Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3747 State: PUBLISHED Published: 2022-11-29T20:41:02.181Z Last Updated: 2025-01-23T21:17:57.243Z Severity: HIGH (CVSS 8.8 CVSS:3.1/A:H/I:H/C:H/S:U/UI:R/PR:N/AC:L/AV:N) Vendors: MuffinGroup Products: Becustom Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update the plugin's settings like betheme_url_slug, replaced_theme_author, and betheme_label to name a few, via a forged request granted they can trick a
betheme_url_slug, replaced_theme_author, and betheme_label to name a few, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://muffingroup.com/betheme/features/be-custom/ - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-3747.txt - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3747
CVE ID: CVE-2022-3748 State: PUBLISHED Published: 2023-04-14T14:06:30.571Z Last Updated: 2025-04-14T17:03:55.384Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ForgeRock Inc. Products: Access Management Problem Types: CWE-285 Description: Improper Authorization vulnerability in ForgeRock Inc. Access Management allows Authentication Bypass. This issue affects Access Management: from 6.5.0 through 7.2.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://backstage.forgerock.com/knowledge/kb/article/a92134872 - https://backstage.forgerock.com/knowledge/kb/article/a34332318 - https://backstage.forgerock.com/down
rticle/a92134872 - https://backstage.forgerock.com/knowledge/kb/article/a34332318 - https://backstage.forgerock.com/downloads/browse/am/all/productId:am
CVE ID: CVE-2022-3750 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-30T15:33:32.639Z Vendors: Unknown Products: Ask me Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The has a CSRF vulnerability that allows the deletion of a post without using a nonce or prompting for confirmation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5019db80-0356-497d-b488-a26a5de78676
CVE ID: CVE-2022-3751 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-25T14:55:25.221Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: owncast Products: owncast/owncast Problem Types: CWE-89 Description: SQL Injection in GitHub repository owncast/owncast prior to 0.0.13. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/a04cff99-5d53-45e5-a882-771b0fad62c9 - https://github.com/owncast/owncast/commit/23b6e5868d5501726c27a3fabbecf49000968591
CVE ID: CVE-2022-3752 State: PUBLISHED Published: 2022-12-19T22:23:36.836Z Last Updated: 2025-04-16T14:28:03.254Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Rockwell Automation Products: CompactLogix 5480, ControlLogix 5580 , GuardLogix 5580, Compact GuardLogix 5380, CompactLogix 5380 Problem Types: CWE-20 Description: An unauthorized user could use a specially crafted sequence of Ethernet/IP messages, combined with heavy traffic loading to cause a denial-of-service condition in Rockwell Automation Logix controllers resulting in a major non-recoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the
non-recoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online and continue normal operation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1137664
CVE ID: CVE-2022-3753 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-30T15:34:21.946Z Vendors: Unknown Products: Evaluate Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8e88a5b9-6f1d-40de-99fc-8e1e66646c2b
CVE ID: CVE-2022-3754 State: PUBLISHED Published: 2022-10-29T00:00:00.000Z Last Updated: 2025-05-08T19:13:47.991Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f4711d7f-1368-48ab-9bef-45f32e356c47 - https://github.com/thorsten/phpmyfaq/commit/d7a87d2646287828c70401ca8976ef531fbc77ea
CVE ID: CVE-2022-3755 State: REJECTED Published: N/A Last Updated: 2022-11-21T00:00:00 Description: No description available.
CVE ID: CVE-2022-3756 State: REJECTED Published: N/A Last Updated: 2022-11-21T00:00:00 Description: No description available.
CVE ID: CVE-2022-3757 State: REJECTED Published: N/A Last Updated: 2022-11-21T00:00:00 Description: No description available.
CVE ID: CVE-2022-3758 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-02-28T17:30:48.778Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Authorization bypass through user-controlled key in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.4, all versions starting from 15.9 before 15.9.2. Due to improper permissions checks an unauthorised user was able to read, add or edit a users private snippet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - ht
it a users private snippet. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/379598 - https://hackerone.com/reports/1751258 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3758.json
CVE ID: CVE-2022-3759 State: PUBLISHED Published: 2023-02-13T00:00:00.000Z Last Updated: 2025-03-21T18:38:24.181Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7 before 15.7.6, all versions starting from 15.8 before 15.8.1. An attacker may upload a crafted CI job artifact zip file in a project that uses dynamic child pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this
ld pipelines and make a sidekiq job allocate a lot of memory. In GitLab instances where Sidekiq is memory-limited, this may cause Denial of Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/379633 - https://hackerone.com/reports/1736230 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3759.json
CVE ID: CVE-2022-3760 State: PUBLISHED Published: 2023-03-07T08:37:30.992Z Last Updated: 2025-03-05T14:48:20.748Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Mia Technology Products: Mia-Med Problem Types: CWE-89 Description: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mia Technology Mia-Med.This issue affects Mia-Med: before 1.0.0.58. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-23-0130
CVE ID: CVE-2022-3761 State: PUBLISHED Published: 2023-10-17T12:10:36.100Z Last Updated: 2024-08-03T01:20:57.580Z Vendors: OpenVPN Inc Products: OpenVPN Connect Problem Types: CWE-295 Description: OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to intercept configuration profile download requests which contains the users credentials Additional Analyst Notes: - CVE Program Container: References: - https://openvpn.net/vpn-server-resources/openvpn-connect-for-macos-change-log/ - https://openvpn.net/vpn-server-resources/openvpn-connect-for-windows-change-log/
CVE ID: CVE-2022-3762 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-30T15:36:31.186Z Vendors: Unknown Products: Booster for WooCommerce, Booster Plus for WooCommerce, Booster Elite for WooCommerce Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not validate files to download in some of its modules, which could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be a
ch could allow ShopManager and Admin to download arbitrary files from the server even when they are not supposed to be able to (for example in multisite) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/96ef4bb8-a054-48ae-b29c-b3060acd01ac
CVE ID: CVE-2022-3763 State: PUBLISHED Published: 2022-11-21T00:00:00.000Z Last Updated: 2025-04-30T15:37:34.468Z Vendors: Unknown Products: Booster for WooCommerce, Booster Plus for WooCommerce, Booster Elite for WooCommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.5, Booster Elite for WooCommerce WordPress plugin before 1.1.7 do not have CSRF check in place when deleting files uploaded at the checkout, allowing attackers to make a logged in shop manager or admin delete them via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CIS
a logged in shop manager or admin delete them via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7ab15530-8321-487d-97a5-1469b51fcc3f
CVE ID: CVE-2022-3764 State: PUBLISHED Published: 2024-01-16T15:50:50.054Z Last Updated: 2025-06-20T16:58:03.351Z Vendors: Unknown Products: Form Vibes Problem Types: CWE-89 SQL Injection Description: The plugin does not filter the "delete_entries" parameter from user requests, leading to an SQL Injection vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9d49df6b-e2f1-4662-90d2-84c29c3b1cb0/
CVE ID: CVE-2022-3765 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-02T18:01:34.947Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/613143a1-8e51-449a-b214-12458308835d - https://github.com/thorsten/phpmyfaq/commit/372428d02a08e90b3a253ba5c506cda84581a5af
CVE ID: CVE-2022-3766 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-05T14:09:37.644Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: thorsten Products: thorsten/phpmyfaq Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/d9666520-4ff5-43bb-aacf-50c8e5570983 - https://github.com/thorsten/phpmyfaq/commit/c7904f2236c6c0dd64c2226b90c30af0f7e5a72d
CVE ID: CVE-2022-3767 State: PUBLISHED Published: 2023-03-09T00:00:00.000Z Last Updated: 2025-02-28T17:28:45.941Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: GitLab Products: DAST Problem Types: Vulnerability in DAST Description: Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every request, regardless of the host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/377473 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3767.json
CVE ID: CVE-2022-3768 State: PUBLISHED Published: 2022-11-28T13:47:07.347Z Last Updated: 2025-04-25T15:18:13.145Z Vendors: Unknown Products: WPSmartContracts Problem Types: CWE-89 SQL Injection Description: The WPSmartContracts WordPress plugin before 1.3.12 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1d8bf5bb-5a17-49b7-a5ba-5f2866e1f8a3 - https://bulletin.iese.de/post/wp-smart-contracts_1-3-11/
CVE ID: CVE-2022-3769 State: PUBLISHED Published: 2022-11-28T13:47:08.267Z Last Updated: 2025-04-25T15:04:03.782Z Vendors: Unknown Products: OWM Weather Problem Types: CWE-89 SQL Injection Description: The OWM Weather WordPress plugin before 5.6.9 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as contributor Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2f9ffc1e-c8a9-47bb-a76b-d043c93e63f8 - https://bulletin.iese.de/post/owm-weather_5-6-8/
CVE ID: CVE-2022-3770 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-04-15T13:23:32.818Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Yunjing Products: CMS Problem Types: CWE-266 Description: A vulnerability classified as critical was found in Yunjing CMS. This vulnerability affects unknown code of the file /index/user/upload_img.html. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212500. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
er of this vulnerability is VDB-212500. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/swzaq/swzaq - https://vuldb.com/?id.212500
CVE ID: CVE-2022-3771 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-04-15T13:23:26.555Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: easyii Products: CMS Problem Types: CWE-266 Description: A vulnerability, which was classified as critical, has been found in easyii CMS. This issue affects the function file of the file helpers/Upload.php of the component File Upload Management. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The identifier VDB-212501 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?i
rability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.212501
CVE ID: CVE-2022-3772 State: REJECTED Published: N/A Last Updated: 2022-11-07T00:00:00 Description: No description available.
CVE ID: CVE-2022-3773 State: REJECTED Published: N/A Last Updated: 2022-11-03T00:00:00 Description: No description available.
CVE ID: CVE-2022-3774 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-04-15T13:23:20.111Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: SourceCodester Products: Train Scheduler App Problem Types: CWE-99 Description: A vulnerability was found in SourceCodester Train Scheduler App 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /train_scheduler_app/?action=delete. The manipulation of the argument id leads to improper control of resource identifiers. The attack may be launched remotely. The identifier of this vulnerability is VDB-212504. Additional Analyst Notes: - CVE Program Container:
aunched remotely. The identifier of this vulnerability is VDB-212504. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rohit0x5/poc/blob/main/idor - https://vuldb.com/?id.212504 - http://packetstormsecurity.com/files/169604/Train-Scheduler-App-1.0-Insecure-Direct-Object-Reference.html
CVE ID: CVE-2022-3775 State: PUBLISHED Published: 2022-12-19T00:00:00 Last Updated: 2024-08-03T01:20:57.693Z Vendors: n/a Products: grub2 Problem Types: CWE-787 Description: When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/cve-2022-3775 - https://security.ge
Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/cve-2022-3775 - https://security.gentoo.org/glsa/202311-14
CVE ID: CVE-2022-3776 State: PUBLISHED Published: 2022-11-03T16:30:34.559Z Last Updated: 2025-01-31T18:27:29.263Z Severity: HIGH (CVSS 8.8 CVSS:3.1/A:H/I:H/C:H/S:U/UI:R/PR:N/AC:L/AV:N) Vendors: gloriafood Products: Restaurant Menu – Food Ordering System – Table Reservation Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as forms_action, set_option, & chosen_options to name a few . This makes it possible
ctions called via AJAX actions such as forms_action, set_option, & chosen_options to name a few . This makes it possible for unauthenticated attackers to perform a variety of administrative actions like modifying forms, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2807967%40menu-ordering-reservations&new=2807967%40menu-ordering-reservations&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3776
CVE ID: CVE-2022-3778 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2022-3780 State: PUBLISHED Published: 2022-11-01T18:22:29.174Z Last Updated: 2025-05-05T14:06:40.669Z Vendors: Devolutions Products: Remote Desktop Manager Problem Types: CWE-284 Description: Database connections on deleted users could stay active on MySQL data sources in Remote Desktop Manager 2022.3.7 and below which allow deleted users to access unauthorized data. This issue affects : Remote Desktop Manager 2022.3.7 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2022-0008
CVE ID: CVE-2022-3781 State: PUBLISHED Published: 2022-11-01T18:28:28.590Z Last Updated: 2025-05-05T14:04:03.985Z Vendors: Devolutions Products: Remote Desktop Manager, Devolutions Server Problem Types: CWE-311 Description: Dashlane password and Keepass Server password in My Account Settings are not encrypted in the database in Devolutions Remote Desktop Manager 2022.2.26 and prior versions and Devolutions Server 2022.3.1 and prior versions which allows database users to read the data. This issue affects : Remote Desktop Manager 2022.2.26 and prior versions. Devolutions Server 2022.3.1 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References:
ver 2022.3.1 and prior versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://devolutions.net/security/advisories/DEVO-2022-0009
CVE ID: CVE-2022-3782 State: PUBLISHED Published: 2023-01-11T16:58:10.434Z Last Updated: 2025-04-09T13:42:27.268Z Vendors: redhat.com Products: Keycloak Problem Types: n/a Description: keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Referen
rd in the Valid Redirect URIs field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-3782
CVE ID: CVE-2022-3783 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-04-15T13:23:12.687Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: node-red-dashboard Problem Types: CWE-707 Description: A vulnerability, which was classified as problematic, has been found in node-red-dashboard. This issue affects some unknown processing of the file components/ui-component/ui-component-ctrl.js of the component ui_text Format Handler. The manipulation leads to cross site scripting. The attack may be initiated remotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix th
emotely. The name of the patch is 9305d1a82f19b235dfad24a7d1dd4ed244db7743. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212555. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/node-red/node-red-dashboard/issues/772 - https://github.com/node-red/node-red-dashboard/commit/9305d1a82f19b235dfad24a7d1dd4ed244db7743 - https://vuldb.com/?id.212555
CVE ID: CVE-2022-3784 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-04-15T13:23:01.136Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Axiomatic Products: Bento4 Problem Types: CWE-119 Description: A vulnerability classified as critical was found in Axiomatic Bento4 5e7bb34. Affected by this vulnerability is the function AP4_Mp4AudioDsiParser::ReadBits of the file Ap4Mp4AudioInfo.cpp of the component mp4hls. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-212563. Additional