Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
ger&new=2727947%40zephyr-project-manager&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1822
CVE ID: CVE-2022-1823 State: PUBLISHED Published: 2022-06-20T10:15:22 Last Updated: 2024-08-03T00:17:00.722Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Consumer Product Removal Tool Problem Types: CWE-269 Description: Improper privilege management vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local user to modify a configuration file and perform a LOLBin (Living off the land) attack. This could result in the user gaining elevated permissions and being able to execute arbitrary code, through not correctly checking the integrity of the configuration file. Additional Analyst Notes: -
cute arbitrary code, through not correctly checking the integrity of the configuration file. Additional Analyst Notes: - CVE Program Container: References: - https://service.mcafee.com/?articleId=TS103318&page=shell&shell=article-view
CVE ID: CVE-2022-1824 State: PUBLISHED Published: 2022-06-20T10:15:16 Last Updated: 2024-08-03T00:17:00.711Z Severity: HIGH (CVSS 7.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H) Vendors: McAfee,LLC Products: McAfee Consumer Product Removal Tool Problem Types: CWE-427 Description: An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloading attack by using a specific file name. This could result in the user gaining elevated permissions and being able to execute arbitrary code as there were insufficient checks on the executable being signed by McAfee. Additional Analyst Notes: - CVE Program C
de as there were insufficient checks on the executable being signed by McAfee. Additional Analyst Notes: - CVE Program Container: References: - https://service.mcafee.com/?articleId=TS103318&page=shell&shell=article-view
CVE ID: CVE-2022-1825 State: PUBLISHED Published: 2022-05-23T10:40:09 Last Updated: 2024-08-03T00:17:00.786Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: collectiveaccess Products: collectiveaccess/providence Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository collectiveaccess/providence prior to 1.8. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c6ad4cef-1b3d-472f-af0e-68e46341dfe5 - https://github.com/collectiveaccess/providence/commit/49de453c8d4942d09fab230e8f242300c831e2a7
CVE ID: CVE-2022-1826 State: PUBLISHED Published: 2022-06-20T10:26:02 Last Updated: 2024-08-03T00:17:00.594Z Vendors: Unknown Products: Cross-Linker Problem Types: CWE-352 Description: The Cross-Linker WordPress plugin through 3.0.1.9 does not have CSRF check in place when creating Cross-Links, which could allow attackers to make a logged in admin perform such action via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b9dba241-d94c-4ce5-8730-445ba8005e66
CVE ID: CVE-2022-1827 State: PUBLISHED Published: 2022-06-20T10:26:04 Last Updated: 2024-08-03T00:17:00.867Z Vendors: Unknown Products: PDF24 Article To PDF Problem Types: CWE-352 Description: The PDF24 Article To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0bd25283-e079-4010-b139-cce9afb1d54d
CVE ID: CVE-2022-1828 State: PUBLISHED Published: 2022-06-20T10:26:05 Last Updated: 2024-08-03T00:17:00.745Z Vendors: Unknown Products: PDF24 Articles To PDF Problem Types: CWE-352 Description: The PDF24 Articles To PDF WordPress plugin through 4.2.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/877ce7a5-b1ff-4d03-9cd8-6beed5595af8
CVE ID: CVE-2022-1829 State: PUBLISHED Published: 2022-06-20T10:26:07 Last Updated: 2024-08-03T00:16:59.969Z Vendors: Unknown Products: Inline Google Maps Problem Types: CWE-352 Description: The Inline Google Maps WordPress plugin through 5.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8353aa12-dbb7-433f-9dd9-d61a3f303d4b
CVE ID: CVE-2022-1830 State: PUBLISHED Published: 2022-06-20T10:26:08 Last Updated: 2024-08-03T00:17:00.377Z Vendors: Unknown Products: Amazon Einzeltitellinks Problem Types: CWE-352 Description: The Amazon Einzeltitellinks WordPress plugin through 1.3.3 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a6b3e927-41e2-4e48-b9e1-8c58a1b9a933
CVE ID: CVE-2022-1831 State: PUBLISHED Published: 2022-06-20T10:26:10 Last Updated: 2024-08-03T00:17:00.474Z Vendors: Unknown Products: WPlite Problem Types: CWE-352 Description: The WPlite WordPress plugin through 1.3.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/91c44a4f-b599-46c0-a8df-d1fb87472abe
CVE ID: CVE-2022-1832 State: PUBLISHED Published: 2022-06-20T10:26:11 Last Updated: 2024-08-03T00:17:00.782Z Vendors: Unknown Products: CaPa Protect Problem Types: CWE-352 Description: The CaPa Protect WordPress plugin through 0.5.8.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable the applied protection. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e025f821-81c3-4072-a89e-a5b3d0fb1275
CVE ID: CVE-2022-1833 State: PUBLISHED Published: 2022-06-21T14:23:41 Last Updated: 2024-08-03T00:17:00.931Z Vendors: n/a Products: AMQ Broker Operator Problem Types: CWE-276 Description: A flaw was found in AMQ Broker Operator 7.9.4 installed via UI using OperatorHub where a low-privilege user that has access to the namespace where the AMQ Operator is deployed has access to clusterwide edit rights by checking the secrets. The service account used for building the Operator gives more permission than expected and an attacker could benefit from it. This requires at least an already compromised low-privilege account or insider attack. Additional Analyst Notes: - CVE Program Container: Reference
lready compromised low-privilege account or insider attack. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2089406#c4
CVE ID: CVE-2022-1834 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:15:38.162Z Vendors: Mozilla Products: Thunderbird Problem Types: Braille space character caused incorrect sender email to be shown for a digitally signed email Description: When displaying the sender of an email, and the sender name contained the Braille Pattern Blank space character multiple times, Thunderbird would have displayed all the spaces. This could have been used by an attacker to send an email message with the attacker's digital signature, that was shown with an arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed
arbitrary sender email address chosen by the attacker. If the sender name started with a false email address, followed by many Braille space characters, the attacker's email address was not visible. Because Thunderbird compared the invisible sender address with the signature's email address, if the signing key or certificate was accepted by Thunderbird, the email was shown as having a valid digital signature. This vulnerability affects Thunderbird < 91.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-22/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1767816
CVE ID: CVE-2022-1835 State: REJECTED Published: 2022-09-14T18:56:37 Last Updated: 2022-09-14T18:56:37 Description: No description available.
CVE ID: CVE-2022-1836 State: REJECTED Published: 2022-06-19T21:21:47 Last Updated: 2022-06-19T21:21:47 Description: No description available.
CVE ID: CVE-2022-1837 State: PUBLISHED Published: 2022-05-24T05:25:20.000Z Last Updated: 2025-04-15T14:39:52.286Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Home Clean Services Management System Problem Types: CWE-434 Description: A vulnerability was found in Home Clean Services Management System 1.0. It has been rated as critical. Affected by this issue is register.php?link=registerand. The manipulation with the input <?php phpinfo();?> leads to code execution. The attack may be launched remotely but demands an authentication. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - C
uthentication. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Home%20Clean%20Services%20Management%20System/HCS_add_register.php_File_Upload_Getshell.md - https://vuldb.com/?id.200582
CVE ID: CVE-2022-1838 State: PUBLISHED Published: 2022-05-24T05:25:22.000Z Last Updated: 2025-04-15T14:39:43.651Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Home Clean Services Management System Problem Types: CWE-89 Description: A vulnerability classified as critical has been found in Home Clean Services Management System 1.0. This affects an unknown part of admin/login.php. The manipulation of the argument username with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(5)))JPeh)/**/AND/**/'frfq%'='frfq leads to sql injection. It is possible to initiate the attack remotely but it requires authentication. Exploit
q%'='frfq leads to sql injection. It is possible to initiate the attack remotely but it requires authentication. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Home%20Clean%20Services%20Management%20System/HCS_admin_SQL_Inject.md - https://vuldb.com/?id.200583
CVE ID: CVE-2022-1839 State: PUBLISHED Published: 2022-05-24T05:25:23.000Z Last Updated: 2025-04-15T14:39:32.839Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Home Clean Services Management System Problem Types: CWE-89 Description: A vulnerability classified as critical was found in Home Clean Services Management System 1.0. This vulnerability affects the file login.php. The manipulation of the argument email with the input admin%'/**/AND/**/(SELECT/**/5383/**/FROM/**/(SELECT(SLEEP(2)))JPeh)/**/AND/**/'frfq%'='frfq leads to sql injection. The attack can be initiated remotely but it requires authentication. Exploit details have been d
leads to sql injection. The attack can be initiated remotely but it requires authentication. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Home%20Clean%20Services%20Management%20System/HCS_login_email_SQL_injection.md - https://vuldb.com/?id.200584
CVE ID: CVE-2022-1840 State: PUBLISHED Published: 2022-05-24T05:25:25.000Z Last Updated: 2025-04-15T14:39:23.120Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Home Clean Services Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in Home Clean Services Management System 1.0. This issue affects register.php?link=registerand. The manipulation with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely but demands authentication. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Co
ut demands authentication. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Home%20Clean%20Services%20Management%20System/Home%20Clean%20Services%20Management%20System%20Stored%20Cross-Site%20Scripting%28XSS%29.md - https://vuldb.com/?id.200585
CVE ID: CVE-2022-1841 State: PUBLISHED Published: 2022-08-31T19:40:08.845879Z Last Updated: 2024-09-16T22:14:38.965Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L) Vendors: zephyrproject-rtos Products: zephyr Problem Types: CWE-787 Description: In subsys/net/ip/tcp.c , function tcp_flags , when the incoming parameter flags is ECN or CWR , the buf will out-of-bounds write a byte zero. Additional Analyst Notes: - CVE Program Container: References: - http://github.com/zephyrproject-rtos/zephyr/security/advisories/GHSA-5c3j-p8cr-2pgh
CVE ID: CVE-2022-1842 State: PUBLISHED Published: 2022-06-27T08:57:39 Last Updated: 2024-08-03T00:17:00.917Z Vendors: Unknown Products: OpenBook Book Data Problem Types: CWE-352 Description: The OpenBook Book Data WordPress plugin through 3.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/77aafeb9-af80-490a-b3d7-4fa973bab61c
CVE ID: CVE-2022-1843 State: PUBLISHED Published: 2022-06-27T08:57:45 Last Updated: 2024-08-03T00:17:00.824Z Vendors: Unknown Products: MailPress Problem Types: CWE-352 Description: The MailPress WordPress plugin through 7.2.1 does not have CSRF checks in various places, which could allow attackers to make a logged in admin change the settings, purge log files and more via CSRF attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/aa59f811-2375-4593-93d4-f587f9870ed1
CVE ID: CVE-2022-1844 State: PUBLISHED Published: 2022-06-27T08:57:50 Last Updated: 2024-08-03T00:17:00.742Z Vendors: Unknown Products: WP Sentry Problem Types: CWE-352 Description: The WP Sentry WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f0b0baac-7f44-44e1-af73-5a72b967858d
CVE ID: CVE-2022-1845 State: PUBLISHED Published: 2022-06-27T08:57:57 Last Updated: 2024-08-03T00:17:00.813Z Vendors: Unknown Products: WP Post Styling Problem Types: CWE-352 Description: The WP Post Styling WordPress plugin before 1.3.1 does not have CSRF checks in various actions, which could allow attackers to make a logged in admin delete plugin's data, update the settings, add new entries and more via CSRF attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6ee3e9e2-ff57-41c4-8cc5-b258801a8a02
CVE ID: CVE-2022-1846 State: PUBLISHED Published: 2022-06-27T08:58:03 Last Updated: 2024-08-03T00:17:00.834Z Vendors: Unknown Products: Tiny Contact Form Problem Types: CWE-352 Description: The Tiny Contact Form WordPress plugin through 0.7 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5fa5838e-4843-4d9c-9884-e3ebbf56fc6a
CVE ID: CVE-2022-1847 State: PUBLISHED Published: 2022-06-27T08:58:09 Last Updated: 2024-08-03T00:17:00.404Z Vendors: Unknown Products: Rotating Posts Problem Types: CWE-352 Description: The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d34ed713-4cca-4cef-b431-f132f1b10aa6
CVE ID: CVE-2022-1848 State: PUBLISHED Published: 2022-05-24T10:40:09 Last Updated: 2024-08-03T00:17:00.744Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: erudika Products: erudika/para Problem Types: CWE-840 Description: Business Logic Errors in GitHub repository erudika/para prior to 1.45.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8dfe0877-e44b-4a1a-8eee-5c03c93ae90a - https://github.com/erudika/para/commit/fa677c629842df60099daa9c23bd802bc41b48d1
CVE ID: CVE-2022-1849 State: PUBLISHED Published: 2022-05-24T12:05:10 Last Updated: 2024-08-03T00:17:00.823Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: filegator Products: filegator/filegator Problem Types: CWE-384 Description: Session Fixation in GitHub repository filegator/filegator prior to 7.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/881f8f36-d5c8-470d-8261-f109e6d5db4b - https://github.com/filegator/filegator/commit/fcd3995f64f5dfc6a4c2c059cc22a2fef1e81225
CVE ID: CVE-2022-1850 State: PUBLISHED Published: 2022-05-24T12:10:10 Last Updated: 2024-08-03T00:17:00.986Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: filegator Products: filegator/filegator Problem Types: CWE-22 Description: Path Traversal in GitHub repository filegator/filegator prior to 7.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/07755f07-a412-4911-84a4-2f8c03c8f7ce - https://github.com/filegator/filegator/commit/6e2b68f17f48cdc1d6a4a93a2369d2069fe64989
CVE ID: CVE-2022-1851 State: PUBLISHED Published: 2022-05-25T00:00:00 Last Updated: 2024-08-03T00:17:00.640Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f8af901a-9a46-440d-942a-8f815b59394d - https://github.com/vim/vim/commit/78d52883e10d71f23ab72a3d8b9733b00da8c9ad - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QMFHBC5OQXDPV2SDYA2JUQGVCPYASTJB/ - https://lists.fedoraproject.org/archives/list/pack
40lists.fedoraproject.org/message/QMFHBC5OQXDPV2SDYA2JUQGVCPYASTJB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OZSLFIKFYU5Y2KM5EJKQNYHWRUBDQ4GJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYNK6SDCMOLQJOI3B4AOE66P2G2IH4ZM/ - https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1852 State: PUBLISHED Published: 2022-06-30T12:42:20 Last Updated: 2024-08-03T00:17:00.872Z Vendors: n/a Products: kernel Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in the Linux kernel’s KVM module, which can lead to a denial of service in the x86_emulate_insn in arch/x86/kvm/emulate.c. This flaw occurs while executing an illegal instruction in guest in the Intel CPU. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/fee060cd52d69c114b62d1a2948ea9648b5131f9 - https://bugzilla.redhat.com/show_bug.cgi?id=2089815
CVE ID: CVE-2022-1853 State: PUBLISHED Published: 2022-07-27T21:15:42 Last Updated: 2024-08-03T00:17:00.807Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Indexed DB in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1324864 - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1854 State: PUBLISHED Published: 2022-07-27T21:15:57 Last Updated: 2024-08-03T00:17:00.812Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in ANGLE in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html - https://crbug.com/1320024 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1855 State: PUBLISHED Published: 2022-07-27T21:16:13 Last Updated: 2024-08-03T00:17:00.830Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Messaging in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html - https://crbug.com/1228661 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1856 State: PUBLISHED Published: 2022-07-27T21:16:26 Last Updated: 2024-08-03T00:17:00.928Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in User Education in Google Chrome prior to 102.0.5005.61 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension or specific user interaction. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html - https://crbug.com/1323239 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1857 State: PUBLISHED Published: 2022-07-27T21:16:37 Last Updated: 2024-08-03T00:17:00.913Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in File System API in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to bypass file system restrictions via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/05/stable-channel-update-for-desktop_24.html - https://crbug.com/1227995 - https://security.gentoo.org/glsa/202208-25