Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0330 State: PUBLISHED Published: 2022-03-25T00:00:00 Last Updated: 2024-08-02T23:25:40.079Z Vendors: n/a Products: kernel Problem Types: CWE-281 Description: A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2042404 - https://www.openwall.com/lists/oss-security/2022/01/25/12 - https://security.netapp.com/advisory/ntap-20220526-0001/ - http://www.openwall.com/lists/oss-security/
y/2022/01/25/12 - https://security.netapp.com/advisory/ntap-20220526-0001/ - http://www.openwall.com/lists/oss-security/2022/11/30/1
CVE ID: CVE-2022-0331 State: PUBLISHED Published: 2022-03-29T00:30:13 Last Updated: 2024-08-02T23:25:40.012Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Sophos Products: Sophos Firewall Problem Types: n/a Description: An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5 MR2 and older. Additional Analyst Notes: - CVE Program Container: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220328-sfos-18-5-3
CVE ID: CVE-2022-0332 State: PUBLISHED Published: 2022-01-25T19:11:10 Last Updated: 2024-08-02T23:25:40.155Z Vendors: n/a Products: moodle Problem Types: CWE-89 Description: A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2043661 - https://moodle.org/mod/forum/discuss.php?d=431099
CVE ID: CVE-2022-0333 State: PUBLISHED Published: 2022-01-25T19:11:11 Last Updated: 2024-08-02T23:25:40.633Z Vendors: n/a Products: moodle Problem Types: CWE-863 Description: A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2043663 - https://moodle.org/mod/forum/discuss.php?d=431100
CVE ID: CVE-2022-0334 State: PUBLISHED Published: 2022-01-25T19:11:11 Last Updated: 2024-08-02T23:25:40.135Z Vendors: n/a Products: moodle Problem Types: CWE-863 Description: A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2043664 - https://moodle.org/mod/forum/discuss.php?d=431102
CVE ID: CVE-2022-0335 State: PUBLISHED Published: 2022-01-25T19:11:12 Last Updated: 2024-08-02T23:25:39.990Z Vendors: n/a Products: moodle Problem Types: CWE-352 Description: A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2043666 - https://moodle.org/mod/forum/discuss.php?d=431103
CVE ID: CVE-2022-0336 State: PUBLISHED Published: 2022-08-29T00:00:00 Last Updated: 2024-08-02T23:25:40.210Z Vendors: n/a Products: Samba Problem Types: CWE-276 Description: The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an
exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity. Additional Analyst Notes: - CVE Program Container: References: - https://www.samba.org/samba/security/CVE-2022-0336.html - https://bugzilla.samba.org/show_bug.cgi?id=14950 - https://github.com/samba-team/samba/commit/1a5dc817c0c9379bbaab14c676681b42b0039a3c - https://github.com/samba-team/samba/commit/c58ede44f382bd0125f761f0479c8d48156be400 - https://bugzilla.redhat.com/show_bug.cgi?id=2046134 - https://access.redhat.com/security/cve/CVE-2022-0336 - h
56be400 - https://bugzilla.redhat.com/show_bug.cgi?id=2046134 - https://access.redhat.com/security/cve/CVE-2022-0336 - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2022-0337 State: PUBLISHED Published: 2023-01-02T00:00:00 Last Updated: 2024-10-23T19:12:06.068Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop.html - https://crbug.com/1247389
CVE ID: CVE-2022-0338 State: PUBLISHED Published: 2022-01-25T09:00:12 Last Updated: 2024-08-02T23:25:40.271Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: delgan Products: delgan/loguru Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/359bea50-2bc6-426a-b2f9-175d401b1ed0 - https://github.com/delgan/loguru/commit/ea39375e62f9b8f18e2ca798a5c0fb8c972b7eaa
CVE ID: CVE-2022-0339 State: PUBLISHED Published: 2022-01-30T13:17:54 Last Updated: 2024-08-02T23:25:40.213Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: janeczku Products: janeczku/calibre-web Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/499688c4-6ac4-4047-a868-7922c3eab369 - https://github.com/janeczku/calibre-web/commit/3b216bfa07ec7992eff03e55d61732af6df9bb92
CVE ID: CVE-2022-0341 State: PUBLISHED Published: 2022-03-14T04:10:09 Last Updated: 2024-08-02T23:25:40.270Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: vanessa219 Products: vanessa219/vditor Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fa546b57-bc15-4705-824e-9474b616f628 - https://github.com/vanessa219/vditor/commit/219f8a9e272aba3cbc0096a82cac776532dbb9e5
CVE ID: CVE-2022-0342 State: PUBLISHED Published: 2022-03-28T12:05:11 Last Updated: 2024-08-02T23:25:40.167Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Zyxel Products: USG/ZyWALL series firmware, USG FLEX series firmware, ATP series firmware, VPN series firmware, NSG series firmware Problem Types: CWE-287 Description: An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which
20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/Zyxel-security-advisory-for-authentication-bypass-vulnerability-of-firewalls.shtml
CVE ID: CVE-2022-0343 State: PUBLISHED Published: 2022-03-29T15:10:11.000Z Last Updated: 2025-04-21T13:54:49.491Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Google LLC Products: Perfetto Dev Scripts Problem Types: CWE-275 Description: A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://android-review.googlesource.com/c/platform/external/perfetto/+/1999296/
CVE ID: CVE-2022-0344 State: PUBLISHED Published: 2022-03-28T18:53:07 Last Updated: 2024-08-02T23:25:40.256Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.c
st and later moved to a public project Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/37015 - https://hackerone.com/reports/724880 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0344.json
CVE ID: CVE-2022-0345 State: PUBLISHED Published: 2022-02-28T09:06:47 Last Updated: 2024-08-02T23:25:40.513Z Vendors: Unknown Products: Customize WordPress Emails and Alerts Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.). Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b3b523b9-6c92-4091-83
Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b3b523b9-6c92-4091-837a-d34e3174eb19
CVE ID: CVE-2022-0346 State: PUBLISHED Published: 2022-05-23T07:15:21 Last Updated: 2024-08-02T23:25:40.521Z Vendors: Unknown Products: XML Sitemap Generator for Google Problem Types: CWE-79 Description: The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4b339390-d71a-44e0-8682-51a12bd2bfe6
CVE ID: CVE-2022-0347 State: PUBLISHED Published: 2022-03-07T08:16:26 Last Updated: 2024-08-02T23:25:40.244Z Vendors: Unknown Products: LoginPress | Custom Login Page Customizer Problem Types: CWE-79 Description: The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a5084367-842b-496a-a23c-24dbebac1e8b
CVE ID: CVE-2022-0348 State: PUBLISHED Published: 2022-01-27T14:10:11 Last Updated: 2024-08-02T23:25:39.983Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/250e79be-7e5d-4ba3-9c34-655e39ade2f4 - https://github.com/pimcore/pimcore/commit/832c34aeb9f21f213295a0c28377132df996352a
CVE ID: CVE-2022-0349 State: PUBLISHED Published: 2022-03-07T08:16:27 Last Updated: 2024-08-02T23:25:40.197Z Vendors: Unknown Products: NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor Problem Types: CWE-89 Description: The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1d0dd7be-29f3-4043-a9c6-67d02746463a
CVE ID: CVE-2022-0350 State: PUBLISHED Published: 2022-03-31T15:15:14 Last Updated: 2024-08-02T23:25:40.226Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H) Vendors: vanessa219 Products: vanessa219/vditor Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8202aa06-4b49-45ff-aa0f-00982f62005c - https://github.com/vanessa219/vditor/commit/e912e36ea98251d700499b1ac7702708d3398476
CVE ID: CVE-2022-0351 State: PUBLISHED Published: 2022-01-25T00:00:00.000Z Last Updated: 2025-11-03T20:34:20.193Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-786 Description: Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/8b36db58-b65c-4298-be7f-40b9e37fd161 - https://github.com/vim/vim/commit/fe6fb267e6ee5c5da2f41889e4e0e0ac5bf4b89d - https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213
ian-lts-announce/2022/05/msg00022.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/43 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0352 State: PUBLISHED Published: 2022-01-28T21:29:15 Last Updated: 2024-08-02T23:25:40.508Z Severity: HIGH (CVSS 8.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: janeczku Products: janeczku/calibre-web Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a577ff17-2ded-4c41-84ae-6ac02440f717 - https://github.com/janeczku/calibre-web/commit/6bf07539788004513c3692c074ebc7ba4ce005e1
CVE ID: CVE-2022-0353 State: PUBLISHED Published: 2023-10-24T20:39:21.969Z Last Updated: 2024-09-11T18:48:59.900Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: HardwareScanPlugin , Diagnostics Problem Types: CWE-400 Description: A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics versions prior to 4.45 that could allow a local user with administrative access to trigger a system crash. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-94532 - https://support.lenovo.com/us/
Vulnrichment: References: - https://support.lenovo.com/us/en/product_security/LEN-94532 - https://support.lenovo.com/us/en/product_security/LEN-102365
CVE ID: CVE-2022-0354 State: PUBLISHED Published: 2022-04-22T20:30:47 Last Updated: 2024-08-02T23:25:40.291Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: System Update Problem Types: Insecure GUI Description: A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-76673 - https://www.infosec.tir
E Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-76673 - https://www.infosec.tirol/cve-2022-0354/
CVE ID: CVE-2022-0355 State: PUBLISHED Published: 2022-01-26T00:00:00 Last Updated: 2024-08-02T23:25:40.264Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: feross Products: feross/simple-get Problem Types: CWE-212 Description: Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/42c79c23-6646-46c4-871d-219c0d4b4e31 - https://github.com/feross/simple-get/commit/e4af095e06cd69a9235013e8507e220a79b9684f - https://github.com/advisories/GHSA-wpg7-2c88-r8xv
CVE ID: CVE-2022-0357 State: PUBLISHED Published: 2023-05-24T07:53:32.812Z Last Updated: 2025-01-16T15:43:43.255Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Bitdefender Products: Total Security, Internet Security, Antivirus Plus Problem Types: CWE-428 Description: Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to 26.0.10.45. Bitdefender Internet Security versions prior to 26.0.10.45. Bitdefender Antivirus Plus versi
rsions prior to 26.0.10.45. Bitdefender Internet Security versions prior to 26.0.10.45. Bitdefender Antivirus Plus versions prior to 26.0.10.45. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/improper-quoting-path-issue-in-bitdefender-total-security
CVE ID: CVE-2022-0358 State: PUBLISHED Published: 2022-08-29T00:00:00 Last Updated: 2024-08-02T23:25:40.534Z Vendors: n/a Products: QEMU/virtiofsd Problem Types: CWE-273 Description: A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating thei
unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2044863 - https://gitlab.com/qemu-project/qemu/-/commit/449e8171f96a6a944d1f3b7d3627ae059eae21ca - https://access.redhat.com/security/cve/CVE-2022-0358 - https://security.netapp.com/advisory/ntap-20221007-0008/
CVE ID: CVE-2022-0359 State: PUBLISHED Published: 2022-01-26T00:00:00.000Z Last Updated: 2025-11-03T20:34:21.582Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a3192d90-4f82-4a67-b7a6-37046cc88def - https://github.com/vim/vim/commit/85b6747abc15a7a81086db31289cf1b8b17e6cb1 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213444 - https://suppor
2/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/43 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0360 State: PUBLISHED Published: 2022-02-28T09:06:48 Last Updated: 2024-08-02T23:25:40.211Z Vendors: Unknown Products: Easy Drag And drop All Import : WP Ultimate CSV Importer Problem Types: CWE-79 Description: The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d718b993-4de5-499c-84c9-69801396f51f - https://plugins.trac.wordpress.org/changeset/2662897
CVE ID: CVE-2022-0361 State: PUBLISHED Published: 2022-01-26T00:00:00.000Z Last Updated: 2025-11-03T20:34:22.982Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a055618c-0311-409c-a78a-99477121965b - https://github.com/vim/vim/commit/dc5490e2cbc8c16022a23b449b48c1bd0083f366 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213444 - https://support.
03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/43 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0362 State: PUBLISHED Published: 2022-01-26T12:40:10 Last Updated: 2024-08-02T23:25:40.489Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-89 Description: SQL Injection in Packagist showdoc/showdoc prior to 2.10.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e7c72417-eb8f-416c-8480-be76ac0a9091 - https://github.com/star7th/showdoc/commit/2b34e267e4186125f99bfa420140634ad45801fb
CVE ID: CVE-2022-0363 State: PUBLISHED Published: 2022-04-25T15:50:56 Last Updated: 2024-08-02T23:25:40.197Z Vendors: Unknown Products: myCred Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a438a951-497c-43cd-822f-1a48d4315191