Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3444 State: PUBLISHED Published: 2022-11-01T00:00:00 Last Updated: 2024-08-03T01:07:06.619Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in File System API in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass File System restrictions via a crafted HTML page and malicious file. (Chromium security severity: Low) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_27.html - https://crbug.com/1208439 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/me
https://crbug.com/1208439 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YKLJ3B3D5BCVWE3QNP4N7HHF26OHD567/
CVE ID: CVE-2022-3445 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-11-12T15:59:29.330Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Skia in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html - https://crbug.com/1364604 - https://security.gentoo.org/glsa/202305-10
CVE ID: CVE-2022-3446 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-24T13:19:23.194Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in WebSQL in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html - https://crbug.com/1368076 - https://security.gentoo.org/glsa/202305-10
CVE ID: CVE-2022-3447 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-29T14:44:18.669Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 106.0.5249.119 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html - https://crbug.com/1366582 - https://security.gentoo.org/glsa/202305-10
CVE ID: CVE-2022-3448 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-24T13:17:43.235Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Permissions API in Google Chrome prior to 106.0.5249.119 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html - https://crbug.com/1363040 - https://security.gentoo.org/glsa/202305-10
CVE ID: CVE-2022-3449 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-24T13:16:26.875Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Safe Browsing in Google Chrome prior to 106.0.5249.119 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html - https://crbug.com/1364662 - https://security.gentoo.org/glsa/202305-10
CVE ID: CVE-2022-3450 State: PUBLISHED Published: 2022-11-09T00:00:00 Last Updated: 2024-10-23T20:18:39.087Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Peer Connection in Google Chrome prior to 106.0.5249.119 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/10/stable-channel-update-for-desktop_11.html - https://crbug.com/1369882 - https://security.gentoo.org/glsa/202305-10
CVE ID: CVE-2022-3451 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-01T20:43:37.425Z Vendors: Unknown Products: Product Stock Manager Problem Types: CWE-862, CWE-352 Description: The Product Stock Manager WordPress plugin before 1.0.5 does not have authorisation and proper CSRF checks in multiple AJAX actions, allowing users with a role as low as subscriber to call them. One action in particular could allow to update arbitrary options Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d8005cd0-8232-4d43-a4e4-14728eaf1300
CVE ID: CVE-2022-3452 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-04-15T13:45:52.723Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Book Store Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Book Store Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /category.php. The manipulation of the argument category_name leads to cross site scripting. The attack can be initiated remotely. The identifier of this vulnerability is VDB-210436. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnr
The identifier of this vulnerability is VDB-210436. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.210436
CVE ID: CVE-2022-3453 State: PUBLISHED Published: 2022-10-11T00:00:00.000Z Last Updated: 2025-04-15T13:45:45.294Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Book Store Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Book Store Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /transcation.php. The manipulation of the argument buyer_name leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-210437 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA
The identifier VDB-210437 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.210437
CVE ID: CVE-2022-3456 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T14:49:50.154Z Severity: MEDIUM (CVSS 5.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b34412ca-50c5-4615-b7e3-5d07d33acfce - https://github.com/ikus060/rdiffweb/commit/b78ec09f4582e363f6f449df6f987127e126c311
CVE ID: CVE-2022-3457 State: PUBLISHED Published: 2022-10-13T00:00:00.000Z Last Updated: 2025-05-15T14:47:54.934Z Severity: LOW (CVSS 3.7 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-346 Description: Origin Validation Error in GitHub repository ikus060/rdiffweb prior to 2.5.0a5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/cfcab02e-d6ad-4dcf-b1b0-da90434bc55b - https://github.com/ikus060/rdiffweb/commit/afc1bdfab5161c74012ff2590a6ec49cc0d8fde0
CVE ID: CVE-2022-3458 State: PUBLISHED Published: 2022-10-12T00:00:00 Last Updated: 2024-08-03T01:07:06.750Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Human Resource Management System Problem Types: CWE-266 Description: A vulnerability has been found in SourceCodester Human Resource Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /employeeview.php of the component Image File Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The associated identifier of this vulnerability is VDB-210559. Additional Analyst Notes: -
ck can be launched remotely. The associated identifier of this vulnerability is VDB-210559. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.210559
CVE ID: CVE-2022-3459 State: PUBLISHED Published: 2024-09-14T02:04:19.287Z Last Updated: 2024-09-16T18:28:01.955Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: ankitpokhrel Products: WooCommerce Multiple Free Gift Problem Types: CWE-639 Description: The WooCommerce Multiple Free Gift plugin for WordPress is vulnerable to gift manipulation in all versions up to, and including, 1.2.3. This is due to plugin not enforcing server-side checks on the products that can be added as a gift. This makes it possible for unauthenticated attackers to add non-gift items to their cart as a gift. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.w
d non-gift items to their cart as a gift. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cdb9c321-1a2c-4593-9947-2071a908ee1c?source=cve - https://plugins.trac.wordpress.org/browser/woocommerce-multiple-free-gift/trunk/lib/WFG_Frontend.class.php#L189
CVE ID: CVE-2022-3460 State: PUBLISHED Published: 2023-01-02T00:00:00.000Z Last Updated: 2025-04-10T15:25:44.314Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Exposure of Sensitive Information Through Environmental Variables Description: In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed in variable preview. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2022/sa2022-25/
CVE ID: CVE-2022-3461 State: PUBLISHED Published: 2022-11-15T10:59:53.718Z Last Updated: 2025-04-29T20:13:09.642Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: PHOENIX CONTACT Products: Config+, PC Worx, PC Worx Express Problem Types: CWE-119 Description: In PHOENIX CONTACT Automationworx Software Suite up to version 1.89 manipulated PC Worx or Config+ files could lead to a heap buffer overflow and a read access violation. Availability, integrity, or confidentiality of an application programming workstation might be compromised by attacks using these vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
sing these vulnerabilities. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert.vde.com/en/advisories/VDE-2022-048/
CVE ID: CVE-2022-3462 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-01T20:42:59.733Z Vendors: Unknown Products: Highlight Focus Problem Types: CWE-79 Description: The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b583de48-1332-4984-8c0c-a7ed4a2397cd
CVE ID: CVE-2022-3463 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-01T20:25:04.059Z Vendors: Unknown Products: Contact Form Plugin – Fastest Contact Form Builder Plugin for WordPress by Fluent Forms Problem Types: CWE-1236 Description: The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CSV injection Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e2a59481-db45-4b8e-b17a-447303469364
CVE ID: CVE-2022-3464 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-04-15T13:45:33.279Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: puppyCMS Problem Types: CWE-707 Description: A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument site_name leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this vulnerability is VDB-210699. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
B-210699. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.210699
CVE ID: CVE-2022-3465 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-04-14T15:58:43.861Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Mediabridge Products: Medialink Problem Types: CWE-287 Description: A vulnerability classified as critical was found in Mediabridge Medialink. This vulnerability affects unknown code of the file /index.asp. The manipulation leads to improper authentication. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210700. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
rability is VDB-210700. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Peanut886/Vulnerability/blob/main/MediaLink%20Unauthorized%20access.md - https://vuldb.com/?id.210700
CVE ID: CVE-2022-3466 State: PUBLISHED Published: 2023-09-15T13:18:27.974Z Last Updated: 2024-08-03T01:14:01.483Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: Red Hat Products: Red Hat OpenShift Container Platform 4.12, Red Hat OpenShift Container Platform 3.11 Problem Types: CWE-276 Description: The version of cri-o as released for Red Hat OpenShift Container Platform 4.9.48, 4.10.31, and 4.11.6 via RHBA-2022:6316, RHBA-2022:6257, and RHBA-2022:6658, respectively, included an incorrect version of cri-o missing the fix for CVE-2022-27652, which was previously fixed in OCP 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an
, which was previously fixed in OCP 4.9.41 and 4.10.12 via RHBA-2022:5433 and RHSA-2022:1600. This issue could allow an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. For more details, see https://access.redhat.com/security/cve/CVE-2022-27652. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2022:7398 - https://access.redhat.com/security/cve/CVE-2022-3466 - https://bugzilla.redhat.com/show_bug.cgi?id=2134063
CVE ID: CVE-2022-3467 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-04-15T13:45:24.053Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Jiusi Products: OA Problem Types: CWE-707 Description: A vulnerability classified as critical was found in Jiusi OA. Affected by this vulnerability is an unknown functionality of the file /jsoa/hntdCustomDesktopActionContent. The manipulation of the argument inforid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-210709 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
ssigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cnblogs.com/J0o1ey/p/16785375.html - https://vuldb.com/?id.210709
CVE ID: CVE-2022-3469 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-05-05T16:12:56.800Z Vendors: Unknown Products: WP Attachments Problem Types: CWE-79 Description: The WP Attachments WordPress plugin before 5.0.5 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/017ca231-e019-4694-afa2-ab7f8481ae63
CVE ID: CVE-2022-3470 State: PUBLISHED Published: 2022-10-12T00:00:00 Last Updated: 2024-08-03T01:14:01.521Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Human Resource Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Human Resource Management System. It has been classified as critical. Affected is an unknown function of the file getstatecity.php. The manipulation of the argument sc leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-210714 is the identifier assigned to this vulnerability. Additional
as been disclosed to the public and may be used. VDB-210714 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Hanfu-l/POC-Exp/blob/main/The%20Human%20Resource%20Management%20System%20sc%20parameter%20is%20injected.pdf - https://vuldb.com/?id.210714
CVE ID: CVE-2022-3471 State: PUBLISHED Published: 2022-10-12T00:00:00 Last Updated: 2024-08-03T01:14:01.442Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Human Resource Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Human Resource Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file city.php. The manipulation of the argument searccity leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-2
. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-210715. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Hanfu-l/POC-Exp/blob/main/The%20Human%20Resource%20Management%20System%20searccity%20parameter%20is%20injected.pdf - https://vuldb.com/?id.210715
CVE ID: CVE-2022-3472 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-04-15T13:45:16.952Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Human Resource Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Human Resource Management System. It has been rated as critical. Affected by this issue is some unknown functionality of the file city.php. The manipulation of the argument cityedit leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210716. Additiona
exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-210716. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Hanfu-l/POC-Exp/blob/main/The%20Human%20Resource%20Management%20System%20cityedit%20parameter%20is%20injected.pdf - https://vuldb.com/?id.210716
CVE ID: CVE-2022-3473 State: PUBLISHED Published: 2022-10-12T00:00:00 Last Updated: 2024-08-03T01:14:01.456Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Human Resource Management System Problem Types: CWE-707 Description: A vulnerability classified as critical has been found in SourceCodester Human Resource Management System. This affects an unknown part of the file getstatecity.php. The manipulation of the argument ci leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-210717 was assigned to this vulnerability. Additional Analyst
isclosed to the public and may be used. The identifier VDB-210717 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Hanfu-l/POC-Exp/blob/main/The%20Human%20Resource%20Management%20System%20ci%20parameter%20is%20injected.pdf - https://vuldb.com/?id.210717
CVE ID: CVE-2022-3474 State: PUBLISHED Published: 2022-10-26T00:00:00 Last Updated: 2024-08-03T01:14:01.488Z Vendors: Google LLC Products: Bazel Problem Types: CWE-522 Description: A bad credential handling in the remote assets API for Bazel versions prior to 5.3.2 and 4.2.3 sends all user-provided credentials instead of only the required ones for the requests. We recommend upgrading to versions later than or equal to 5.3.2 or 4.2.3. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/bazelbuild/bazel/security/advisories/GHSA-mxr8-q875-rhwq
CVE ID: CVE-2022-3477 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T19:15:06.272Z Vendors: tagDiv Products: tagDiv Composer, Newspaper, Newsmag Problem Types: CWE-287 Description: The tagDiv Composer WordPress plugin before 3.5, required by the Newspaper WordPress theme before 12.1 and Newsmag WordPress theme before 5.2.2, does not properly implement the Facebook login feature, allowing unauthenticated attackers to login as any user by just knowing their email address Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/993a95d2-6fce-48de-ae17-06ce2db829ef
CVE ID: CVE-2022-3478 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T15:05:04.648Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.5, all versions starting from 15.6 before 15.6.1. It was possible to trigger a DoS attack by uploading a malicious nuget package. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/37
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/377788 - https://hackerone.com/reports/1716296 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3478.json