Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2031 State: PUBLISHED Published: 2022-08-25T00:00:00 Last Updated: 2024-08-03T00:24:44.042Z Vendors: n/a Products: samba Problem Types: CWE-288 Description: A flaw was found in Samba. The security vulnerability occurs when KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password, can exploit this flaw to obtain and use tickets to other services. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/security/CVE-2022-2031.html - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2022-2032 State: PUBLISHED Published: 2022-07-25T17:47:49.531669Z Last Updated: 2024-09-16T19:04:08.674Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: Artica PFMS Products: Pandora FMS Problem Types: CWE-79 Description: In Pandora FMS v7.0NG.761 and below, in the file manager section, the dirname parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/ - https://www.incibe.es/en/cve-assignment-publication/coor
dorafms.com/en/security/common-vulnerabilities-and-exposures/ - https://www.incibe.es/en/cve-assignment-publication/coordinated-cves
CVE ID: CVE-2022-2034 State: PUBLISHED Published: 2022-08-29T14:40:26 Last Updated: 2024-08-03T00:24:43.797Z Vendors: Unknown Products: Sensei LMS Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Sensei LMS WordPress plugin before 4.5.0 does not have proper permissions set in one of its REST endpoint, allowing unauthenticated users to access private messages sent to teachers Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/aba3dd58-7a8e-4129-add5-4dd5972c0426 - https://hackerone.com/reports/1590237
CVE ID: CVE-2022-2035 State: PUBLISHED Published: 2022-06-09T14:23:25 Last Updated: 2024-08-03T00:24:44.069Z Vendors: n/a Products: Rustici Software SCORM Engine Problem Types: Cross-Site Scripting Description: A reflected cross-site scripting (XSS) vulnerability exists in the playerConfUrl parameter in the /defaultui/player/modern.html file for SCORM Engine versions < 20.1.45.914, 21.1.x < 21.1.7.219. The issue exists because there are no limitations on the domain or format of the url supplied by the user, allowing an attacker to craft malicious urls which can trigger a reflected XSS payload in the context of a victim's browser. Additional Analyst Notes: - CVE Program Container: References:
flected XSS payload in the context of a victim's browser. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-21
CVE ID: CVE-2022-2036 State: PUBLISHED Published: 2022-06-09T05:30:15 Last Updated: 2024-08-03T00:24:43.966Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: francoisjacquet Products: francoisjacquet/rosariosis Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository francoisjacquet/rosariosis prior to 9.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c7715149-f99c-4d62-a5c6-c78bfdb41905 - https://github.com/francoisjacquet/rosariosis/commit/6e213b17e6ac3a3961e1eabcdaba1c892844398a
CVE ID: CVE-2022-2037 State: PUBLISHED Published: 2022-06-09T08:20:12 Last Updated: 2024-08-03T00:24:44.060Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: tooljet Products: tooljet/tooljet Problem Types: CWE-1125 Description: Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4431ef84-93f2-4bc5-bc1a-97d7f229b28e - https://github.com/tooljet/tooljet/commit/fadf025365823cbbc739a1313791c0a04621972b
CVE ID: CVE-2022-2039 State: PUBLISHED Published: 2022-07-18T16:12:50 Last Updated: 2024-08-03T00:24:44.165Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: livesupporti Products: Free Live Chat Support Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Free Live Chat Support plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.0.11. This is due to missing nonce protection on the livesupporti_settings() function found in the ~/livesupporti.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrato
or unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/dfa3efa2-c542-44b9-8039-13e6eac75101?source=cve - https://plugins.trac.wordpress.org/browser/livesupporti/trunk/livesupporti.php#L67 - https://wordpress.org/plugins/livesupporti/#developers - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2039 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2762052%40livesupporti&new=2762052%40livesupporti&sfp_email=
wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2762052%40livesupporti&new=2762052%40livesupporti&sfp_email=&sfph_mail=
CVE ID: CVE-2022-2040 State: PUBLISHED Published: 2022-06-27T08:59:27 Last Updated: 2024-08-03T00:24:44.147Z Vendors: Unknown Products: Brizy – Page Builder Problem Types: CWE-79 Description: The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element URL, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ab53a70c-57d5-400f-b11f-b1b7b2b0cf01 - https://www.fortiguard.com/zeroday/FG-VD-21-111
CVE ID: CVE-2022-2041 State: PUBLISHED Published: 2022-06-27T08:59:32 Last Updated: 2024-08-03T00:24:44.273Z Vendors: Unknown Products: Brizy – Page Builder Problem Types: CWE-79 Description: The Brizy WordPress plugin before 2.4.2 does not sanitise and escape some element content, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8edb11bc-9e8d-4a98-8538-aaff0f072109 - https://www.fortiguard.com/zeroday/FG-VD-21-110
CVE ID: CVE-2022-2042 State: PUBLISHED Published: 2022-06-10T00:00:00 Last Updated: 2024-08-03T00:24:44.172Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8628b4cd-4055-4059-aed4-64f7fdc10eba - https://github.com/vim/vim/commit/2813f38e021c6e6581c0c88fcf107e41788bc835 - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213443 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fu
com/kb/HT213443 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/43 - http://seclists.org/fulldisclosure/2022/Oct/45 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2043 State: PUBLISHED Published: 2022-08-31T15:59:34.678Z Last Updated: 2025-04-16T16:10:58.933Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MOXA Products: MOXA Problem Types: CWE-787 Description: MOXA NPort 5110: Firmware Versions 2.10 is vulnerable to an out-of-bounds write that can cause the device to become unresponsive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-04
CVE ID: CVE-2022-2044 State: PUBLISHED Published: 2022-08-31T15:59:34.511Z Last Updated: 2025-04-16T16:11:07.088Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: MOXA Products: MOXA Problem Types: CWE-787 Description: MOXA NPort 5110: Firmware Versions 2.10 is vulnerable to an out-of-bounds write that may allow an attacker to overwrite values in memory, causing a denial-of-service condition or potentially bricking the device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-207-04
CVE ID: CVE-2022-2046 State: PUBLISHED Published: 2022-08-08T13:46:03 Last Updated: 2024-08-03T00:24:43.957Z Vendors: Unknown Products: Directorist – WordPress Business Directory Plugin with Classified Ads Listings Problem Types: CWE-434 Description: The Directorist WordPress plugin before 7.2.3 allows administrators to download other plugins from the same vendor directly to the site, but does not check the URL domain it gets the zip files from. This could allow administrators to run code on the server, which is a problem in multisite configurations. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/03a04eab-be47-4195-af77-0df2a32eb807 - https:
s: - CVE Program Container: References: - https://wpscan.com/vulnerability/03a04eab-be47-4195-af77-0df2a32eb807 - https://plugins.trac.wordpress.org/changeset/2752034/directorist?contextall=1&old=2731298&old_path=%2Fdirectorist
CVE ID: CVE-2022-2047 State: PUBLISHED Published: 2022-07-07T20:45:12 Last Updated: 2024-08-03T00:24:44.138Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-20 Description: In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
- CVE Program Container: References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q - https://www.debian.org/security/2022/dsa-5198 - https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html - https://security.netapp.com/advisory/ntap-20220901-0006/
CVE ID: CVE-2022-2048 State: PUBLISHED Published: 2022-07-07T20:35:09 Last Updated: 2024-08-03T00:24:43.964Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: The Eclipse Foundation Products: Eclipse Jetty Problem Types: CWE-410, CWE-664 Description: In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse/je
to process good requests. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j - https://www.debian.org/security/2022/dsa-5198 - https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html - https://security.netapp.com/advisory/ntap-20220901-0006/ - http://www.openwall.com/lists/oss-security/2022/09/09/2
CVE ID: CVE-2022-2049 State: PUBLISHED Published: 2022-08-19T08:45:14 Last Updated: 2024-08-03T00:24:43.963Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Regex Denial of Service Description: In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/post/2022/sa2022-10/
CVE ID: CVE-2022-2050 State: PUBLISHED Published: 2022-07-11T12:57:09 Last Updated: 2024-08-03T00:24:44.187Z Vendors: Unknown Products: WP-Paginate Problem Types: CWE-79 Description: The WP-Paginate WordPress plugin before 2.1.9 does not escape one of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/016453e3-803b-4a67-8ea7-2d228c2998d4
CVE ID: CVE-2022-2052 State: PUBLISHED Published: 2022-10-17T08:20:11.346Z Last Updated: 2025-05-10T02:57:40.699Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TRUMPF Werkzeugmaschinen SE + Co. KG Products: TruTops Monitor, TruTops Fab, Oseon, Job Order Interface, TruTops Boost with option Inventory of sheets and remainder sheets, TruTops Boost with option Graphic separation of cut parts Problem Types: CWE-284 Description: Multiple Trumpf Products in multiple versions use default privileged Windows users and passwords. An adversary may use these accounts to remotely gain full access to the system. Additional Analyst Notes: - CVE Program Container: - CISA
use these accounts to remotely gain full access to the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-023/
CVE ID: CVE-2022-2053 State: PUBLISHED Published: 2022-08-05T15:24:27 Last Updated: 2024-08-03T00:24:44.066Z Vendors: n/a Products: Undertow Problem Types: CWE-400 Description: When a POST request comes through AJP and the request exceeds the max-post-size limit (maxEntitySize), Undertow's AjpServerRequestConduit implementation closes a connection without sending any response to the client/proxy. This behavior results in that a front-end proxy marking the backend worker (application server) as an error state and not forward requests to the worker for a while. In mod_cluster, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server sta
, this continues until the next STATUS request (10 seconds intervals) from the application server updates the server state. So, in the worst case, it can result in "All workers are in error state" and mod_cluster responds "503 Service Unavailable" for a while (up to 10 seconds). In mod_proxy_balancer, it does not forward requests to the worker until the "retry" timeout passes. However, luckily, mod_proxy_balancer has "forcerecovery" setting (On by default; this parameter can force the immediate recovery of all workers without considering the retry parameter of the workers if all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in respondi
f all workers of a balancer are in error state.). So, unlike mod_cluster, mod_proxy_balancer does not result in responding "503 Service Unavailable". An attacker could use this behavior to send a malicious request and trigger server errors, resulting in DoS (denial of service). This flaw was fixed in Undertow 2.2.19.Final, Undertow 2.3.0.Alpha2. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2095862&comment#0 - https://issues.redhat.com/browse/UNDERTOW-2133
CVE ID: CVE-2022-2054 State: PUBLISHED Published: 2022-06-12T13:55:10 Last Updated: 2024-08-03T00:24:44.330Z Severity: HIGH (CVSS 8.4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: nuitka Products: nuitka/nuitka Problem Types: CWE-94 Description: Code Injection in GitHub repository nuitka/nuitka prior to 0.9. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ea4a842c-c48c-4aae-a599-3305125c63a7 - https://github.com/nuitka/nuitka/commit/09647745d7cbb6ff32f9fa948f19d5558b32bcad
CVE ID: CVE-2022-2056 State: PUBLISHED Published: 2022-06-30T00:00:00 Last Updated: 2024-08-03T00:24:44.219Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Divide by zero in libtiff Description: Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/merge_requests/346 - https://gitlab.com/libtiff/libtiff/-/issues/415 - https://gitlab.com/gitlab-org/cves/-/blob/maste
-/merge_requests/346 - https://gitlab.com/libtiff/libtiff/-/issues/415 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2056.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TSS7MJ7OO7JO5BNKCRYSFU7UAYOKLA2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXUMJXVEAYFWRO3U3YHKSULHIVDOLEQS/ - https://security.netapp.com/advisory/ntap-20220826-0001/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-2057 State: PUBLISHED Published: 2022-06-30T00:00:00 Last Updated: 2024-08-03T00:24:44.313Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Divide by zero in libtiff Description: Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/merge_requests/346 - https://gitlab.com/libtiff/libtiff/-/issues/427 - https://gitlab.com/gitlab-org/cves/-/blob/maste
-/merge_requests/346 - https://gitlab.com/libtiff/libtiff/-/issues/427 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2057.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TSS7MJ7OO7JO5BNKCRYSFU7UAYOKLA2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXUMJXVEAYFWRO3U3YHKSULHIVDOLEQS/ - https://security.netapp.com/advisory/ntap-20220826-0001/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-2058 State: PUBLISHED Published: 2022-06-30T00:00:00 Last Updated: 2024-08-03T00:24:44.171Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Divide by zero in libtiff Description: Divide By Zero error in tiffcrop in libtiff 4.4.0 allows attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit f3a5e010. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/428 - https://gitlab.com/libtiff/libtiff/-/merge_requests/346 - https://gitlab.com/gitlab-org/cves/-/blob/maste
-/issues/428 - https://gitlab.com/libtiff/libtiff/-/merge_requests/346 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2058.json - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4TSS7MJ7OO7JO5BNKCRYSFU7UAYOKLA2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXUMJXVEAYFWRO3U3YHKSULHIVDOLEQS/ - https://security.netapp.com/advisory/ntap-20220826-0001/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-2059 State: PUBLISHED Published: 2022-07-25T17:48:40.455565Z Last Updated: 2024-09-16T19:40:15.388Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: Artica PFMS Products: Pandora FMS Problem Types: CWE-79 Description: In Pandora FMS v7.0NG.761 and below, in the agent creation section, the alias parameter is vulnerable to a Stored Cross Site-Scripting. This vulnerability can be exploited by an attacker with administrator privileges logged in the system. Additional Analyst Notes: - CVE Program Container: References: - https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE ID: CVE-2022-2060 State: PUBLISHED Published: 2022-06-13T08:50:10 Last Updated: 2024-08-03T00:24:44.238Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: dolibarr Products: dolibarr/dolibarr Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository dolibarr/dolibarr prior to 16.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2acfc8fe-247c-4f88-aeaa-042b6b8690a0 - https://github.com/dolibarr/dolibarr/commit/2b5b9957c3010a5db9d1988c2efe5b209b16b47f
CVE ID: CVE-2022-2061 State: PUBLISHED Published: 2022-06-13T11:30:25 Last Updated: 2024-08-03T00:24:44.179Z Severity: LOW (CVSS 2.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: hpjansson Products: hpjansson/chafa Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository hpjansson/chafa prior to 1.12.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/365ab61f-9a63-421c-97e6-21d4653021f0 - https://github.com/hpjansson/chafa/commit/e6ce3746cdcf0836b9dae659a5aed15d73a080d8
CVE ID: CVE-2022-2062 State: PUBLISHED Published: 2022-06-13T00:00:00 Last Updated: 2024-08-03T00:24:44.180Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L) Vendors: nocodb Products: nocodb/nocodb Problem Types: CWE-209 Description: Generation of Error Message Containing Sensitive Information in GitHub repository nocodb/nocodb prior to 0.91.7+. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/35593b4c-f127-4699-8ad3-f0b2203a8ef6 - https://github.com/nocodb/nocodb/commit/a18f5dd53811b9ec1c1bb2fdbfb328c0c87d7fb4
CVE ID: CVE-2022-2063 State: PUBLISHED Published: 2022-06-13T11:30:13 Last Updated: 2024-08-03T00:24:44.112Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: nocodb Products: nocodb/nocodb Problem Types: CWE-269 Description: Improper Privilege Management in GitHub repository nocodb/nocodb prior to 0.91.7+. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/156f405b-21d6-4384-9bff-17ebfe484e20 - https://github.com/nocodb/nocodb/commit/269a19c2ad89a0e8a7596498e3806ff2ec1040c2
CVE ID: CVE-2022-2064 State: PUBLISHED Published: 2022-06-13T11:45:15 Last Updated: 2024-08-03T00:24:44.195Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: nocodb Products: nocodb/nocodb Problem Types: CWE-613 Description: Insufficient Session Expiration in GitHub repository nocodb/nocodb prior to 0.91.7+. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/39523d51-fc5c-48b8-a082-171da79761bb - https://github.com/nocodb/nocodb/commit/c9b5111b25aea2781e19395a8e9107ddbd235a2b
CVE ID: CVE-2022-2065 State: PUBLISHED Published: 2022-06-13T12:10:17 Last Updated: 2024-08-03T00:24:44.157Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: neorazorx Products: neorazorx/facturascripts Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/bcb44da4-d5c9-4830-924f-02d6defe6506 - https://github.com/neorazorx/facturascripts/commit/1d1edb40b40016d7fd2893b410b98569d7facca1