Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25617 State: PUBLISHED Published: 2022-05-18T17:21:49.648Z Last Updated: 2025-02-20T20:22:25.776Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Code Snippets Pro Products: Code Snippets (WordPress plugin) Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in Code Snippets plugin <= 2.14.3 at WordPress via &orderby vulnerable parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/code-snippets/ - https://patchstack.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scri
k.com/database/vulnerability/code-snippets/wordpress-code-snippets-plugin-2-14-3-authenticated-reflected-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-25618 State: PUBLISHED Published: 2022-04-04T19:46:17.800Z Last Updated: 2025-02-20T20:28:52.921Z Severity: LOW (CVSS 3.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:N/I:L/A:N) Vendors: TMS-Plugins Products: wpDataTables – Tables & Table Charts (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in wpDataTables (WordPress plugin) versions <= 2.1.27 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wpdatatables/#developers - https://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-plugin-2-1-27-stored-cross-site-scripti
ttps://patchstack.com/database/vulnerability/wpdatatables/wordpress-wpdatatables-plugin-2-1-27-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-25619 State: PUBLISHED Published: 2022-03-30T14:55:17 Last Updated: 2024-08-03T04:42:50.007Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Profelis IT Consultancy Products: SambaBox Problem Types: CWE-77 Description: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in ping tool of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause run arbitrary code. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86. Additional Analyst Notes: - CVE Program Container: References: - https://www.sambabox.io/sambabox-surum-4-0/
CVE ID: CVE-2022-25620 State: PUBLISHED Published: 2022-03-30T14:55:11 Last Updated: 2024-08-03T04:42:50.040Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: Profelis IT Consultancy Products: SambaBox Problem Types: CWE-80 Description: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Group Functionality of Profelis IT Consultancy SambaBox allows AUTHENTICATED user to cause execute arbitrary codes on the vulnerable server. This issue affects: Profelis IT Consultancy SambaBox 4.0 version 4.0 and prior versions on x86. Additional Analyst Notes: - CVE Program Container: References: - https://www.sambabox.io/sambabox-sur
r versions on x86. Additional Analyst Notes: - CVE Program Container: References: - https://www.sambabox.io/sambabox-surum-4-0/
CVE ID: CVE-2022-25621 State: PUBLISHED Published: 2022-03-11T17:54:28 Last Updated: 2024-08-03T04:42:50.297Z Vendors: NEC Platforms, Ltd. Products: UNIVERGE DT Problem Types: OS command injection Description: UUNIVERGE WA 1020 Ver8.2.11 and prior, UNIVERGE WA 1510 Ver8.2.11 and prior, UNIVERGE WA 1511 Ver8.2.11 and prior, UNIVERGE WA 1512 Ver8.2.11 and prior, UNIVERGE WA 2020 Ver8.2.11 and prior, UNIVERGE WA 2021 Ver8.2.11 and prior, UNIVERGE WA 2610-AP Ver8.2.11 and prior, UNIVERGE WA 2611-AP Ver8.2.11 and prior, UNIVERGE WA 2611E-AP Ver8.2.11 and prior, UNIVERGE WA WA2612-AP Ver8.2.11 and prior allows a remote attacker to execute arbitrary OS commands. Additional Analyst Notes: - CVE Prog
2-AP Ver8.2.11 and prior allows a remote attacker to execute arbitrary OS commands. Additional Analyst Notes: - CVE Program Container: References: - https://jpn.nec.com/security-info/secinfo/nv22-004_en.html
CVE ID: CVE-2022-25622 State: PUBLISHED Published: 2022-04-12T00:00:00.000Z Last Updated: 2025-04-21T13:54:36.799Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C) Vendors: Siemens Products: SIMATIC CFU DIQ, SIMATIC CFU PA, SIMATIC ET 200AL IM 157-1 PN, SIMATIC ET 200MP IM 155-5 PN HF, SIMATIC ET 200pro IM 154-8 PN/DP CPU, SIMATIC ET 200pro IM 154-8F PN/DP CPU, SIMATIC ET 200pro IM 154-8FX PN/DP CPU, SIMATIC ET 200S IM 151-8 PN/DP CPU, SIMATIC ET 200S IM 151-8F PN/DP CPU, SIMATIC ET 200SP IM 155-6 MF HF, SIMATIC ET 200SP IM 155-6 PN HA (incl. SIPLUS variants), SIMATIC ET 200SP IM 155-6 PN HF, SIMATIC ET 200SP IM 155-6 PN/2 HF, SIMATIC ET 200SP IM 155-6 P
(incl. SIPLUS variants), SIMATIC ET 200SP IM 155-6 PN HF, SIMATIC ET 200SP IM 155-6 PN/2 HF, SIMATIC ET 200SP IM 155-6 PN/3 HF, SIMATIC ET200ecoPN, AI 8xRTD/TC, M12-L, SIMATIC ET200ecoPN, CM 4x IO-Link, M12-L, SIMATIC ET200ecoPN, CM 8x IO-Link, M12-L, SIMATIC ET200ecoPN, DI 16x24VDC, M12-L, SIMATIC ET200ecoPN, DI 8x24VDC, M12-L, SIMATIC ET200ecoPN, DIQ 16x24VDC/2A, M12-L, SIMATIC ET200ecoPN, DQ 8x24VDC/0,5A, M12-L, SIMATIC ET200ecoPN, DQ 8x24VDC/2A, M12-L, SIMATIC PN/MF Coupler, SIMATIC PN/PN Coupler, SIMATIC S7-1500 CPU family (incl. related ET200 CPUs and SIPLUS variants), SIMATIC S7-300 CPU 314C-2 PN/DP, SIMATIC S7-300 CPU 315-2 PN/DP, SIMATIC S7-300 CPU 315F-2 PN/DP, SIMATIC S7-300 CPU 3
, SIMATIC S7-300 CPU 314C-2 PN/DP, SIMATIC S7-300 CPU 315-2 PN/DP, SIMATIC S7-300 CPU 315F-2 PN/DP, SIMATIC S7-300 CPU 315T-3 PN/DP, SIMATIC S7-300 CPU 317-2 PN/DP, SIMATIC S7-300 CPU 317F-2 PN/DP, SIMATIC S7-300 CPU 317T-3 PN/DP, SIMATIC S7-300 CPU 317TF-3 PN/DP, SIMATIC S7-300 CPU 319-3 PN/DP, SIMATIC S7-300 CPU 319F-3 PN/DP, SIMATIC S7-400 CPU 412-2 PN V7, SIMATIC S7-400 CPU 414-3 PN/DP V7, SIMATIC S7-400 CPU 414F-3 PN/DP V7, SIMATIC S7-400 CPU 416-3 PN/DP V7, SIMATIC S7-400 CPU 416F-3 PN/DP V7, SIMATIC S7-400 H V6 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V10 CPU family (incl. SIPLUS variants), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants), SIMATIC TDC CP51M1, SIMATIC TDC
PU family (incl. SIPLUS variants), SIMATIC S7-410 V8 CPU family (incl. SIPLUS variants), SIMATIC TDC CP51M1, SIMATIC TDC CPU555, SIMATIC WinAC RTX 2010, SIMATIC WinAC RTX F 2010, SINAMICS DCM, SINAMICS G110M, SINAMICS G115D, SINAMICS G120 (incl. SIPLUS variants), SINAMICS G130, SINAMICS G150, SINAMICS S110, SINAMICS S120 (incl. SIPLUS variants), SINAMICS S150, SINAMICS S210 (6SL5...), SINAMICS V90, SIPLUS ET 200MP IM 155-5 PN HF, SIPLUS ET 200MP IM 155-5 PN HF T1 RAIL, SIPLUS ET 200S IM 151-8 PN/DP CPU, SIPLUS ET 200S IM 151-8F PN/DP CPU, SIPLUS ET 200SP IM 155-6 PN HF, SIPLUS ET 200SP IM 155-6 PN HF T1 RAIL, SIPLUS ET 200SP IM 155-6 PN HF TX RAIL, SIPLUS HCS4200 CIM4210, SIPLUS HCS4200 CIM4
LUS ET 200SP IM 155-6 PN HF T1 RAIL, SIPLUS ET 200SP IM 155-6 PN HF TX RAIL, SIPLUS HCS4200 CIM4210, SIPLUS HCS4200 CIM4210C, SIPLUS HCS4300 CIM4310, SIPLUS NET PN/PN Coupler, SIPLUS S7-300 CPU 314C-2 PN/DP, SIPLUS S7-300 CPU 315-2 PN/DP, SIPLUS S7-300 CPU 315F-2 PN/DP, SIPLUS S7-300 CPU 317-2 PN/DP, SIPLUS S7-300 CPU 317F-2 PN/DP, SIPLUS S7-400 CPU 414-3 PN/DP V7, SIPLUS S7-400 CPU 416-3 PN/DP V7 Problem Types: CWE-400 Description: The PROFINET (PNIO) stack, when integrated with the Interniche IP stack, improperly handles internal resources for TCP segments where the minimum TCP-Header length is less than defined. This could allow an attacker to create a denial of service condition for TCP
um TCP-Header length is less than defined. This could allow an attacker to create a denial of service condition for TCP services on affected devices by sending specially crafted TCP segments. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-446448.pdf - https://cert-portal.siemens.com/productcert/html/ssa-446448.html
CVE ID: CVE-2022-25623 State: PUBLISHED Published: 2022-03-04T16:08:00 Last Updated: 2024-08-03T04:42:50.355Z Vendors: n/a Products: Symantec Management Agent Problem Types: Privilege escalation Description: The Symantec Management Agent is susceptible to a privilege escalation vulnerability. A low privilege local account can be elevated to the SYSTEM level through registry manipulations. Additional Analyst Notes: - CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/20366
CVE ID: CVE-2022-25625 State: PUBLISHED Published: 2022-08-26T15:25:43 Last Updated: 2024-08-03T04:42:50.318Z Vendors: n/a Products: Symantec Privileged Access Management (PAM) Problem Types: Privilege escalation Description: A malicious unauthorized PAM user can access the administration configuration data and change the values. Additional Analyst Notes: - CVE Program Container: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/20850
CVE ID: CVE-2022-25626 State: PUBLISHED Published: 2022-12-16T00:00:00.000Z Last Updated: 2025-04-18T13:31:49.540Z Vendors: n/a Products: Symantec Identity Governance and Administration Problem Types: Authentication Bypass Description: An unauthenticated user can access Identity Manager’s management console specific page URLs. However, the system doesn’t allow the user to carry out server side tasks without a valid web session. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/21136
CVE ID: CVE-2022-25627 State: PUBLISHED Published: 2022-12-16T00:00:00.000Z Last Updated: 2025-04-18T13:30:49.461Z Vendors: n/a Products: Symantec Identity Governance and Administration Problem Types: Remote Command Execution (RCE) Description: An authenticated administrator who has physical access to the environment can carry out Remote Command Execution on Management Console in Symantec Identity Manager 14.4 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/21136
CVE ID: CVE-2022-25628 State: PUBLISHED Published: 2022-12-16T00:00:00.000Z Last Updated: 2025-04-18T13:29:48.937Z Vendors: n/a Products: Symantec Identity Governance and Administration Problem Types: XML eXternal Entity injection (XXE) Description: An authenticated user can perform XML eXternal Entity injection in Management Console in Symantec Identity Manager 14.4 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/21136
CVE ID: CVE-2022-25629 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-23T14:21:33.037Z Vendors: n/a Products: Symantec Messaging Gateway Problem Types: Stored XSS Vulnerability Description: An authenticated user who has the privilege to add/edit annotations on the Content tab, can craft a malicious annotation that can be executed on the annotations page (Annotation Text Column). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21115
CVE ID: CVE-2022-25630 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-23T14:20:36.514Z Vendors: n/a Products: Symantec Messaging Gateway Problem Types: Stored XSS Vulnerability Description: An authenticated user can embed malicious content with XSS into the admin group policy page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/21117 - http://packetstormsecurity.com/files/171781/Symantec-Messaging-Gateway-10.7.4-Cross-Site-Scripting.html
CVE ID: CVE-2022-25631 State: PUBLISHED Published: 2023-01-20T00:00:00.000Z Last Updated: 2025-04-03T17:39:40.348Z Vendors: n/a Products: Symantec Endpoint Protection Problem Types: Elevation of Privilege Description: Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a type of issue whereby an attacker may attempt to compromise the software application to gain elevated Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.broadcom.com/external/content/SecurityAdvisories/0/21165
CVE ID: CVE-2022-25634 State: PUBLISHED Published: 2022-03-02T14:27:37 Last Updated: 2024-08-03T04:42:50.375Z Vendors: n/a Products: n/a Problem Types: n/a Description: Qt through 5.15.8 and 6.x through 6.2.3 can load system library files from an unintended working directory. Additional Analyst Notes: - CVE Program Container: References: - https://codereview.qt-project.org/c/qt/qtbase/+/396440 - https://codereview.qt-project.org/c/qt/qtbase/+/396689 - https://download.qt.io/official_releases/qt/6.2/CVE-2022-25643-6.2.diff - https://codereview.qt-project.org/c/qt/tqtc-qtbase/+/396690 - https://download.qt.io/official_releases/qt/5.15/CVE-2022-25643-5.15.diff
CVE ID: CVE-2022-25635 State: PUBLISHED Published: 2022-08-30T04:25:24.051734Z Last Updated: 2024-09-16T16:44:07.179Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Realtek Products: Linux/Android Bluetooth Mesh SDK Problem Types: CWE-120 Description: Realtek Linux/Android Bluetooth Mesh SDK has a buffer overflow vulnerability due to insufficient validation for broadcast network packet length. An unauthenticated attacker in the adjacent network can exploit this vulnerability to disrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-6456-fc6c5-1.html
CVE ID: CVE-2022-25636 State: PUBLISHED Published: 2022-02-22T01:41:05 Last Updated: 2024-08-03T04:42:50.324Z Vendors: n/a Products: n/a Problem Types: n/a Description: net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a heap out-of-bounds write. This is related to nf_tables_offload. Additional Analyst Notes: - CVE Program Container: References: - https://www.openwall.com/lists/oss-security/2022/02/21/2 - https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git/commit/?id=b1a5983f56e371046dcf164f90bfaf704d2b89f6 - http://www.openwall.com/lists/oss-security/2022/02/22/1 - https://www.debian.org/security/2022/dsa-5095
faf704d2b89f6 - http://www.openwall.com/lists/oss-security/2022/02/22/1 - https://www.debian.org/security/2022/dsa-5095 - https://www.oracle.com/security-alerts/cpujul2022.html - https://nickgregory.me/linux/security/2022/03/12/cve-2022-25636/ - https://github.com/Bonfee/CVE-2022-25636 - http://packetstormsecurity.com/files/166444/Kernel-Live-Patch-Security-Notice-LSN-0085-1.html - https://security.netapp.com/advisory/ntap-20220325-0002/
CVE ID: CVE-2022-25638 State: PUBLISHED Published: 2022-02-24T01:06:54 Last Updated: 2024-08-03T04:42:50.339Z Vendors: n/a Products: n/a Problem Types: n/a Description: In wolfSSL before 5.2.0, certificate validation may be bypassed during attempted authentication by a TLS 1.3 client to a TLS 1.3 server. This occurs when the sig_algo field differs between the certificate_verify message and the certificate message. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wolfSSL/wolfssl/pull/4813 - https://www.wolfssl.com/docs/security-vulnerabilities/
CVE ID: CVE-2022-25640 State: PUBLISHED Published: 2022-02-24T01:07:17 Last Updated: 2024-08-03T04:42:50.317Z Vendors: n/a Products: n/a Problem Types: n/a Description: In wolfSSL before 5.2.0, a TLS 1.3 server cannot properly enforce a requirement for mutual authentication. A client can simply omit the certificate_verify message from the handshake, and never present a certificate. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wolfSSL/wolfssl/pull/4831
CVE ID: CVE-2022-25641 State: PUBLISHED Published: 2022-08-29T04:53:44 Last Updated: 2024-08-03T04:42:50.320Z Vendors: n/a Products: n/a Problem Types: n/a Description: Foxit PDF Reader before 11.2.2 and PDF Editor before 11.2.2, and PhantomPDF before 10.1.8, mishandle cross-reference information during compressed-object parsing within signed documents. This leads to delivery of incorrect signature information via an Incremental Saving Attack and a Shadow Attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.foxit.com/support/security-bulletins.html
CVE ID: CVE-2022-25642 State: PUBLISHED Published: 2022-02-28T14:33:54 Last Updated: 2024-08-03T04:42:50.330Z Vendors: n/a Products: n/a Problem Types: n/a Description: Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://obyte.org/faq - https://vuln.ryotak.me/advisories/64 - https://github.com/byteball/obyte-gui-wallet/releases/tag/v3.4.1
CVE ID: CVE-2022-25643 State: PUBLISHED Published: 2022-02-22T00:00:00 Last Updated: 2024-08-03T04:42:50.299Z Vendors: n/a Products: n/a Problem Types: n/a Description: seatd-launch in seatd 0.6.x before 0.6.4 allows removing files with escalated privileges when installed setuid root. The attack vector is a user-supplied socket pathname. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/kennylevinsen/seatd/tags - https://github.com/kennylevinsen/seatd/compare/0.6.3...0.6.4 - https://lists.sr.ht/~kennylevinsen/seatd-announce/%3CETEO7R.QG8B1KGD531R1%40kl.wtf%3E - https://github.com/kennylevinsen/seatd/commit/10658dc5439db429af0088295a051c53925a4416 - https://g
GD531R1%40kl.wtf%3E - https://github.com/kennylevinsen/seatd/commit/10658dc5439db429af0088295a051c53925a4416 - https://github.com/kennylevinsen/seatd/commit/7cffe0797fdb17a9c08922339465b1b187394335 - https://nvd.nist.gov/vuln/detail/CVE-2022-25643
CVE ID: CVE-2022-25644 State: PUBLISHED Published: 2022-08-29T05:05:10.294812Z Last Updated: 2024-09-17T02:16:05.364Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: @pendo324/get-process-by-name Problem Types: Arbitrary Code Execution Description: All versions of package @pendo324/get-process-by-name are vulnerable to Arbitrary Code Execution due to improper sanitization of getProcessByName function. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-PENDO324GETPROCESSBYNAME-2419094 - https://github.com/pendo324/get-process-by-name-js/blob/34e8a279a94fa23acb13e302e9516ab1ea8d8731/index.js%2
ME-2419094 - https://github.com/pendo324/get-process-by-name-js/blob/34e8a279a94fa23acb13e302e9516ab1ea8d8731/index.js%23L27-L28
CVE ID: CVE-2022-25645 State: PUBLISHED Published: 2022-05-01T15:30:39.915755Z Last Updated: 2024-09-17T03:28:40.013Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L/E:P) Vendors: n/a Products: dset Problem Types: Prototype Pollution Description: All versions of package dset are vulnerable to Prototype Pollution via 'dset/merge' mode, as the dset function checks for prototype pollution by validating if the top-level path contains __proto__, constructor or protorype. By crafting a malicious object, it is possible to bypass this check and achieve prototype pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DSET-23308
type pollution. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-DSET-2330881 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2431974 - https://github.com/lukeed/dset/blob/master/src/merge.js%23L9 - https://github.com/lukeed/dset/pull/38
CVE ID: CVE-2022-25646 State: PUBLISHED Published: 2022-08-30T05:05:17.816833Z Last Updated: 2024-09-16T16:14:09.112Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: x-data-spreadsheet Problem Types: Cross-site Scripting (XSS) Description: All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting (XSS) due to missing sanitization of values inserted into the cells. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-XDATASPREADSHEET-2430381 - https://github.com/myliang/x-spreadsheet/issues/580 - https://youtu.be/Ij-8VVKNh7U
CVE ID: CVE-2022-25647 State: PUBLISHED Published: 2022-05-01T15:30:29.223346Z Last Updated: 2024-09-17T03:32:46.390Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: n/a Products: com.google.code.gson:gson Problem Types: Deserialization of Untrusted Data Description: The package com.google.code.gson:gson before 2.8.9 are vulnerable to Deserialization of Untrusted Data via the writeReplace() method in internal classes, which may lead to DoS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMGOOGLECODEGSON-1730327 - https://github.com/google/gson/pull/1991 - https://github.com/google/gson/pull/1991/commits
-COMGOOGLECODEGSON-1730327 - https://github.com/google/gson/pull/1991 - https://github.com/google/gson/pull/1991/commits - https://lists.debian.org/debian-lts-announce/2022/05/msg00015.html - https://www.oracle.com/security-alerts/cpujul2022.html - https://security.netapp.com/advisory/ntap-20220901-0009/ - https://lists.debian.org/debian-lts-announce/2022/09/msg00009.html - https://www.debian.org/security/2022/dsa-5227
CVE ID: CVE-2022-25648 State: PUBLISHED Published: 2022-04-19T16:35:11.215526Z Last Updated: 2024-09-16T17:59:47.353Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: git Problem Types: Command Injection Description: The package git before 1.11.0 are vulnerable to Command Injection via git argument injection. When calling the fetch(remote = 'origin', opts = {}) function, the remote parameter is passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-RUBY-GIT-2421270 -
njection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-RUBY-GIT-2421270 - https://github.com/ruby-git/ruby-git/releases/tag/v1.11.0 - https://github.com/ruby-git/ruby-git/pull/569 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XWNJA7WPE67LJ3DJMWZ2TADHCZKWMY55/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PTJUF6SFPL4ZVSJQHGQ36KFPFO5DQVYZ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q2V3HOFU4ZVTQZHAVAVL3EX2KU53SP7R/ - https://lists.debian.org/debian-lts-announce/2023/01/msg00043.html
CVE ID: CVE-2022-25649 State: PUBLISHED Published: 2022-08-05T15:07:52.745Z Last Updated: 2025-02-20T20:14:11.813Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: StoreApps Products: Affiliate For WooCommerce (WordPress plugin) Problem Types: CWE-264 Description: Multiple Improper Access Control vulnerabilities in StoreApps Affiliate For WooCommerce premium plugin <= 4.7.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/affiliate-for-woocommerce/wordpress-affiliate-for-woocommerce-premium-plugin-4-7-0-multiple-improper-access-control-vulnerabilities - https://
rce/wordpress-affiliate-for-woocommerce-premium-plugin-4-7-0-multiple-improper-access-control-vulnerabilities - https://dzv365zjfbd8v.cloudfront.net/changelogs/affiliate-for-woocommerce/changelog.txt