Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/371098 - https://hackerone.com/reports/1672388 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2884.json - http://packetstormsecurity.com/files/171628/GitLab-15.3-Remote-Code-Execution.html
CVE ID: CVE-2022-2885 State: PUBLISHED Published: 2022-08-21T08:05:09 Last Updated: 2024-08-03T00:52:58.823Z Severity: MEDIUM (CVSS 6.7 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:L/A:L) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/edeed309-be07-4373-b15e-2d1eb415eb89 - https://github.com/yetiforcecompany/yetiforcecrm/commit/a9ad9ee089b575855b9e5e202b4990a15811e8d2
CVE ID: CVE-2022-2886 State: PUBLISHED Published: 2022-08-19T12:00:17.000Z Last Updated: 2025-04-15T13:48:57.899Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Laravel Problem Types: CWE-502 Description: A vulnerability, which was classified as critical, was found in Laravel 5.1. Affected is an unknown function. The manipulation leads to deserialization. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-206688. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/beicheng-maker/vul
nal Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/beicheng-maker/vulns/issues/3 - https://vuldb.com/?id.206688
CVE ID: CVE-2022-2887 State: PUBLISHED Published: 2022-09-16T08:40:37 Last Updated: 2024-08-03T00:52:59.877Z Vendors: Unknown Products: WP Server Health Stats Problem Types: CWE-79 Description: The WP Server Health Stats WordPress plugin before 1.7.0 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/237541d5-c1a5-44f2-8e5f-82457b8f9497
CVE ID: CVE-2022-2888 State: PUBLISHED Published: 2022-09-21T11:25:08.000Z Last Updated: 2025-05-28T15:22:09.888Z Severity: MEDIUM (CVSS 4.4 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: octoprint Products: octoprint/octoprint Problem Types: CWE-613 Description: If an attacker comes into the possession of a victim's OctoPrint session cookie through whatever means, the attacker can use this cookie to authenticate as long as the victim's account exists. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/d27d232b-2578-4b32-b3b4-74aabdadf629 - https://github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d
s/d27d232b-2578-4b32-b3b4-74aabdadf629 - https://github.com/octoprint/octoprint/commit/40e6217ac1a85cc5ed592873ae49db01d3005da4
CVE ID: CVE-2022-2889 State: PUBLISHED Published: 2022-08-19T00:00:00 Last Updated: 2024-08-03T00:52:59.666Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.0225. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d1ac9817-825d-49ce-b514-1d5b12b6bdaa - https://github.com/vim/vim/commit/91c7cbfe31bbef57d5fcf7d76989fc159f73ef15 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/ - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2890 State: PUBLISHED Published: 2022-08-22T13:55:14 Last Updated: 2024-08-03T00:52:59.983Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/yetiforcecompany/yetiforcecrm/commit/2c14baaf8dbc7fd82d5c585f2fa0c23528450618 - https://huntr.dev/bounties/5d228a33-eda3-4cff-91da-7bc43e6636da
CVE ID: CVE-2022-2891 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T00:53:00.501Z Vendors: Unknown Products: WP 2FA Problem Types: CWE-203 Observable Discrepancy Description: The WP 2FA WordPress plugin before 2.3.0 uses comparison operators that don't mitigate time-based attacks, which could be abused to leak information about the authentication codes being compared. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/301b3dce-2584-46ec-92ed-1c0626522120
CVE ID: CVE-2022-2892 State: PUBLISHED Published: 2022-08-31T20:54:54.536Z Last Updated: 2025-04-16T17:48:40.246Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Measuresoft Products: ScadaPro Server Problem Types: CWE-787 Description: Measuresoft ScadaPro Server (Versions prior to 6.8.0.1) uses an unmaintained ActiveX control, which may allow an out-of-bounds write condition while processing a specific project file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-05
CVE ID: CVE-2022-2893 State: PUBLISHED Published: 2023-01-17T16:19:05.745Z Last Updated: 2025-01-16T22:01:26.105Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L) Vendors: RONDS Products: Equipment Predictive Maintenance Solution Problem Types: CWE-22 Description: RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths and download files. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-23-012-02
CVE ID: CVE-2022-2894 State: PUBLISHED Published: 2022-08-31T20:54:55.197Z Last Updated: 2025-04-16T17:48:12.800Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Measuresoft Products: ScadaPro Server Problem Types: CWE-822 Description: Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. The controls may allow seven untrusted pointer deference instances while processing a specific project file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06
CVE ID: CVE-2022-2895 State: PUBLISHED Published: 2022-08-31T20:54:54.819Z Last Updated: 2025-04-16T17:48:31.475Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Measuresoft Products: ScadaPro Server Problem Types: CWE-121 Description: Measuresoft ScadaPro Server (All Versions) uses unmaintained ActiveX controls. These controls may allow two stack-based buffer overflow instances while processing a specific project file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06
CVE ID: CVE-2022-2896 State: PUBLISHED Published: 2022-08-31T20:54:55.401Z Last Updated: 2025-04-16T17:48:01.170Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Measuresoft Products: ScadaPro Server Problem Types: CWE-121 Description: Measuresoft ScadaPro Server (All Versions) allows use after free while processing a specific project file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06
CVE ID: CVE-2022-2897 State: PUBLISHED Published: 2022-08-31T20:54:55.020Z Last Updated: 2025-04-16T17:48:20.720Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Measuresoft Products: ScadaPro Server and Client Problem Types: CWE-59 Description: Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow privilege escalation.. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06
CVE ID: CVE-2022-2898 State: PUBLISHED Published: 2022-08-31T20:54:55.611Z Last Updated: 2025-04-16T16:10:51.543Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: Measuresoft Products: ScadaPro Server and Client Problem Types: CWE-59 Description: Measuresoft ScadaPro Server and Client (All Versions) do not properly resolve links before file access; this could allow a denial-of-service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-235-06
CVE ID: CVE-2022-2900 State: PUBLISHED Published: 2022-09-14T08:30:13 Last Updated: 2024-08-03T00:52:59.599Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: ionicabizau Products: ionicabizau/parse-url Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1b4c972a-abc8-41eb-a2e1-696db746b5fd - https://github.com/ionicabizau/parse-url/commit/b88c81df8f4c5168af454eaa4f92afa9349e4e13
CVE ID: CVE-2022-2901 State: PUBLISHED Published: 2022-09-06T09:15:12 Last Updated: 2024-08-03T00:53:00.430Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:N) Vendors: chatwoot Products: chatwoot/chatwoot Problem Types: CWE-285 Description: Improper Authorization in GitHub repository chatwoot/chatwoot prior to 2.8. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/cf46e0a6-f1b5-4959-a952-be9e4bac03fe - https://github.com/chatwoot/chatwoot/commit/329e8c37c8ebc1b3629c0c3830b0e3070a3adc2a
CVE ID: CVE-2022-2903 State: PUBLISHED Published: 2022-09-26T12:35:34.000Z Last Updated: 2025-05-21T19:18:35.069Z Vendors: Unknown Products: Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress Problem Types: CWE-502 Description: The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/255b98ba-5da9-4424-a7e9-c438d8905864
CVE ID: CVE-2022-2904 State: PUBLISHED Published: 2022-11-02T00:00:00.000Z Last Updated: 2025-05-02T18:47:03.811Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions starting from 15.2 before 15.2.5, all versions starting from 15.3 before 15.3.4, all versions starting from 15.4 before 15.4.1 It was possible to exploit a vulnerability in the external status checks feature which could lead to a stored XSS that allowed attackers to perf
it a vulnerability in the external status checks feature which could lead to a stored XSS that allowed attackers to perform arbitrary actions on behalf of victims at client side. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/367408 - https://hackerone.com/reports/1628009 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2904.json
CVE ID: CVE-2022-2905 State: PUBLISHED Published: 2022-09-09T00:00:00 Last Updated: 2024-08-03T00:53:00.453Z Vendors: n/a Products: kernel Problem Types: CWE-125 Description: An out-of-bounds memory read flaw was found in the Linux kernel's BPF subsystem in how a user calls the bpf_tail_call function with a key larger than the max_entries of the map. This flaw allows a local user to gain unauthorized access to data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2121800 - https://lore.kernel.org/bpf/984b37f9fdf7ac36831d2137415a4a915744c1b6.1661462653.git.daniel%40iogearbox.net/ - https://lists.debian.org/debian-lts-announce/2022/1
c36831d2137415a4a915744c1b6.1661462653.git.daniel%40iogearbox.net/ - https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html
CVE ID: CVE-2022-2906 State: PUBLISHED Published: 2022-09-21T10:15:27.446Z Last Updated: 2025-05-28T15:25:56.879Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: BIND9 Problem Types: In BIND 9.18.0 -> 9.18.6 and versions 9.19.0 -> 9.19.4 of the BIND 9.19 development branch, changes between OpenSSL 1.x and OpenSSL 3.0 expose a flaw in named that causes a small memory leak in key processing when using TKEY records in Diffie-Hellman mode with OpenSSL 3.0.0 and later versions. Description: An attacker can leverage this flaw to gradually erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have
ally erode available memory to the point where named crashes for lack of resources. Upon restart the attacker would have to begin again, but nevertheless there is the potential to deny service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kb.isc.org/docs/cve-2022-2906 - http://www.openwall.com/lists/oss-security/2022/09/21/3 - https://security.gentoo.org/glsa/202210-25
CVE ID: CVE-2022-2907 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-04T17:43:37.905Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. It was possible to read repository content by an unauthorised user if a project member used a crafted link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-o
k. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/349388 - https://hackerone.com/reports/1417680 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2907.json
CVE ID: CVE-2022-2908 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T19:10:54.397Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: A potential DoS vulnerability was discovered in Gitlab CE/EE versions starting from 10.7 before 15.1.5, all versions starting from 15.2 before 15.2.3, all versions starting from 15.3 before 15.3.1 allowed an attacker to trigger high CPU usage via a special crafted input added in the Commit message field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitl
it message field. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/363734 - https://hackerone.com/reports/1584156 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2908.json
CVE ID: CVE-2022-2909 State: PUBLISHED Published: 2022-08-20T06:55:11.000Z Last Updated: 2025-04-15T13:48:49.848Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Simple and Nice Shopping Cart Script Problem Types: CWE-434 Description: A vulnerability was found in SourceCodester Simple and Nice Shopping Cart Script. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /mkshop/Men/profile.php. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206845 was assigned to this v
remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-206845 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://s1.ax1x.com/2022/08/14/vUSyHH.png - https://vuldb.com/?id.206845
CVE ID: CVE-2022-2912 State: PUBLISHED Published: 2022-09-16T08:40:38.000Z Last Updated: 2025-06-03T17:37:02.460Z Vendors: Unknown Products: Craw Data Problem Types: CWE-918 Description: The Craw Data WordPress plugin through 1.0.0 does not implement nonce checks, which could allow attackers to make a logged in admin change the url value performing unwanted crawls on third-party sites (SSRF). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fd9853e8-b3ae-4a10-8389-8a4a11a8297c
CVE ID: CVE-2022-2913 State: PUBLISHED Published: 2022-09-16T08:40:39.000Z Last Updated: 2025-06-03T17:48:04.382Z Vendors: Unknown Products: Login No Captcha reCAPTCHA Problem Types: CWE-639 Description: The Login No Captcha reCAPTCHA WordPress plugin before 1.7 doesn't check the proper IP address allowing attackers to spoof IP addresses on the allow list and bypass the need for captcha on the login screen. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/5231ac18-ea9a-4bb9-af9f-e3d95a3b54f1
CVE ID: CVE-2022-2915 State: PUBLISHED Published: 2022-08-26T20:30:15 Last Updated: 2024-08-03T00:52:59.534Z Vendors: SonicWall Products: SMA100 Problem Types: CWE-122 Description: A Heap-based Buffer Overflow vulnerability in the SonicWall SMA100 appliance allows a remote authenticated attacker to cause Denial of Service (DoS) on the appliance or potentially lead to code execution. This vulnerability impacts 10.2.1.5-34sv and earlier versions. Additional Analyst Notes: - CVE Program Container: References: - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0019
CVE ID: CVE-2022-2921 State: PUBLISHED Published: 2022-08-21T03:15:20 Last Updated: 2024-08-03T00:52:59.889Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: notrinos Products: notrinos/notrinoserp Problem Types: CWE-359 Description: Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository notrinos/notrinoserp prior to v0.7. This results in privilege escalation to a system administrator account. An attacker can gain access to protected functionality such as create/update companies, install/update languages, install/activate extensions, install/activate themes and other permissive actions. Additional Analyst Notes: - CVE Program Con
l/activate extensions, install/activate themes and other permissive actions. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/51b32a1c-946b-4390-a212-b6c4b6e4115c - https://github.com/notrinos/notrinoserp/commit/1b9903f4deea3289872793e60d730c63ecbf7b45
CVE ID: CVE-2022-2922 State: PUBLISHED Published: 2022-09-30T06:45:13.000Z Last Updated: 2025-05-20T16:03:33.907Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: dnnsoftware Products: dnnsoftware/dnn.platform Problem Types: CWE-23 Description: Relative Path Traversal in GitHub repository dnnsoftware/dnn.platform prior to 9.11.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/74918f40-dc11-4218-abef-064eb71a0703 - https://github.com/dnnsoftware/dnn.platform/commit/9b17351592fbde376506ba6705dbcc7a74a2a195
CVE ID: CVE-2022-2923 State: PUBLISHED Published: 2022-08-22T00:00:00 Last Updated: 2024-08-03T00:53:00.468Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:L) Vendors: vim Products: vim/vim Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository vim/vim prior to 9.0.0240. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/fd3a3ab8-ab0f-452f-afea-8c613e283fd2 - https://github.com/vim/vim/commit/6669de1b235843968e88844ca6d3c8dec4b01a9e - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/ - https://security.gentoo.org/glsa/2023
age-announce%40lists.fedoraproject.org/message/C72HDIMR3KTTAO7QGTXWUMPBNFUFIBRD/ - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2924 State: PUBLISHED Published: 2022-09-20T05:25:09.000Z Last Updated: 2025-05-29T13:40:12.402Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N) Vendors: yetiforcecompany Products: yetiforcecompany/yetiforcecrm Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository yetiforcecompany/yetiforcecrm prior to 6.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/f0f3aded-6e97-4cf2-980a-c90f2c6ca0e0 - https://github.com/yetiforcecompany/yetiforcecrm/commit/b716ecea340783b842498425faa029800bd30420
CVE ID: CVE-2022-2925 State: PUBLISHED Published: 2022-09-09T05:25:09 Last Updated: 2024-08-03T00:52:59.827Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: appwrite Products: appwrite/appwrite Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository appwrite/appwrite prior to 1.0.0-RC1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a3b4148f-165f-4583-abed-5568696d99dc - https://github.com/appwrite/appwrite/commit/b5b4d92623c13fa8e5c71736db461e81fb7a7ade
CVE ID: CVE-2022-2926 State: PUBLISHED Published: 2022-09-26T12:35:35.000Z Last Updated: 2025-05-21T16:23:31.411Z Vendors: Unknown Products: Download Manager Problem Types: CWE-22 Description: The Download Manager WordPress plugin before 3.2.55 does not validate one of its settings, which could allow high privilege users such as admin to list and read arbitrary files and folders outside of the blog directory Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2a440e1a-a7e4-4106-839a-d93895e16785
CVE ID: CVE-2022-2927 State: PUBLISHED Published: 2022-08-22T08:55:09 Last Updated: 2024-08-03T00:53:00.428Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: notrinos Products: notrinos/notrinoserp Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository notrinos/notrinoserp prior to 0.7. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7fa956dd-f541-4dcd-987d-ba15caa6a886 - https://github.com/notrinos/notrinoserp/commit/e61e76b44c6a2b28a4a648a06ef34f65c376ec1e
CVE ID: CVE-2022-2928 State: PUBLISHED Published: 2022-10-07T04:45:11.751554Z Last Updated: 2024-09-17T00:21:40.167Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ISC Products: ISC DHCP Problem Types: A DHCP server configured with allow leasequery;, a remote machine with access to the server can send lease queries for the same lease multiple times, leading to the add_option() function being repeatedly called. This could cause an option's refcount field to overflow and the server to abort. Internally, reference counters are integers and thus overflow at 2^31 references, so even at 1000 lease query responses per second, it would take more than three weeks to