-2-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47182 State: PUBLISHED Published: 2024-12-13T14:22:11.135Z Last Updated: 2024-12-13T21:04:02.971Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Wpexpertsio Products: APIExperts Square for WooCommerce Problem Types: CWE-862 Description: Missing Authorization vulnerability in Wpexpertsio APIExperts Square for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.4.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/woosquare/vulnerability/wordpress-apiexperts-square-for-woocom
ences: - https://patchstack.com/database/wordpress/plugin/woosquare/vulnerability/wordpress-apiexperts-square-for-woocommerce-plugin-4-2-5-broken-access-control?_s_id=cve
CVE ID: CVE-2022-47183 State: PUBLISHED Published: 2023-05-22T09:11:57.541Z Last Updated: 2025-01-09T15:10:42.660Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: StylistWP Products: Extra Block Design, Style, CSS for ANY Gutenberg Blocks Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in StylistWP Extra Block Design, Style, CSS for ANY Gutenberg Blocks plugin <= 0.2.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/stylist/wordpress-extra-block-design-style-css-for-any-gutenberg-blocks-plugin-0-2-6-cross-site-request-forgery-
ability/stylist/wordpress-extra-block-design-style-css-for-any-gutenberg-blocks-plugin-0-2-6-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47184 State: PUBLISHED Published: 2023-06-14T07:42:36.126Z Last Updated: 2025-02-13T16:33:59.589Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: 8.0.0 to 9.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/tns2b4khyyncgs5v5p9y35pobg9z2bvs - https://www.debian.org/security/2023/dsa-5435 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/messag
g/security/2023/dsa-5435 - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6GDCBNFDDW6ULW7CACJCPENI7BVDHM5O/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FGWXNAEEVRUZ5JG4EJAIIFC3CI7LFETV/ - https://lists.debian.org/debian-lts-announce/2023/06/msg00037.html
CVE ID: CVE-2022-47185 State: PUBLISHED Published: 2023-08-09T06:57:40.407Z Last Updated: 2025-02-13T16:34:00.177Z Vendors: Apache Software Foundation Products: Apache Traffic Server Problem Types: CWE-20 Description: Improper input validation vulnerability on the range header in Apache Software Foundation Apache Traffic Server.This issue affects Apache Traffic Server: through 9.2.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/jsl6dfdgs1mjjo1mbtyflyjr7xftswhc - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BOTOM2MFKOLK46Q3BQHO662HTPZFRQUC/ - https://lists.debian.org/
ives/list/package-announce@lists.fedoraproject.org/message/BOTOM2MFKOLK46Q3BQHO662HTPZFRQUC/ - https://lists.debian.org/debian-lts-announce/2023/09/msg00042.html - https://www.debian.org/security/2023/dsa-5549
CVE ID: CVE-2022-47186 State: PUBLISHED Published: 2023-09-28T13:26:12.138Z Last Updated: 2024-09-23T18:59:29.643Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Generex Products: UPS CS141 Problem Types: CWE-434 Description: There is an unrestricted upload of file vulnerability in Generex CS141 below 2.06 version. An attacker could upload and/or delete any type of file, without any format restriction and without any authentication, in the "upload" directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-c
ces: - https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141 - https://www.generex.de/support/changelogs/cs141/page:2
CVE ID: CVE-2022-47187 State: PUBLISHED Published: 2023-09-28T13:30:27.188Z Last Updated: 2024-09-23T18:54:02.859Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Generex Products: UPS CS141 Problem Types: CWE-79 Description: There is a file upload XSS vulnerability in Generex CS141 below 2.06 version. The web application allows file uploading, making it possible to upload a file with HTML content. When HTML files are allowed, XSS payload can be injected into the uploaded file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabi
ulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141 - https://www.generex.de/support/changelogs/cs141/2-12
CVE ID: CVE-2022-47188 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-12T14:52:45.725Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Generex Products: UPS CS141 Problem Types: CWE-20 Description: There is an arbitrary file reading vulnerability in Generex UPS CS141 below 2.06 version. An attacker, making use of the default credentials, could upload a backup file containing a symlink to /etc/shadow, allowing him to obtain the content of this path. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabiliti
ichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141 - https://www.generex.de/support/changelogs/cs141/page:2 - https://www.generex.de/support/changelogs/cs141/2-12
CVE ID: CVE-2022-47189 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-12T14:51:18.859Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: Generex Products: UPS CS141 Problem Types: CWE-20 Description: Generex UPS CS141 below 2.06 version, allows an attacker toupload a firmware file containing an incorrect configuration, in order to disrupt the normal functionality of the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141 - https://www.generex.de/support/changelogs/cs141/pag
isories/update-03032023-multiple-vulnerabilities-generex-ups-cs141 - https://www.generex.de/support/changelogs/cs141/page:2 - https://www.generex.de/support/changelogs/cs141/2-12
CVE ID: CVE-2022-47190 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-11T19:08:06.211Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Generex Products: UPS CS141 Problem Types: CWE-20 Description: Generex UPS CS141 below 2.06 version, could allow a remote attacker to upload a firmware file containing a webshell that could allow him to execute arbitrary code as root. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe-cert.es/en/early-warning/ics-advisories/update-03032023-multiple-vulnerabilities-generex-ups-cs141 - https://www.generex.de/support/changelogs/cs141/page:2 -