Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1755 State: PUBLISHED Published: 2022-09-26T12:35:31.000Z Last Updated: 2025-05-21T19:21:54.712Z Vendors: Unknown Products: SVG Support Problem Types: CWE-79 Description: The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/62b2548e-6b59-48b8-b1c2-9bd47e634982
CVE ID: CVE-2022-1756 State: PUBLISHED Published: 2022-06-13T12:42:33 Last Updated: 2024-08-03T00:16:59.701Z Vendors: Unknown Products: Newsletter – Send awesome emails from WordPress Problem Types: CWE-79 Description: The Newsletter WordPress plugin before 7.4.5 does not sanitize and escape the $_SERVER['REQUEST_URI'] before echoing it back in admin pages. Although this uses addslashes, and most modern browsers automatically URLEncode requests, this is still vulnerable to Reflected XSS in older browsers such as Internet Explorer 9 or below. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6ad407fe-db2b-41fb-834b-dd8c4f62b072
CVE ID: CVE-2022-1757 State: PUBLISHED Published: 2022-07-11T12:56:16 Last Updated: 2024-08-03T00:16:59.901Z Vendors: Unknown Products: pagebar Problem Types: CWE-352, CWE-79 Description: The pagebar WordPress plugin before 2.70 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of sanitisation in some of them, it could also lead to Stored XSS issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e648633e-868b-45b2-870a-308a2f9cb7f5
CVE ID: CVE-2022-1758 State: PUBLISHED Published: 2022-06-13T12:42:34 Last Updated: 2024-08-03T00:16:59.867Z Vendors: Unknown Products: Genki Pre-Publish Reminder Problem Types: CWE-352 Description: The Genki Pre-Publish Reminder WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored XSS as well as RCE when custom code is added via the plugin settings. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/211816ce-d2bc-469b-9a8e-e0c2a5c4461b
CVE ID: CVE-2022-1759 State: PUBLISHED Published: 2022-06-13T12:42:36 Last Updated: 2024-08-03T00:16:59.833Z Vendors: Unknown Products: RB Internal Links Problem Types: CWE-352 Description: The RB Internal Links WordPress plugin through 2.0.16 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as perform Stored Cross-Site Scripting attacks due to the lack of sanitisation and escaping Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d8e63f78-f38a-4f68-96ba-8059d175cea8
CVE ID: CVE-2022-1760 State: PUBLISHED Published: 2024-01-16T15:52:21.304Z Last Updated: 2025-06-02T15:10:39.939Z Vendors: Unknown Products: Core Control Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Core Control WordPress plugin through 1.2.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c7906b1d-25c9-4f34-bd02-66824878b88e/
CVE ID: CVE-2022-1761 State: PUBLISHED Published: 2022-06-13T12:42:37 Last Updated: 2024-08-03T00:16:59.654Z Vendors: Unknown Products: Peter’s Collaboration E-mails Problem Types: CWE-352 Description: The Peter’s Collaboration E-mails WordPress plugin through 2.2.0 is vulnerable to CSRF due to missing nonce checks. This allows the change of its settings, which can be used to lower the required user level, change texts, the used email address and more. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/31b413e1-d4b5-463e-9910-37876881c062
CVE ID: CVE-2022-1762 State: PUBLISHED Published: 2022-06-13T12:42:39 Last Updated: 2024-08-03T00:16:59.806Z Vendors: Unknown Products: iQ Block Country Problem Types: CWE-290 Authentication Bypass by Spoofing Description: The iQ Block Country WordPress plugin before 1.2.20 does not properly checks HTTP headers in order to validate the origin IP address, allowing threat actors to bypass it's block feature by spoofing the headers. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/03254977-37cc-4365-979b-326f9637be85
CVE ID: CVE-2022-1763 State: PUBLISHED Published: 2022-06-13T12:42:40 Last Updated: 2024-08-03T00:16:59.872Z Vendors: Unknown Products: Static Page eXtended Problem Types: CWE-352 Description: Due to missing checks the Static Page eXtended WordPress plugin through 2.1 is vulnerable to CSRF attacks which allows changing the plugin settings, including required user levels for specific features. This could also lead to Stored Cross-Site Scripting due to the lack of escaping in some of the settings Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bd3aff73-078a-4e5a-b9e3-1604851c6df8
CVE ID: CVE-2022-1764 State: PUBLISHED Published: 2022-06-13T12:42:42 Last Updated: 2024-08-03T00:17:00.538Z Vendors: Unknown Products: WP-chgFontSize Problem Types: CWE-352 Description: The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/04305e4e-37e3-4f35-bf66-3b79b99d2868
CVE ID: CVE-2022-1765 State: PUBLISHED Published: 2022-06-13T12:42:43 Last Updated: 2024-08-03T00:16:59.872Z Vendors: Unknown Products: Hot Linked Image Cacher Problem Types: CWE-352 Description: The Hot Linked Image Cacher WordPress plugin through 1.16 is vulnerable to CSRF. This can be used to store / cache images from external domains on the server, which could lead to legal risks (due to copyright violations or licensing rules). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b50e7622-c1dc-485b-a5f5-b010b40eef20
CVE ID: CVE-2022-1766 State: PUBLISHED Published: 2022-07-20T16:10:10.790146Z Last Updated: 2024-09-16T20:36:35.624Z Vendors: Anchore Inc. Products: Anchore Enterprise, AnchoreCTL Problem Types: CWE-522 Description: Anchore Enterprise anchorectl version 0.1.4 improperly stored credentials when generating a Software Bill of Materials. anchorectl will add the credentials used to access Anchore Enterprise API in the Software Bill of Materials (SBOM) generated by anchorectl. Users of anchorectl version 0.1.4 should upgrade to anchorectl version 0.1.5 to resolve this issue. Additional Analyst Notes: - CVE Program Container: References: - https://docs.anchore.com/current/docs/releasenotes/401/
CVE ID: CVE-2022-1767 State: PUBLISHED Published: 2022-05-18T15:45:11 Last Updated: 2024-08-03T00:16:59.753Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b1ce040c-9ed1-4d36-9b48-82df42310868 - https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf
CVE ID: CVE-2022-1768 State: PUBLISHED Published: 2022-06-13T13:08:27.000Z Last Updated: 2025-02-13T16:28:51.760Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: davidfcarr Products: RSVPMaker Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to insufficient escaping and parameterization on user supplied data passed to multiple SQL queries in the ~/rsvpmaker-email.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and includ
it possible for unauthenticated attackers to steal sensitive information from the database in versions up to, and including, 9.3.2. Please note that this is separate from CVE-2022-1453 & CVE-2022-1505. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c1d02646-271a-4079-8a47-00b4029e9c1f?source=cve - https://gist.github.com/Xib3rR4dAr/441d6bb4a5b8ad4b25074a49210a02cc - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1768 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2725322%40rsvpmaker&new=2725322%40rsvpmaker&sfp_email=&sfph_mail= - http://packet
et?sfp_email=&sfph_mail=&reponame=&old=2725322%40rsvpmaker&new=2725322%40rsvpmaker&sfp_email=&sfph_mail= - http://packetstormsecurity.com/files/176549/WordPress-RSVPMaker-9.3.2-SQL-Injection.html
CVE ID: CVE-2022-1769 State: PUBLISHED Published: 2022-05-17T00:00:00 Last Updated: 2024-08-03T00:16:59.943Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-126 Description: Buffer Over-read in GitHub repository vim/vim prior to 8.2.4974. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/522076b2-96cb-4df6-a504-e6e2f64c171c - https://github.com/vim/vim/commit/4748c4bd64610cf943a431d215bb1aad51f8d0b4 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QKIX5HYKWXWG6QBCPPTPQ53GNOFHSAIS/ - https://lists.fedoraproject.org/archives/list
unce%40lists.fedoraproject.org/message/QKIX5HYKWXWG6QBCPPTPQ53GNOFHSAIS/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUPOLEX5GXC733HL4EFYMHFU7NISJJZG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFAZTAT5CZC2R6KYDYA2HBAVEDSIX6MW/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1770 State: PUBLISHED Published: 2022-05-20T18:05:10 Last Updated: 2024-08-03T00:16:59.915Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: polonel Products: polonel/trudesk Problem Types: CWE-269 Description: Improper Privilege Management in GitHub repository polonel/trudesk prior to 1.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/74a252a2-8bf6-4f88-a180-b90338a239fa - https://github.com/polonel/trudesk/commit/889876f66c9a5b28f019258e329310c31d72cbd2
CVE ID: CVE-2022-1771 State: PUBLISHED Published: 2022-05-18T00:00:00 Last Updated: 2024-08-03T00:16:59.938Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-674 Description: Uncontrolled Recursion in GitHub repository vim/vim prior to 8.2.4975. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/faa74175-5317-4b71-a363-dfc39094ecbb - https://github.com/vim/vim/commit/51f0bfb88a3554ca2dde777d78a59880d1ee37a8 - https://security.gentoo.org/glsa/202208-32 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1772 State: PUBLISHED Published: 2022-06-13T12:42:45 Last Updated: 2024-08-03T00:16:59.892Z Vendors: Unknown Products: Google Places Reviews Problem Types: CWE-79 Description: The Google Places Reviews WordPress plugin before 2.0.0 does not properly escape its Google API key setting, which is reflected on the site's administration panel. A malicious administrator could abuse this bug, in a multisite WordPress configuration, to trick super-administrators into viewing the booby-trapped payload and taking over their account. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/02addade-d191-4e45-b7b5-2f3f673679ab
CVE ID: CVE-2022-1773 State: PUBLISHED Published: 2022-06-13T12:42:46 Last Updated: 2024-08-03T00:16:59.886Z Vendors: Unknown Products: WP Athletics Problem Types: CWE-79 Description: The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c2cc3d8e-f3ac-46c6-871e-894cf3ba67f6
CVE ID: CVE-2022-1774 State: PUBLISHED Published: 2022-05-18T20:40:10 Last Updated: 2024-08-03T00:16:59.870Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.0.7. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf - https://huntr.dev/bounties/6ac07c49-bb7f-47b5-b361-33e6757b8757
CVE ID: CVE-2022-1775 State: PUBLISHED Published: 2022-05-20T22:35:11 Last Updated: 2024-08-03T00:16:59.880Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: polonel Products: polonel/trudesk Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository polonel/trudesk prior to 1.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0966043c-602f-463e-a6e5-9a1745f4fbfa - https://github.com/polonel/trudesk/commit/13dd6c61fc85fa773b4065f075fceda563129c53
CVE ID: CVE-2022-1776 State: PUBLISHED Published: 2022-06-27T08:57:34 Last Updated: 2024-08-03T00:16:59.614Z Vendors: Unknown Products: Popups, Welcome Bar, Optins and Lead Generation Plugin – Icegram Problem Types: CWE-79 Description: The Popups, Welcome Bar, Optins and Lead Generation Plugin WordPress plugin before 2.1.8 does not sanitize and escape some campaign parameters, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/46ed56db-9b9d-4390-80fc-343a01fcc3c9
CVE ID: CVE-2022-1777 State: PUBLISHED Published: 2022-06-13T12:42:48 Last Updated: 2024-08-03T00:16:59.974Z Vendors: Unknown Products: Filr – Secure document library Problem Types: CWE-862 Description: The Filr WordPress plugin before 1.2.2.1 does not have authorisation check in two of its AJAX actions, allowing them to be called by any authenticated users, such as subscriber. They are are protected with a nonce, however the nonce is leaked on the dashboard. This could allow them to upload arbitrary HTML files as well as delete all files or arbitrary ones. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a50dc7f8-a9e6-41fa-a047-ad1c3bc309b4
CVE ID: CVE-2022-1778 State: PUBLISHED Published: 2022-09-14T17:05:36.801Z Last Updated: 2025-06-04T15:05:54.743Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Hitachi Energy Products: MicroSCADA X SYS600 Problem Types: CWE-119 Description: Improper Input Validation vulnerability in Hitachi Energy MicroSCADA X SYS600 while reading a specific configuration file causes a buffer-overflow that causes a failure to start the SYS600. The configuration file can only be accessed by an administrator access. This issue affects: Hitachi Energy MicroSCADA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachi
DA X SYS600 version 10 to version 10.3.1. cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.1.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentId=8DBD000106&languageCode=en&Preview=true
CVE ID: CVE-2022-1779 State: PUBLISHED Published: 2022-06-13T12:42:49 Last Updated: 2024-08-03T00:16:59.906Z Vendors: Unknown Products: Auto Delete Posts Problem Types: CWE-352 Description: The Auto Delete Posts WordPress plugin through 1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and delete specific posts, categories and attachments at once. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/45117646-88ff-41d4-8abd-e2f18d4b693e
CVE ID: CVE-2022-1780 State: PUBLISHED Published: 2022-06-13T12:42:51 Last Updated: 2024-08-03T00:16:59.855Z Vendors: Unknown Products: LaTeX for WordPress Problem Types: CWE-352 Description: The LaTeX for WordPress plugin through 3.4.10 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack which could also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/dd22ea1e-49a9-4b06-8dd9-bb224110f98a
CVE ID: CVE-2022-1781 State: PUBLISHED Published: 2022-06-13T12:42:52 Last Updated: 2024-08-03T00:16:59.892Z Vendors: Unknown Products: postTabs Problem Types: CWE-352 Description: The postTabs WordPress plugin through 2.10.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, which also lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7f2ae2c9-57d4-46a0-a9a1-585ec543b153
CVE ID: CVE-2022-1782 State: PUBLISHED Published: 2022-05-18T09:00:14 Last Updated: 2024-08-03T00:16:59.850Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: erudika Products: erudika/para Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository erudika/para prior to v1.45.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7555693f-94e4-4183-98cb-3497da6df028 - https://github.com/erudika/para/commit/9d844f31333475a0394dd14b901ea50674b281f8
CVE ID: CVE-2022-1783 State: PUBLISHED Published: 2022-06-06T17:00:32 Last Updated: 2024-08-03T00:16:59.907Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for malicious group maintainers to add new members to a project within their group, through the REST API, even after their group owner enabled a setting to prevent members from being added to project
oup, through the REST API, even after their group owner enabled a setting to prevent members from being added to projects within that group. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353121 - https://hackerone.com/reports/1472109 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1783.json
CVE ID: CVE-2022-1784 State: PUBLISHED Published: 2022-05-20T12:15:11 Last Updated: 2024-08-03T00:16:59.867Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.8. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/jgraph/drawio/commit/c63f3a04450f30798df47f9badbc74eb8a69fbdf - https://huntr.dev/bounties/d1330ce8-cccb-4bae-b9a9-a03b97f444a5
CVE ID: CVE-2022-1785 State: PUBLISHED Published: 2022-05-19T00:00:00.000Z Last Updated: 2025-11-03T20:34:37.428Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-787 Description: Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8c969cba-eef2-4943-b44a-4e3089599109 - https://github.com/vim/vim/commit/e2bd8600b873d2cd1f9d667c28cba8b1dba18839 - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1786 State: PUBLISHED Published: 2022-05-31T18:45:44 Last Updated: 2024-08-03T00:16:59.956Z Vendors: n/a Products: kernel Problem Types: CWE-843 Description: A use-after-free flaw was found in the Linux kernel’s io_uring subsystem in the way a user sets up a ring with IORING_SETUP_IOPOLL with more than one task completing submissions on this ring. This flaw allows a local user to crash or escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2087760 - https://www.debian.org/security/2022/dsa-5161 - https://security.netapp.com/advisory/ntap-20220722-0001/
CVE ID: CVE-2022-1787 State: PUBLISHED Published: 2022-06-13T12:42:54 Last Updated: 2024-08-03T00:16:59.877Z Vendors: Unknown Products: Sideblog WordPress Plugin Problem Types: CWE-352 Description: The Sideblog WordPress plugin through 6.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b85920b3-dfc1-4112-abd8-ce6a5d91ae0d
CVE ID: CVE-2022-1788 State: PUBLISHED Published: 2022-06-13T12:42:55 Last Updated: 2024-08-03T00:16:59.905Z Vendors: Unknown Products: Change Uploaded File Permissions Problem Types: CWE-352 Description: Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c39719e5-dadd-4414-a96d-5e70a1e3d462
CVE ID: CVE-2022-1789 State: PUBLISHED Published: 2022-05-31T18:48:00 Last Updated: 2024-08-03T00:16:59.887Z Vendors: n/a Products: kernel Problem Types: CWE-476 Description: With shadow paging enabled, the INVPCID instruction results in a call to kvm_mmu_invpcid_gva. If INVPCID is executed with CR0.PG=0, the invlpg callback is not set and the result is a NULL pointer dereference. Additional Analyst Notes: - CVE Program Container: References: - https://francozappa.github.io/about-bias/ - https://bugzilla.redhat.com/show_bug.cgi?id=1832397 - https://kb.cert.org/vuls/id/647177/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBUOQTNTQ4ZCXHOCNK