Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
Program Container: References: - https://wpscan.com/vulnerability/4d12533e-bdb7-411f-bcdf-4c5046db13f3 - https://github.com/10up/safe-svg/pull/28
CVE ID: CVE-2022-1092 State: PUBLISHED Published: 2022-04-25T15:51:15 Last Updated: 2024-08-02T23:55:22.825Z Vendors: Unknown Products: myCred Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/95759d5c-8802-4493-b7e5-7f2bc546af61
CVE ID: CVE-2022-1093 State: PUBLISHED Published: 2022-05-23T07:15:25 Last Updated: 2024-08-02T23:55:22.837Z Vendors: Unknown Products: WP Meta SEO Problem Types: CWE-79 Description: The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/57017050-811e-474d-8256-33d19d4c0553
CVE ID: CVE-2022-1094 State: PUBLISHED Published: 2022-04-25T15:51:16.000Z Last Updated: 2025-05-05T16:43:24.966Z Vendors: Unknown Products: amr users Problem Types: CWE-79 Description: The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3c03816b-e381-481c-b9f5-63d0c24ff329
CVE ID: CVE-2022-1095 State: PUBLISHED Published: 2022-06-27T08:56:16 Last Updated: 2024-08-02T23:55:23.587Z Vendors: Unknown Products: Mihdan: No External Links Problem Types: CWE-79 Description: The Mihdan: No External Links WordPress plugin before 5.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bf476a3e-05ba-4b54-8a65-3d261ad5337b
CVE ID: CVE-2022-1096 State: PUBLISHED Published: 2022-07-22T23:35:35.000Z Last Updated: 2025-10-21T23:15:37.697Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://crbug.com/1309225 - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1097 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:30:37.032Z Vendors: Mozilla Products: Thunderbird, Firefox, Firefox ESR Problem Types: Use-after-free in NSSToken objects Description: <code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-13/ - https://www.mozilla.org/security
Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-13/ - https://www.mozilla.org/security/advisories/mfsa2022-14/ - https://www.mozilla.org/security/advisories/mfsa2022-15/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1745667
CVE ID: CVE-2022-1098 State: PUBLISHED Published: 2022-04-01T22:17:22.593Z Last Updated: 2025-04-16T17:57:58.352Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: DIAEnerrgie Products: DIAEnergie Problem Types: CWE-427 Description: Delta Electronics DIAEnergie (all versions prior to 1.8.02.004) are vulnerable to a DLL hijacking condition. When combined with the Incorrect Default Permissions vulnerability of 4.2.2 above, this makes it possible for an attacker to escalate privileges Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-081-01
CVE ID: CVE-2022-1099 State: PUBLISHED Published: 2022-04-04T19:46:03 Last Updated: 2024-08-02T23:55:24.230Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/328593 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1099.json
CVE ID: CVE-2022-1100 State: PUBLISHED Published: 2022-04-04T19:46:02 Last Updated: 2024-08-02T23:55:23.609Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Improper input validation in GitLab Description: A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.
ied values resulting in high CPU usage. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/273771 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1100.json
CVE ID: CVE-2022-1101 State: PUBLISHED Published: 2023-01-07T21:33:57.055Z Last Updated: 2024-11-25T17:06:18.498Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: SourceCodester Products: Royale Event Management System Problem Types: CWE-287 Description: A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /royal_event/userregister.php. The manipulation leads to improper authentication. The attack may be initiated remotely. The identifier VDB-195785 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Reference
as assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.195785 - https://vuldb.com/?ctiid.195785
CVE ID: CVE-2022-1102 State: PUBLISHED Published: 2023-01-07T21:34:19.194Z Last Updated: 2024-08-02T23:55:22.822Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: SourceCodester Products: Royale Event Management System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in SourceCodester Royale Event Management System 1.0. Affected is an unknown function of the file /royal_event/companyprofile.php. The manipulation of the argument companyname/regno/companyaddress/companyemail leads to cross site scripting. It is possible to launch the attack remotely. VDB-195786 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE
launch the attack remotely. VDB-195786 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.195786 - https://vuldb.com/?ctiid.195786 - https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html?
CVE ID: CVE-2022-1103 State: PUBLISHED Published: 2022-05-16T14:30:37 Last Updated: 2024-08-02T23:55:24.395Z Vendors: Unknown Products: Advanced uploader Problem Types: CWE-434 Description: The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9ddeef95-7c7f-4296-a55b-fd3304c91c18
CVE ID: CVE-2022-1104 State: PUBLISHED Published: 2022-05-09T16:50:46 Last Updated: 2024-08-02T23:55:23.360Z Vendors: Unknown Products: Popup Maker – Popup for opt-ins, lead gen, & more Problem Types: CWE-79 Description: The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4d4709f3-ad38-4519-a24a-73bc04b20e52
CVE ID: CVE-2022-1105 State: PUBLISHED Published: 2022-04-04T19:46:04 Last Updated: 2024-08-02T23:55:22.835Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/335933 - https://gitlab.com/gitlab-org/cves/-/blob/master/20
References: - https://gitlab.com/gitlab-org/gitlab/-/issues/335933 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1105.json
CVE ID: CVE-2022-1106 State: PUBLISHED Published: 2022-03-27T14:05:10 Last Updated: 2024-08-02T23:55:23.753Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-416 Description: use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/16b9d0ea-71ed-41bc-8a88-2deb4c20be8f - https://github.com/mruby/mruby/commit/7f5a490d09f4d56801ac3a3e4e39e03e1471b44c
CVE ID: CVE-2022-1107 State: PUBLISHED Published: 2022-04-22T20:30:50 Last Updated: 2024-08-02T23:55:24.201Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad BIOS Problem Types: CWE-20 Description: During an internal product security audit a potential vulnerability due to use of Boot Services in the SmmOEMInt15 SMI handler was discovered in some ThinkPad models could be exploited by an attacker with elevated privileges that could allow for execution of code. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-84943
CVE ID: CVE-2022-1108 State: PUBLISHED Published: 2022-04-22T20:30:51 Last Updated: 2024-08-02T23:55:24.265Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: ThinkPad BIOS Problem Types: CWE-20 Description: A potential vulnerability due to improper buffer validation in the SMI handler LenovoFlashDeviceInterface in Thinkpad X1 Fold Gen 1 could be exploited by an attacker with local access and elevated privileges to execute arbitrary code. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-84943
CVE ID: CVE-2022-1109 State: PUBLISHED Published: 2023-01-20T19:23:31.270Z Last Updated: 2025-04-02T13:41:13.482Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: Leyun Problem Types: CWE-276 Description: An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://iknow.lenovo.com.cn/detail/dc_204380.html
CVE ID: CVE-2022-1110 State: PUBLISHED Published: 2022-05-18T16:10:35 Last Updated: 2024-08-02T23:55:23.446Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Lenovo Products: Smart Standby Driver Problem Types: CWE-120 Description: A buffer overflow vulnerability in Lenovo Smart Standby Driver prior to version 4.1.50.0 could allow a local attacker to cause denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.lenovo.com/us/en/product_security/LEN-79452
CVE ID: CVE-2022-1111 State: PUBLISHED Published: 2022-04-04T19:46:10 Last Updated: 2024-08-02T23:55:24.171Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Vulnerability in GitLab Description: A business logic error in Project Import in GitLab CE/EE versions 14.9 prior to 14.9.2, 14.8 prior to 14.8.5, and 14.0 prior to 14.7.7 under certain conditions caused imported projects to show an incorrect user in the 'Access Granted' column in the project membership pages Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/345236 - https://gitlab.com/gitlab-org/cves/-/blob/
ntainer: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/345236 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1111.json
CVE ID: CVE-2022-1112 State: PUBLISHED Published: 2022-04-18T17:10:56 Last Updated: 2024-08-02T23:55:23.670Z Vendors: Unknown Products: Autolinks Problem Types: CWE-79, CWE-352 Description: The Autolinks WordPress plugin through 1.0.1 does not have CSRF check in place when updating its settings, and does not sanitise as well as escape them, which could allow attackers to perform Stored Cross-Site scripting against a logged in admin via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/746c7cf2-0902-461a-a364-285505d73505
CVE ID: CVE-2022-1113 State: PUBLISHED Published: 2022-06-27T08:56:22 Last Updated: 2024-08-02T23:55:23.983Z Vendors: Unknown Products: Flower Delivery by Florist One Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Flower Delivery by Florist One WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setups) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ea438e84-f842-4cb9-b6c0-550cd8187701
CVE ID: CVE-2022-1114 State: PUBLISHED Published: 2022-04-29T15:38:57 Last Updated: 2024-08-02T23:55:23.392Z Vendors: n/a Products: ImageMagick Problem Types: CWE-416 Description: A heap-use-after-free flaw was found in ImageMagick's RelinquishDCMInfo() function of dcm.c file. This vulnerability is triggered when an attacker passes a specially crafted DICOM image file to ImageMagick for conversion, potentially leading to information disclosure and a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2064538
CVE ID: CVE-2022-1115 State: PUBLISHED Published: 2022-08-29T14:03:06 Last Updated: 2024-08-02T23:55:23.492Z Vendors: n/a Products: ImageMagick Problem Types: CWE-119 Description: A heap-buffer-overflow flaw was found in ImageMagick’s PushShortPixel() function of quantum-private.h file. This vulnerability is triggered when an attacker passes a specially crafted TIFF image file to ImageMagick for conversion, potentially leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2067022 - https://github.com/ImageMagick/ImageMagick/issues/4974 - https://github.com/ImageMagick/ImageMagick6/commit/1f860f52bd8d58737a
//github.com/ImageMagick/ImageMagick/issues/4974 - https://github.com/ImageMagick/ImageMagick6/commit/1f860f52bd8d58737ad883072203391096b30b51 - https://github.com/ImageMagick/ImageMagick/commit/c8718305f120293d8bf13724f12eed885d830b09 - https://access.redhat.com/security/cve/CVE-2022-1115
CVE ID: CVE-2022-1116 State: PUBLISHED Published: 2022-05-17T16:50:11.000Z Last Updated: 2025-04-21T13:53:37.804Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Linux Products: Kernel Problem Types: CWE-190 Description: Integer Overflow or Wraparound vulnerability in io_uring of Linux Kernel allows local attacker to cause memory corruption and escalate privileges to root. This issue affects: Linux Kernel versions prior to 5.4.189; version 5.4.24 and later versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/fs/io_uring.c?h=v5.4.189&id=1a623d3
eferences: - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/fs/io_uring.c?h=v5.4.189&id=1a623d361ffe5cecd4244a02f449528416360038 - https://kernel.dance/#1a623d361ffe5cecd4244a02f449528416360038 - http://packetstormsecurity.com/files/167386/Kernel-Live-Patch-Security-Notice-LSN-0086-1.html - https://security.netapp.com/advisory/ntap-20220629-0004/
CVE ID: CVE-2022-1117 State: PUBLISHED Published: 2022-08-29T14:03:07 Last Updated: 2024-08-02T23:55:23.436Z Vendors: n/a Products: fapolicyd Problem Types: CWE-552 Description: A vulnerability was found in fapolicyd. The vulnerability occurs due to an assumption on how glibc names the runtime linker, a build time regular expression may not correctly detect the runtime linker. The consequence is that the pattern detection for applications launched by the run time linker may fail to detect the pattern and allow execution. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2068171 - https://bugzilla.redhat.com/show_bug.cgi?id=2066904 -
ferences: - https://bugzilla.redhat.com/show_bug.cgi?id=2068171 - https://bugzilla.redhat.com/show_bug.cgi?id=2066904 - https://github.com/linux-application-whitelisting/fapolicyd/commit/38a942613f93824c53164730b2b7a2f75b8cd263 - https://access.redhat.com/security/cve/CVE-2022-1117
CVE ID: CVE-2022-1118 State: PUBLISHED Published: 2022-05-17T19:47:10.000Z Last Updated: 2025-04-16T17:54:25.317Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Rockwell Automation Products: Connected Component Workbench, ISaGRAF Workbench, Safety Instrumented Systems Workstation Problem Types: CWE-502 Description: Connected Components Workbench (v13.00.00 and prior), ISaGRAF Workbench (v6.0 though v6.6.9), and Safety Instrumented System Workstation (v1.2 and prior (for Trusted Controllers)) do not limit the objects that can be deserialized. This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Wo
This allows attackers to craft a malicious serialized object that, if opened by a local user in Connected Components Workbench, may result in arbitrary code execution. This vulnerability requires user interaction to be successfully exploited Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-095-01
CVE ID: CVE-2022-1119 State: PUBLISHED Published: 2022-04-19T20:26:35 Last Updated: 2024-08-02T23:55:23.871Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: eemitch Products: Simple File List Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file that will subsequently be downloaded, in versions up to and including 3.2.7. Additional Analyst Notes: - CVE P
to a file that will subsequently be downloaded, in versions up to and including 3.2.7. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ff21241d-e488-4460-b8c2-d5a070c8c107?source=cve - https://plugins.trac.wordpress.org/browser/simple-file-list/trunk/includes/ee-downloader.php?rev=2071880 - https://wpscan.com/vulnerability/075a3cc5-1970-4b64-a16f-3ec97e22b606 - https://docs.google.com/document/d/1qIZXTzEpI4tO6832vk1KfsSAroT0FY2l--THlhJ8z3c/edit
CVE ID: CVE-2022-1120 State: PUBLISHED Published: 2022-04-04T19:46:08 Last Updated: 2024-08-02T23:55:23.714Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure through an error message in GitLab Description: Missing filtering in an error message in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 exposed sensitive information when an include directive fails in the CI/CD configuration. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/343466 - https://hackerone.com/reports/1408731 - https://gi
References: - https://gitlab.com/gitlab-org/gitlab/-/issues/343466 - https://hackerone.com/reports/1408731 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1120.json
CVE ID: CVE-2022-1121 State: PUBLISHED Published: 2022-04-04T19:46:11 Last Updated: 2024-08-02T23:55:23.783Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Pages Problem Types: Uncontrolled resource consumption in GitLab Pages Description: A lack of appropriate timeouts in GitLab Pages included in GitLab CE/EE all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to cause unlimited resource consumption. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab-pages/-/issues/684 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1121.j
/gitlab.com/gitlab-org/gitlab-pages/-/issues/684 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1121.json
CVE ID: CVE-2022-1122 State: PUBLISHED Published: 2022-03-29T17:25:44.000Z Last Updated: 2025-11-03T19:26:42.585Z Vendors: n/a Products: openjpeg2 Problem Types: CWE-665 Description: A flaw was found in the opj2_decompress program in openjpeg2 2.4.0 in the way it handles an input directory with a large number of files. When it fails to allocate a buffer to store the filenames of the input directory, it calls free() on an uninitialized pointer, leading to a segmentation fault and a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/uclouvain/openjpeg/issues/1368 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap
thub.com/uclouvain/openjpeg/issues/1368 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ROSN5NRUFOH7HGLJ4ZSKPGAKLFXJALW4/ - https://lists.debian.org/debian-lts-announce/2022/04/msg00006.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MIWSQFQWXDU4MT3XTVAO6HC7TVL3NHS7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMKBAMK2CAM5TMC5TODKVCE5AAPTD5YV/ - https://security.gentoo.org/glsa/202209-04