Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1658 State: PUBLISHED Published: 2022-06-13T13:14:22.000Z Last Updated: 2025-01-31T18:53:32.106Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: ArtBees Products: Jupiter Problem Types: CWE-284 Description: Vulnerable versions of the Jupiter Theme (<= 6.10.1) allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abb_remove_plugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, any logged-in user can delete any installed plugin on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
delete any installed plugin on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/
CVE ID: CVE-2022-1659 State: PUBLISHED Published: 2022-06-13T13:17:10.000Z Last Updated: 2025-01-31T18:52:43.279Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: ArtBees Products: Jupiter X Core Problem Types: CWE-284 Description: Vulnerable versions of the JupiterX Core (<= 2.0.6) plugin register an AJAX action jupiterx_conditional_manager which can be used to call any function in the includes/condition/class-condition-manager.php file by sending the desired function to call in the sub_action parameter. This can be used to view site configuration and logged-in users, modify post conditions, or perform a denial of service attack. Additional Analyst Notes: -
uration and logged-in users, modify post conditions, or perform a denial of service attack. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/05/critical-privilege-escalation-vulnerability-in-jupiter-and-jupiterx-premium-themes/
CVE ID: CVE-2022-1660 State: PUBLISHED Published: 2022-05-31T19:34:05.088Z Last Updated: 2025-04-16T16:17:41.641Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Keysight Products: N6854A Geolocation server and N6841A RF Sensor software Problem Types: CWE-502 Description: The affected products are vulnerable of untrusted data due to deserialization without prior authorization/authentication, which may allow an attacker to remotely execute arbitrary code. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-146-01
CVE ID: CVE-2022-1661 State: PUBLISHED Published: 2022-05-31T19:36:01.993Z Last Updated: 2025-04-16T16:17:33.446Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Keysight Products: N6854A Geolocation server and N6841A RF Sensor software Problem Types: CWE-23 Description: The affected products are vulnerable to directory traversal, which may allow an attacker to obtain arbitrary operating system files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-146-01
CVE ID: CVE-2022-1662 State: PUBLISHED Published: 2022-07-14T14:55:03 Last Updated: 2024-08-03T00:10:03.753Z Vendors: n/a Products: convert2rhel Problem Types: CWE-200 Description: In convert2rhel, there's an ansible playbook named ansible/run-convert2rhel.yml which passes the Red Hat Subscription Manager user password via the CLI to convert2rhel. This could allow unauthorized local users to view the password via the process list while convert2rhel is running. However, this ansible playbook is only an example in the upstream repository and it is not shipped in officially supported versions of convert2rhel. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redh
pported versions of convert2rhel. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2083851
CVE ID: CVE-2022-1663 State: PUBLISHED Published: 2022-08-29T14:40:25 Last Updated: 2024-08-03T00:10:03.842Z Vendors: Unknown Products: Stop Spam Comments Problem Types: CWE-200 Description: The Stop Spam Comments WordPress plugin through 0.2.1.2 does not properly generate the Javascript access token for preventing abuse of comment section, allowing threat authors to easily collect the value and add it to the request. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/30820be1-e96a-4ff6-b1ec-efda14069e70
CVE ID: CVE-2022-1664 State: PUBLISHED Published: 2022-05-26T08:20:15.198129Z Last Updated: 2024-09-17T02:16:10.760Z Vendors: Debian Products: dpkg Problem Types: directory traversal Description: Dpkg::Source::Archive in dpkg, the Debian package management system, before version 1.21.8, 1.20.10, 1.19.8, 1.18.26 is prone to a directory traversal vulnerability. When extracting untrusted source packages in v2 and v3 source package formats that include a debian.tar, the in-place extraction can lead to directory traversal situations on specially crafted orig.tar and debian.tar tarballs. Additional Analyst Notes: - CVE Program Container: References: - https://git.dpkg.org/cgit/dpkg/dpkg.git/commit
arballs. Additional Analyst Notes: - CVE Program Container: References: - https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=7a6c03cb34d4a09f35df2f10779cbf1b70a5200b - https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=58814cacee39c4ce9e2cd0e3a3b9b57ad437eff5 - https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=1f23dddc17f69c9598477098c7fb9936e15fa495 - https://git.dpkg.org/cgit/dpkg/dpkg.git/commit/?id=faa4c92debe45412bfcf8a44f26e827800bb24be - https://lists.debian.org/debian-security-announce/2022/msg00115.html - https://lists.debian.org/debian-lts-announce/2022/05/msg00033.html - https://security.netapp.com/advisory/ntap-20221007-0002/
CVE ID: CVE-2022-1665 State: PUBLISHED Published: 2022-06-21T14:23:40 Last Updated: 2024-08-03T00:10:03.767Z Vendors: n/a Products: Red Hat Enterprise Linux Problem Types: CWE-1291 Description: A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing the attacker to load another non-trusted code. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2089529
CVE ID: CVE-2022-1666 State: PUBLISHED Published: 2022-06-24T15:00:29.585Z Last Updated: 2025-04-16T16:16:30.731Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Secheron Products: SEPCOS Control and Protection Relay firmware package Problem Types: CWE-522 Description: The default password for the web application’s root user (the vendor’s private account) was weak and the MD5 hash was used to crack the password using a widely available open-source tool. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE ID: CVE-2022-1667 State: PUBLISHED Published: 2022-06-24T15:00:30.365Z Last Updated: 2025-04-16T16:16:23.607Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Secheron Products: SEPCOS Control and Protection Relay firmware package Problem Types: CWE-841 Description: Client-side JavaScript controls may be bypassed by directly running a JS function to reboot the PLC (e.g., from the browser console) or by loading the corresponding, browser accessible PHP script Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE ID: CVE-2022-1668 State: PUBLISHED Published: 2022-06-24T15:00:32.930Z Last Updated: 2025-04-16T16:16:08.809Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Secheron Products: SEPCOS Control and Protection Relay firmware package Problem Types: CWE-521 Description: Weak default root user credentials allow remote attackers to easily obtain OS superuser privileges over the open TCP port for SSH. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-174-03
CVE ID: CVE-2022-1669 State: PUBLISHED Published: 2022-05-24T17:38:36.592Z Last Updated: 2025-04-16T16:18:54.034Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: CIRCUTOR Products: COMPACT DC-S BASIC Problem Types: CWE-121 Description: A buffer overflow vulnerability has been detected in the firewall function of the device management web portal. The device runs a CGI binary (index.cgi) to offer a management web application. Once authenticated with valid credentials in this web portal, a potential attacker could submit any "Address" value and it would be copied to a second variable with a "strcpy" vulnerable function without checking its length. Because of th
d it would be copied to a second variable with a "strcpy" vulnerable function without checking its length. Because of this, it is possible to send a long address value to overflow the process stack, controlling the function return address. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-137-01
CVE ID: CVE-2022-1670 State: PUBLISHED Published: 2022-05-19T04:25:09 Last Updated: 2024-08-03T00:10:03.783Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: User invitation limit in Octopus Server can be exceeded Description: When generating a user invitation code in Octopus Server, the validity of this code can be set for a specific number of users. It was possible to bypass this restriction of validity to create extra user accounts above the initial number of invited users. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/post/2022/sa2022-04/
CVE ID: CVE-2022-1671 State: PUBLISHED Published: 2022-07-26T16:36:01 Last Updated: 2024-08-03T00:10:03.786Z Vendors: n/a Products: Kernel Problem Types: CWE-476 Description: A NULL pointer dereference flaw was found in rxrpc_preparse_s in net/rxrpc/server_key.c in the Linux kernel. This flaw allows a local attacker to crash the system or leak internal kernel information. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ff8376ade4f668130385839cef586a0990f8ef87 - https://security.netapp.com/advisory/ntap-20220901-0008/ - https://security.netapp.com/advisory/ntap-20220901-0004/
CVE ID: CVE-2022-1672 State: PUBLISHED Published: 2022-07-17T10:35:33 Last Updated: 2024-08-03T00:10:03.792Z Vendors: Unknown Products: Insights from Google PageSpeed Problem Types: CWE-352 Description: The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5c5955d7-24f0-45e6-9c27-78ef50446dad
CVE ID: CVE-2022-1673 State: PUBLISHED Published: 2022-06-06T08:51:14 Last Updated: 2024-08-03T00:10:03.856Z Vendors: Unknown Products: WooCommerce Green Wallet Gateway Problem Types: CWE-79 Description: The WooCommerce Green Wallet Gateway WordPress plugin before 1.0.2 does not escape the error_envision query parameter before outputting it to the page, leading to a Reflected Cross-Site Scripting vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/14283389-a6b8-4dd8-9441-f16fcc4ab3c0
CVE ID: CVE-2022-1674 State: PUBLISHED Published: 2022-05-12T00:00:00 Last Updated: 2024-08-03T00:10:03.912Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-476 Description: NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 in GitHub repository vim/vim prior to 8.2.4938. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2733 allows attackers to cause a denial of service (application crash) via a crafted input. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a74ba4a4-7a39-4a22-bde3-d2f8ee07b385 - https://github.com/vim/vim/commit/a59f2
References: - https://huntr.dev/bounties/a74ba4a4-7a39-4a22-bde3-d2f8ee07b385 - https://github.com/vim/vim/commit/a59f2dfd0cf9ee1a584d3de5b7c2d47648e79060 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODXVYZC5Z4XRRZK7CK6B6IURYVYHA25U/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IUPOLEX5GXC733HL4EFYMHFU7NISJJZG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFAZTAT5CZC2R6KYDYA2HBAVEDSIX6MW/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://se
CVE ID: CVE-2022-1676 State: REJECTED Published: N/A Last Updated: 2023-01-19T00:00:00 Description: No description available.
CVE ID: CVE-2022-1677 State: PUBLISHED Published: 2022-09-01T19:51:43 Last Updated: 2024-08-03T00:10:03.820Z Vendors: n/a Products: Openshift Problem Types: CWE-400 Description: In OpenShift Container Platform, a user with permissions to create or modify Routes can craft a payload that inserts a malformed entry into one of the cluster router's HAProxy configuration files. This malformed entry can match any arbitrary hostname, or all hostnames in the cluster, and direct traffic to an arbitrary application within the cluster, including one under attacker control. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2076211 - https://acces
nalyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2076211 - https://access.redhat.com/security/cve/CVE-2022-1677
CVE ID: CVE-2022-1678 State: PUBLISHED Published: 2022-05-25T14:49:30 Last Updated: 2024-08-03T00:10:03.820Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: kernel Problem Types: CWE-911 Description: An issue was discovered in the Linux Kernel from 4.18 to 4.19, an improper update of sock reference in TCP pacing can lead to memory/netns leak, which can be used by remote clients. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.openanolis.cn/show_bug.cgi?id=61 - https://lore.kernel.org/all/20200602080425.93712-1-kerneljasonxing%40gmail.com/ - https://github.com/torvalds/linux/commit/0a70f118475e037732557796accd08
602080425.93712-1-kerneljasonxing%40gmail.com/ - https://github.com/torvalds/linux/commit/0a70f118475e037732557796accd0878a00fc25a - https://gitee.com/anolis/cloud-kernel/commit/bed537da691b - https://anas.openanolis.cn/cves/detail/CVE-2022-1678 - https://anas.openanolis.cn/errata/detail/ANSA-2022:0143 - https://security.netapp.com/advisory/ntap-20220715-0001/
CVE ID: CVE-2022-1679 State: PUBLISHED Published: 2022-05-16T00:00:00 Last Updated: 2024-08-03T00:10:03.805Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel’s Atheros wireless adapter driver in the way a user forces the ath9k_htc_wait_for_target function to fail with some input messages. This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/lkml/87ilqc7jv9.fsf%40kernel.org/t/ - https://security.netapp.com/advisory/ntap-20220629-0007/ - https://lists.debian.org/debian-lts-announce/2022/10/msg0000
https://security.netapp.com/advisory/ntap-20220629-0007/ - https://lists.debian.org/debian-lts-announce/2022/10/msg00000.html - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
CVE ID: CVE-2022-1680 State: PUBLISHED Published: 2022-06-06T17:05:16 Last Updated: 2024-08-03T00:10:03.843Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: An account takeover issue has been discovered in GitLab EE affecting all versions starting from 11.10 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. When group SAML SSO is configured, the SCIM feature (available only on Premium+ subscriptions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change tho
ions) may allow any owner of a Premium group to invite arbitrary users through their username and email, then change those users' email addresses via SCIM to an attacker controlled email address and thus - in the absence of 2FA - take over those accounts. It is also possible for the attacker to change the display name and username of the targeted account. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/363058 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1680.json
CVE ID: CVE-2022-1681 State: PUBLISHED Published: 2022-05-12T07:45:14 Last Updated: 2024-08-03T00:10:03.788Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: requarks Products: requarks/wiki Problem Types: CWE-288 Description: Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/591b11e1-7504-4a96-99c6-08f2b419e767 - https://github.com/requarks/wiki/commit/78d02dc8e5d103d248e5d7632bf7a6facdf4264c
CVE ID: CVE-2022-1682 State: PUBLISHED Published: 2022-05-12T08:15:17 Last Updated: 2024-08-03T00:10:03.910Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: neorazorx Products: neorazorx/facturascripts Problem Types: CWE-79 Description: Reflected Xss using url based payload in GitHub repository neorazorx/facturascripts prior to 2022.07. Xss can use to steal user's cookies which lead to Account takeover or do any malicious activity in victim's browser Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e962d191-93e2-405e-a6af-b4a4e4d02527 - https://github.com/neorazorx/facturascripts/commit/8e31d8434014a6d1e8791a489d8
es/e962d191-93e2-405e-a6af-b4a4e4d02527 - https://github.com/neorazorx/facturascripts/commit/8e31d8434014a6d1e8791a489d84268fd74b0c9a
CVE ID: CVE-2022-1683 State: PUBLISHED Published: 2022-06-06T08:51:16 Last Updated: 2024-08-03T00:10:03.749Z Vendors: Unknown Products: amtyThumb Problem Types: CWE-89 Description: The amtyThumb WordPress plugin through 4.2.0 does not sanitise and escape a parameter before using it in a SQL statement via its shortcode, leading to an SQL injection and is exploitable by any authenticated user (and not just Author+ like the original advisory mention) due to the fact that they can execute shortcodes via an AJAX action Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/359d145b-c365-4e7c-a12e-c26b7b8617ce - https://bulletin.iese.de/post/amtythumb_4-2
s: - https://wpscan.com/vulnerability/359d145b-c365-4e7c-a12e-c26b7b8617ce - https://bulletin.iese.de/post/amtythumb_4-2-0
CVE ID: CVE-2022-1684 State: PUBLISHED Published: 2022-06-06T08:51:17 Last Updated: 2024-08-03T00:10:03.810Z Vendors: Unknown Products: CUBE SLIDER Problem Types: CWE-89 Description: The Cube Slider WordPress plugin through 1.2 does not sanitise and escape the idslider parameter before using it in various SQL queries, leading to SQL Injections exploitable by high privileged users such as admin Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/db7fb815-945a-41c7-8932-834cc646a806 - https://bulletin.iese.de/post/cube-slider_1-2
CVE ID: CVE-2022-1685 State: PUBLISHED Published: 2022-06-06T08:51:19 Last Updated: 2024-08-03T00:10:03.847Z Vendors: Unknown Products: Five Minute Webshop Problem Types: CWE-89 Description: The Five Minute Webshop WordPress plugin through 1.3.2 does not properly validate and sanitise the orderby parameter before using it in a SQL statement via the Manage Products admin page, leading to an SQL Injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/86bd28d5-6767-4bca-ab59-710c1c4ecd97 - https://bulletin.iese.de/post/five-minute-webshop_1-3-2_1
CVE ID: CVE-2022-1686 State: PUBLISHED Published: 2022-06-06T08:51:20 Last Updated: 2024-08-03T00:10:03.913Z Vendors: Unknown Products: Five Minute Webshop Problem Types: CWE-89 Description: The Five Minute Webshop WordPress plugin through 1.3.2 does not sanitise and escape the id parameter before using it in a SQL statement when editing a product via the admin dashboard, leading to an SQL Injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1a5ce0dd-6847-42e7-8d88-3b63053fab71 - https://bulletin.iese.de/post/five-minute-webshop_1-3-2_2
CVE ID: CVE-2022-1687 State: PUBLISHED Published: 2022-06-06T08:51:22 Last Updated: 2024-08-03T00:10:03.810Z Vendors: Unknown Products: Logo Slider Problem Types: CWE-89 Description: The Logo Slider WordPress plugin through 1.4.8 does not sanitise and escape the lsp_slider_id parameter before using it in a SQL statement via the Manage Slider Images admin page, leading to an SQL Injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e7506906-5c3d-4963-ae24-55f18c3e5081 - https://bulletin.iese.de/post/logo-slider_1-4-8
CVE ID: CVE-2022-1688 State: PUBLISHED Published: 2022-06-06T08:51:23 Last Updated: 2024-08-03T00:10:03.815Z Vendors: Unknown Products: Note Press Problem Types: CWE-89 Description: The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the id parameter before using it in various SQL statement via the admin dashboard, leading to SQL Injections Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/63d4444b-9b04-47f5-a692-c6c6c8ea7d92 - https://bulletin.iese.de/post/note-press_0-1-10_1
CVE ID: CVE-2022-1689 State: PUBLISHED Published: 2022-06-06T08:51:24 Last Updated: 2024-08-03T00:10:03.847Z Vendors: Unknown Products: Note Press Problem Types: CWE-89 Description: The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the Update parameter before using it in a SQL statement when updating a note via the admin dashboard, leading to an SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/982f84a1-216d-41ed-87bd-433b695cec28 - https://bulletin.iese.de/post/note-press_0-1-10_2
CVE ID: CVE-2022-1690 State: PUBLISHED Published: 2022-06-06T08:51:26 Last Updated: 2024-08-03T00:10:03.752Z Vendors: Unknown Products: Note Press Problem Types: CWE-89 Description: The Note Press WordPress plugin through 0.1.10 does not sanitise and escape the ids from the bulk actions before using them in a SQL statement in an admin page, leading to an SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/54e16f0a-667c-44ea-98ad-0306c4a35d9d - https://bulletin.iese.de/post/note-press_0-1-10_3