Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62fd472e-208b-48db-8f98-3d935c7a678c?source=cve - https://plugins.trac.wordpress.org/changeset/2757773/broken-link-checker/trunk/core/core.php?old=2605914&old_path=broken-link-checker%2Ftrunk%2Fcore%2Fcore.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2438
CVE ID: CVE-2022-2439 State: PUBLISHED Published: 2024-09-24T03:06:38.891Z Last Updated: 2024-09-24T15:30:14.881Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: smub Products: Easy Digital Downloads – eCommerce Payments and Subscriptions made easy Problem Types: CWE-502 Description: The Easy Digital Downloads – Simple eCommerce for Selling Digital Files plugin for WordPress is vulnerable to deserialization of untrusted input via the 'upload[file]' parameter in versions up to, and including 3.3.3. This makes it possible for authenticated administrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be us
nistrative users to call files using a PHAR wrapper, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/644c8702-08ad-4048-ae91-041f1771f1dc?source=cve - https://plugins.trac.wordpress.org/changeset/3154854/easy-digital-downloads/tags/3.3.4/includes/admin/import/import-functions.php - https://plugins.trac.wordpress.org/changeset/3154854/easy-digital-downloads/tags/3.3.4/src/Utils/FileSystem.php
CVE ID: CVE-2022-2440 State: PUBLISHED Published: 2024-08-29T03:30:46.255Z Last Updated: 2024-08-29T14:01:39.603Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: mndpsingh287 Products: Theme Editor Problem Types: CWE-502 Description: The Theme Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'images_array' parameter in versions up to, and including 2.8. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also
rary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/88fe46bf-8e85-4550-92ad-bdd426e5a745?source=cve - https://plugins.trac.wordpress.org/browser/theme-editor/trunk/ms_child_theme_editor.php#L495 - https://plugins.trac.wordpress.org/changeset/3142694/
CVE ID: CVE-2022-2441 State: PUBLISHED Published: 2023-10-20T07:29:28.362Z Last Updated: 2024-09-16T18:18:05.277Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: rickardw Products: ImageMagick Engine Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The ImageMagick Engine plugin for WordPress is vulnerable to remote code execution via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to run arbitrary commands leading to remote command execution, granted they can trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attack
an trick a site administrator into performing an action such as clicking on a link. This makes it possible for an attacker to create and or modify files hosted on the server which can easily grant attackers backdoor access to the affected server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b1f17a83-1df0-44fe-bd86-243cff6ec91b?source=cve - https://github.com/orangelabweb/imagemagick-engine/blob/1.7.4/imagemagick-engine.php#L529 - https://github.com/orangelabweb/imagemagick-engine/blob/v.1.7.2/imagemagick-engine.php#L529 - https://www.exploit-db.com/exploits/51025 - https://www.wordfence.com
-engine/blob/v.1.7.2/imagemagick-engine.php#L529 - https://www.exploit-db.com/exploits/51025 - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-2441 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2801283%40imagemagick-engine%2Ftrunk&old=2732430%40imagemagick-engine%2Ftrunk&sfp_email=&sfph_mail=
CVE ID: CVE-2022-2442 State: PUBLISHED Published: 2022-09-06T17:18:57 Last Updated: 2024-08-03T00:39:07.074Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: wpvividplugins Products: Migration, Backup, Staging – WPvivid Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to deserialization of untrusted input via the 'path' parameter in versions up to, and including 0.9.74. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a
es to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b7e2ca2e-c495-47f8-9c18-da5ba73d9e70?source=cve - https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging.php?rev=2749419#L1783 - https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-stagin
419#L1783 - https://plugins.trac.wordpress.org/browser/wpvivid-backuprestore/trunk/includes/staging/class-wpvivid-staging.php?rev=2749419#L1747 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2766112%40wpvivid-backuprestore%2Ftrunk%2Fincludes%2Fstaging%2Fclass-wpvivid-staging.php&new=2766112%40wpvivid-backuprestore%2Ftrunk%2Fincludes%2Fstaging%2Fclass-wpvivid-staging.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2442
CVE ID: CVE-2022-2443 State: PUBLISHED Published: 2022-07-18T16:18:38 Last Updated: 2024-08-03T00:39:07.675Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: kusbandono Products: FreeMind WP Browser Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The FreeMind WP Browser plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including 1.2. This is due to missing nonce protection on the FreemindOptions() function found in the ~/freemind-wp-browser.php file. This makes it possible for unauthenticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into per
nticated attackers to inject malicious web scripts into the page, granted they can trick a site's administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c5f3e34d-07fb-4e49-a4e2-f8e92301b35e?source=cve - https://plugins.trac.wordpress.org/browser/freemind-wp-browser/trunk/freemind-wp-browser.php#L104 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2443
CVE ID: CVE-2022-2444 State: PUBLISHED Published: 2022-07-18T16:13:34.000Z Last Updated: 2025-05-05T16:18:50.902Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: themeisle Products: Visualizer: Tables and Charts Manager for WordPress Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to deserialization of untrusted input via the 'remote_data' parameter in versions up to, and including 3.7.9. This makes it possible for authenticated attackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call
tackers with contributor privileges and above to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d9606d92-8061-4dfc-a6e2-509b54613277?source=cve - https://github.com/Codeinwp/visualizer/blob/master/classes/Visualizer/Source/Csv.php - https://github.com/Codeinwp/visualizer/blob/master/classes/Visualizer/Module/C
aster/classes/Visualizer/Source/Csv.php - https://github.com/Codeinwp/visualizer/blob/master/classes/Visualizer/Module/Chart.php#L1115 - https://github.com/Codeinwp/visualizer/compare/v3.7.9...v3.7.10 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2752058%40visualizer&new=2752058%40visualizer&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2444
CVE ID: CVE-2022-2445 State: REJECTED Published: N/A Last Updated: 2023-04-13T18:35:10.431Z Description: No description available.
CVE ID: CVE-2022-2446 State: PUBLISHED Published: 2024-09-13T15:10:43.938Z Last Updated: 2024-09-13T20:07:11.786Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: benjaminprojas Products: WP Editor Problem Types: CWE-502 Description: The WP Editor plugin for WordPress is vulnerable to deserialization of untrusted input via the 'current_theme_root' parameter in versions up to, and including 1.2.9. This makes it possible for authenticated attackers with administrative privileges to call files using a PHAR wrapper that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It
rbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f3555702-4427-4569-8fd6-f84113593e9d?source=cve - https://plugins.trac.wordpress.org/changeset/3151053/
CVE ID: CVE-2022-2447 State: PUBLISHED Published: 2022-09-01T20:30:20 Last Updated: 2024-08-03T00:39:07.647Z Vendors: n/a Products: openstack-keystone Problem Types: CWE-324 Description: A flaw was found in Keystone. There is a time lag (up to one hour in a default configuration) between when security policy says a token should be revoked from when it is actually revoked. This could allow a remote administrator to secretly maintain access for longer than expected. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2105419 - https://access.redhat.com/security/cve/CVE-2022-2447
CVE ID: CVE-2022-2448 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T00:39:07.739Z Vendors: Unknown Products: reSmush.it : the only free Image Optimizer & compress plugin Problem Types: CWE-79 Description: The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a4599942-2878-4da4-b55d-077775323b61
CVE ID: CVE-2022-2449 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T19:40:46.954Z Vendors: Unknown Products: reSmush.it : the only free Image Optimizer & compress plugin Problem Types: CWE-352 Description: The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6e42f26b-3403-4d55-99ad-2c8e2d76e537
CVE ID: CVE-2022-2450 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T19:39:40.873Z Vendors: Unknown Products: reSmush.it : the only free Image Optimizer & compress plugin Problem Types: CWE-862 Description: The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1b3ff124-f973-4584-a7d7-26cc404bfe2b
CVE ID: CVE-2022-2453 State: PUBLISHED Published: 2022-07-19T13:30:35 Last Updated: 2024-08-03T00:39:07.672Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-416 Description: Use After Free in GitHub repository gpac/gpac prior to 2.1-DEV. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/c8c964de-046a-41b2-9ff5-e25cfdb36b5a - https://github.com/gpac/gpac/commit/dc7de8d3d604426c7a6e628d90cb9fb88e7b4c2c
CVE ID: CVE-2022-2454 State: PUBLISHED Published: 2022-07-19T00:00:00 Last Updated: 2024-08-03T00:39:07.766Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-190 Description: Integer Overflow or Wraparound in GitHub repository gpac/gpac prior to 2.1-DEV. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/105d40d0-46d7-461e-9f8e-20c4cdea925f - https://github.com/gpac/gpac/commit/faa75edde3dfeba1e2cf6ffa48e45a50f1042096 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-2455 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T19:41:20.560Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2 allowed an authenticated and authorized user to exhaust server resources by importing a malicious project. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
mporting a malicious project. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/359964 - https://hackerone.com/reports/1542230 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2455.json
CVE ID: CVE-2022-2456 State: PUBLISHED Published: 2022-08-05T15:10:42 Last Updated: 2024-08-03T00:39:07.782Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for malicious group or project maintainers to change their corresponding group or project visibility by crafting a malicious POST request. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitl
fting a malicious POST request. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/359910 - https://hackerone.com/reports/1536559 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2456.json
CVE ID: CVE-2022-2457 State: PUBLISHED Published: 2022-08-09T20:15:51.000Z Last Updated: 2025-08-27T18:42:02.260Z Vendors: n/a Products: Red Hat Process Automation Manager 7 Problem Types: CWE-307 Description: A flaw was found in Red Hat Process Automation Manager 7 where an attacker can benefit from a brute force attack against Administration Console as the application does not limit the number of unsuccessful login attempts. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2107990#c0
CVE ID: CVE-2022-2458 State: PUBLISHED Published: 2022-08-09T20:15:08 Last Updated: 2024-08-03T00:39:07.716Z Vendors: n/a Products: Red Hat Process Automation Manager 7 Problem Types: CWE-91 Description: XML external entity injection(XXE) is a vulnerability that allows an attacker to interfere with an application's processing of XML data. This attack occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, XML external
of the intended sphere of control, causing the product to embed incorrect documents into its output. Here, XML external entity injection lead to External Service interaction & Internal file read in Business Central and also Kie-Server APIs. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2107994#c0
CVE ID: CVE-2022-2459 State: PUBLISHED Published: 2022-08-05T15:12:45 Last Updated: 2024-08-03T00:39:07.815Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. It may be possible for email invited members to join a project even after the Group Owner has enabled the setting to prevent members from being added to projects in a group, if the invite was sent before the setting was enabled. Additional Analyst Note
from being added to projects in a group, if the invite was sent before the setting was enabled. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/336169 - https://hackerone.com/reports/1256967 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2459.json
CVE ID: CVE-2022-2460 State: PUBLISHED Published: 2022-08-08T13:51:32.000Z Last Updated: 2025-09-03T19:03:00.211Z Vendors: Unknown Products: WPDating Problem Types: CWE-89 SQL Injection Description: The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/694b6dfd-2424-41b4-8595-b6c305c390db
CVE ID: CVE-2022-2461 State: PUBLISHED Published: 2022-09-06T17:18:58.000Z Last Updated: 2025-05-05T16:18:40.559Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: oferwald Products: Transposh WordPress Translation Problem Types: CWE-862 Missing Authorization Description: The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tp_translation' AJAX action and default settings which makes it possible for unauthenticated attackers to influence the data shown on the site. Additional Analyst Note
s which makes it possible for unauthenticated attackers to influence the data shown on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/223373fc-9d78-47f0-b283-109f8e00b802?source=cve - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2461 - https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ - https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1989 - https://packetstormsecurity.com/files/167870/wptransposh107-auth.txt - https://www.exploitalert.com/view-detail
#L1989 - https://packetstormsecurity.com/files/167870/wptransposh107-auth.txt - https://www.exploitalert.com/view-details.html?id=38891
CVE ID: CVE-2022-2462 State: PUBLISHED Published: 2022-09-06T17:18:57 Last Updated: 2024-10-15T18:34:52.936Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: oferwald Products: Transposh WordPress Translation Problem Types: CWE-200 Information Exposure Description: The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tp_history' AJAX action and insufficient restriction on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of in
ion on the data returned in the response. This makes it possible for unauthenticated users to exfiltrate usernames of individuals who have translated text. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/bd1f12ac-86ac-4be9-9575-98381c3b4291?source=cve - https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1948 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2462 - https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ - https://packetstormsecurity.com/files/167878/wptrans
/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ - https://packetstormsecurity.com/files/167878/wptransposh1081-disclose.txt
CVE ID: CVE-2022-2463 State: PUBLISHED Published: 2022-08-25T17:24:53.000Z Last Updated: 2025-04-16T16:11:52.314Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Rockwell Automation Products: ISaGRAF Workbench Problem Types: CWE-22 Description: Rockwell Automation ISaGRAF Workbench software versions 6.0 through 6.6.9 are affected by a Path Traversal vulnerability. A crafted malicious .7z exchange file may allow an attacker to gain the privileges of the ISaGRAF Workbench software when opened. If the software is running at the SYSTEM level, then the attacker will gain admin level privileges. User interaction is required for this exploit to be successful. Addit
hen the attacker will gain admin level privileges. User interaction is required for this exploit to be successful. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-202-03