Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3546 State: PUBLISHED Published: 2022-10-17T00:00:00 Last Updated: 2024-08-03T01:14:01.537Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Simple Cold Storage Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /csms/admin/?page=user/list of the component Create User Handler. The manipulation of the argument First Name/Last Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the publi
ast Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-211046 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/thehackingverse/Stored-xss-/blob/main/Poc - https://vuldb.com/?id.211046
CVE ID: CVE-2022-3547 State: PUBLISHED Published: 2022-10-17T00:00:00 Last Updated: 2024-08-03T01:14:02.513Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Simple Cold Storage Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been classified as problematic. This affects an unknown part of the file /csms/admin/?page=system_info of the component Setting Handler. The manipulation of the argument System Name/System Short Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the pu
leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-211047. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/lakshaya0557/POCs/blob/main/POC - https://vuldb.com/?id.211047
CVE ID: CVE-2022-3548 State: PUBLISHED Published: 2022-10-17T00:00:00 Last Updated: 2024-11-20T14:44:17.786Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Simple Cold Storage Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the component Add New Storage Handler. The manipulation of the argument Name leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability i
initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-211048. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Ramansh123454/POCs/blob/main/POC - https://vuldb.com/?id.211048
CVE ID: CVE-2022-3549 State: PUBLISHED Published: 2022-10-17T00:00:00 Last Updated: 2024-08-03T01:14:02.093Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple Cold Storage Management System Problem Types: CWE-266 Description: A vulnerability was found in SourceCodester Simple Cold Storage Management System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /csms/admin/?page=user/manage_user of the component Avatar Handler. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-
The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-211049 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Ramansh123454/POCs/blob/main/CSMS_RCE - https://vuldb.com/?id.211049
CVE ID: CVE-2022-3550 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-04-15T13:43:12.186Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: X.org Products: Server Problem Types: CWE-119 Description: A vulnerability classified as critical was found in X.org Server. Affected by this vulnerability is the function _GetCountedString of the file xkb/xkb.c. The manipulation leads to buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211051. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cgit.freedesktop.org/xorg/xserver
Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cgit.freedesktop.org/xorg/xserver/commit/?id=11beef0b7f1ed290348e45618e5fa0d2bffcb72e - https://vuldb.com/?id.211051 - https://lists.debian.org/debian-lts-announce/2022/11/msg00012.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXZZ6JBDBVBYPDI6DUTY6N36GNW37YHK/ - https://www.debian.org/security/2022/dsa-5278 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7W3NXSYK4P3XCZQBI3U6UWP4DPZIMRZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOEDFBYPSE3EMV
ZIMRZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOEDFBYPSE3EMVHTEFCVEJD2R2Y5F2A5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QTPFVGYTOY4EWTJEBH3YGDTTU57FZAK/ - https://security.gentoo.org/glsa/202305-30
CVE ID: CVE-2022-3551 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-04-15T13:43:04.746Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: X.org Products: Server Problem Types: CWE-404 Description: A vulnerability, which was classified as problematic, has been found in X.org Server. Affected by this issue is the function ProcXkbGetKbdByName of the file xkb/xkb.c. The manipulation leads to memory leak. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211052. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cgit.freedesktop.org/xorg/xserver/com
yst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cgit.freedesktop.org/xorg/xserver/commit/?id=18f91b950e22c2a342a4fbc55e9ddf7534a707d2 - https://vuldb.com/?id.211052 - https://lists.debian.org/debian-lts-announce/2022/11/msg00012.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OXZZ6JBDBVBYPDI6DUTY6N36GNW37YHK/ - https://www.debian.org/security/2022/dsa-5278 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7W3NXSYK4P3XCZQBI3U6UWP4DPZIMRZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOEDFBYPSE3EMVHTEF
Z/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IOEDFBYPSE3EMVHTEFCVEJD2R2Y5F2A5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3QTPFVGYTOY4EWTJEBH3YGDTTU57FZAK/ - https://security.gentoo.org/glsa/202305-30
CVE ID: CVE-2022-3552 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-12T18:57:29.361Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: boxbilling Products: boxbilling/boxbilling Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/c6e2973d-386d-4667-9426-10d10828539b - https://github.com/boxbilling/boxbilling/commit/b6705995785eaa8653e876318c9b3d82060dc945 - http://packetstormsecurity.com/files/171542/BoxBilling-4.22.1.5-Remote-Co
mit/b6705995785eaa8653e876318c9b3d82060dc945 - http://packetstormsecurity.com/files/171542/BoxBilling-4.22.1.5-Remote-Code-Execution.html
CVE ID: CVE-2022-3553 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-04-15T13:27:23.566Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: X.org Products: Server Problem Types: CWE-404 Description: A vulnerability, which was classified as problematic, was found in X.org Server. This affects an unknown part of the file hw/xquartz/X11Controller.m of the component xquartz. The manipulation leads to denial of service. It is recommended to apply a patch to fix this issue. The identifier VDB-211053 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cgit.freedeskt
bility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cgit.freedesktop.org/xorg/xserver/commit/?id=dfd057996b26420309c324ec844a5ba6dd07eda3 - https://vuldb.com/?id.211053 - https://security.gentoo.org/glsa/202305-30
CVE ID: CVE-2022-3554 State: REJECTED Published: N/A Last Updated: 2022-11-02T00:00:00 Description: No description available.
CVE ID: CVE-2022-3555 State: REJECTED Published: N/A Last Updated: 2022-11-02T00:00:00 Description: No description available.
CVE ID: CVE-2022-3556 State: PUBLISHED Published: 2024-09-05T11:00:14.179Z Last Updated: 2024-09-05T18:18:36.536Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: kanev Products: Cab fare calculator Problem Types: CWE-79 Description: The Cab fare calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the vehicle title setting in versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative privileges to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site
rbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/219de193-32d0-40b0-a471-bf8bf6e2bb62?source=cve - https://wordpress.org/plugins/cab-fare-calculator/
CVE ID: CVE-2022-3558 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-01T19:23:08.995Z Vendors: Unknown Products: Import and export users and customers Problem Types: CWE-1236 Description: The Import and export users and customers WordPress plugin before 1.20.5 does not properly escape data when exporting it via CSV files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e3d72e04-9cdf-4b7d-953e-876e26abdfc6 - https://plugins.trac.wordpress.org/changeset?new=2798139%40import-users-from-csv-with-meta&old=2785785%40import-users-from-csv-with-meta
CVE ID: CVE-2022-3559 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-11-03T21:46:26.053Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Exim Problem Types: CWE-119 Description: A vulnerability was found in Exim and classified as problematic. This issue affects some unknown processing of the component Regex Handler. The manipulation leads to use after free. The name of the patch is 4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2. It is recommended to apply a patch to fix this issue. The identifier VDB-211073 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
-211073 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.exim.org/exim.git/commit/4e9ed49f8f12eb331b29bd5b6dc3693c520fddc2 - https://vuldb.com/?id.211073 - https://bugs.exim.org/show_bug.cgi?id=2915 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WFHLZVHNNO2GWYP5EA4TZQZ5O4GVPARR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TMQ6OCKPNPBPSD37YR4FOWV2R54M2UEP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EIH4W5R7SHTUEQFWWKB4TUO5YFZX64KV/
CVE ID: CVE-2022-3560 State: PUBLISHED Published: 2023-02-02T00:00:00.000Z Last Updated: 2025-03-26T18:27:32.379Z Vendors: n/a Products: pesign Problem Types: CWE-22 Description: A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bu
h traversal attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2135420#c0
CVE ID: CVE-2022-3561 State: PUBLISHED Published: 2022-11-20T00:00:00.000Z Last Updated: 2025-04-29T20:00:14.884Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: librenms Products: librenms/librenms Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7389e6eb-4bce-4b97-999d-d3b70d8cee34 - https://github.com/librenms/librenms/commit/d86cbcd96d684e4de8dfa50b4490e4e02782d242
CVE ID: CVE-2022-3562 State: PUBLISHED Published: 2022-11-20T00:00:00.000Z Last Updated: 2025-04-28T18:08:57.905Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: librenms Products: librenms/librenms Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/bb9f76db-1314-44ae-9ccc-2b69679aa657 - https://github.com/librenms/librenms/commit/43cb72549d90e338f902b359a83c23d3cb5a2645
CVE ID: CVE-2022-3563 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-04-15T13:27:03.066Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-404 Description: A vulnerability classified as problematic has been found in Linux Kernel. Affected is the function read_50_controller_cap_complete of the file tools/mgmt-tester.c of the component BlueZ. The manipulation of the argument cap_len leads to null pointer dereference. It is recommended to apply a patch to fix this issue. VDB-211086 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrich
is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/bluetooth/bluez.git/commit/?id=e3c92f1f786f0b55440bd908b55894d0c792cf0e - https://vuldb.com/?id.211086
CVE ID: CVE-2022-3564 State: PUBLISHED Published: 2022-10-17T00:00:00 Last Updated: 2024-08-03T01:14:01.563Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-119 Description: A vulnerability classified as critical was found in Linux Kernel. Affected by this vulnerability is the function l2cap_reassemble_sdu of the file net/bluetooth/l2cap_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-211087. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pu
vulnerability is VDB-211087. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=89f9f3cb86b1c63badaf392a83dd661d56cc50b1 - https://vuldb.com/?id.211087 - https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html - https://security.netapp.com/advisory/ntap-20221223-0001/ - https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE ID: CVE-2022-3565 State: PUBLISHED Published: 2022-10-17T00:00:00 Last Updated: 2024-08-03T01:14:02.837Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-119 Description: A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/li
bility is VDB-211088. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=2568a7e0832ee30b0a351016d03062ab4e0e0a3f - https://vuldb.com/?id.211088 - https://lists.debian.org/debian-lts-announce/2022/12/msg00031.html - https://lists.debian.org/debian-lts-announce/2022/12/msg00034.html
CVE ID: CVE-2022-3566 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-04-15T13:26:51.044Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-362 Description: A vulnerability, which was classified as problematic, was found in Linux Kernel. This affects the function tcp_getsockopt/tcp_setsockopt of the component TCP Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. The identifier VDB-211089 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57 - https://vuldb.com/?id.211089
CVE ID: CVE-2022-3567 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-04-15T13:26:41.673Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Linux Products: Kernel Problem Types: CWE-362 Description: A vulnerability has been found in Linux Kernel and classified as problematic. This vulnerability affects the function inet6_stream_ops/inet6_dgram_ops of the component IPv6 Handler. The manipulation leads to race condition. It is recommended to apply a patch to fix this issue. VDB-211090 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kern
ulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=364f997b5cfe1db0d63a390fe7c801fa2b3115f6 - https://vuldb.com/?id.211090
CVE ID: CVE-2022-3568 State: PUBLISHED Published: 2023-02-09T23:34:58.206Z Last Updated: 2025-01-13T17:05:39.008Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: rickardw Products: ImageMagick Engine Problem Types: CWE-502 Deserialization of Untrusted Data Description: The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted they can trick a site administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objec
e administrator into performing an action such as clicking on a link, that will deserialize and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4a2ca2f0-1d4a-4614-86ba-a46e765f4a9f - https://github.com/orangelabweb/imagemagick-engine/blob/1.7.4/imagemagick-engine.php#L529 - https://github.com/orangelabweb/imagemagick-engine/blob/v.1.7.2/imagemagick-engine.php#L529 - https://pl
gine.php#L529 - https://github.com/orangelabweb/imagemagick-engine/blob/v.1.7.2/imagemagick-engine.php#L529 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2801283%40imagemagick-engine&new=2801283%40imagemagick-engine&sfp_email=&sfph_mail=
CVE ID: CVE-2022-3569 State: PUBLISHED Published: 2022-10-17T22:45:11.553Z Last Updated: 2025-05-13T15:04:07.694Z Vendors: Synacor Products: Zimbra Collaboration Suite (ZCS) Problem Types: CWE-271 Description: Due to an issue with incorrect sudo permissions, Zimbra Collaboration Suite (ZCS) suffers from a local privilege escalation issue in versions 9.0.0 and prior, where the 'zimbra' user can effectively coerce postfix into running arbitrary commands as 'root'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://twitter.com/ldsopreload/status/1580539318879547392 - https://github.com/rapid7/metasploit-framework/pull/17141 - http://packetstormsecu
opreload/status/1580539318879547392 - https://github.com/rapid7/metasploit-framework/pull/17141 - http://packetstormsecurity.com/files/169430/Zimbra-Privilege-Escalation.html
CVE ID: CVE-2022-3570 State: PUBLISHED Published: 2022-10-21T00:00:00.000Z Last Updated: 2025-05-07T19:57:07.975Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Heap-based buffer overflow in libtiff Description: Multiple heap buffer overflows in tiffcrop.c utility in libtiff library Version 4.4.0 allows attacker to trigger unsafe or out of bounds memory access via crafted TIFF image file which could result into application crash, potential information disclosure or any other context-dependent impact Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/libtiff/libt
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/libtiff/libtiff/-/issues/381 - https://gitlab.com/libtiff/libtiff/-/issues/386 - https://gitlab.com/libtiff/libtiff/-/commit/bd94a9b383d8755a27b5a1bc27660b8ad10b094c - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3570.json - https://lists.debian.org/debian-lts-announce/2023/01/msg00018.html - https://www.debian.org/security/2023/dsa-5333 - https://security.netapp.com/advisory/ntap-20230203-0002/
CVE ID: CVE-2022-3572 State: PUBLISHED Published: 2023-01-24T00:00:00.000Z Last Updated: 2025-04-02T15:03:52.887Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. It was possible to exploit a vulnerability in setting the Jira Connect integration which could lead to a reflected XSS that allowed attackers to perform arbitrary actions on behalf of victims.