Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-2238 State: PUBLISHED Published: 2022-09-01T19:56:03 Last Updated: 2024-08-03T00:32:09.559Z Vendors: n/a Products: Red Hat Advanced Cluster Management for Kubernetes Problem Types: CWE-89 Description: A vulnerability was found in the search-api container in Red Hat Advanced Cluster Management for Kubernetes when a query in the search filter gets parsed by the backend. This flaw allows an attacker to craft specific strings containing special characters that lead to crashing the pod and affects system availability while restarting. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2101669 - https://access.redhat.com/se
CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2101669 - https://access.redhat.com/security/cve/CVE-2022-2238
CVE ID: CVE-2022-2239 State: PUBLISHED Published: 2022-07-25T12:47:41 Last Updated: 2024-08-03T00:32:09.285Z Vendors: Unknown Products: Request a Quote Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Request a Quote WordPress plugin before 2.3.9 does not sanitise and escape some of its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/42127d96-547f-46cb-95d0-a19a8fe7580e
CVE ID: CVE-2022-2240 State: PUBLISHED Published: 2022-07-25T12:47:55 Last Updated: 2024-08-03T00:32:09.260Z Vendors: Unknown Products: Request a Quote Problem Types: CWE-1236 Description: The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6a3a573e-f9f2-45ec-9156-332cc551fc7e
CVE ID: CVE-2022-2241 State: PUBLISHED Published: 2022-08-01T12:50:31 Last Updated: 2024-08-03T00:32:09.268Z Vendors: Unknown Products: Featured Image from URL (FIFU) Problem Types: CWE-116 Improper Encoding or Escaping of Output Description: The Featured Image from URL (FIFU) WordPress plugin before 4.0.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack. Furthermore, due to the lack of validation, sanitisation and escaping in some of them, it could also lead to Stored XSS issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8670d196-972b-491b-8
s Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8670d196-972b-491b-8d9b-25994a345f57
CVE ID: CVE-2022-2242 State: PUBLISHED Published: 2022-08-10T10:20:19.887204Z Last Updated: 2024-09-17T00:07:00.605Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: KUKA Products: SystemSoftware V/KSS Problem Types: CWE-306 Description: The KUKA SystemSoftware V/KSS in versions prior to 8.6.5 is prone to improper access control as an unauthorized attacker can directly read and write robot configurations when access control is not available or not enabled (default). Additional Analyst Notes: - CVE Program Container: References: - https://www.kuka.com/advisories-CVE-2022-2242
CVE ID: CVE-2022-2243 State: PUBLISHED Published: 2022-07-01T15:52:32 Last Updated: 2024-08-03T00:32:09.539Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Authorization bypass through user-controlled key in GitLab Description: An access control vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows authenticated users to enumerate issues in non-linked sentry projects. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/360666 - https://hackerone.com/reports/1546138 - https://gitlab.
rences: - https://gitlab.com/gitlab-org/gitlab/-/issues/360666 - https://hackerone.com/reports/1546138 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2243.json
CVE ID: CVE-2022-2244 State: PUBLISHED Published: 2022-07-01T15:04:24 Last Updated: 2024-08-03T00:32:09.492Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: An improper authorization vulnerability in GitLab EE/CE affecting all versions from 14.8 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows project memebers with reporter role to manage issues in project's error tracking feature. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/360666 - https://hackerone.com/reports/1619583 - https://gitl
eferences: - https://gitlab.com/gitlab-org/gitlab/-/issues/360666 - https://hackerone.com/reports/1619583 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2244.json
CVE ID: CVE-2022-2245 State: PUBLISHED Published: 2022-08-01T12:50:45 Last Updated: 2024-08-03T00:32:09.532Z Vendors: Unknown Products: Counter Box – WordPress plugin for countdown, timer, counter Problem Types: CWE-352 Description: The Counter Box WordPress plugin before 1.2.1 is lacking CSRF check when activating and deactivating counters, which could allow attackers to make a logged in admin perform such actions via CSRF attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/33705003-1f82-4b0c-9b4b-d4de75da309c
CVE ID: CVE-2022-2246 State: REJECTED Published: 2022-06-28T19:00:14 Last Updated: 2022-06-28T21:20:14 Description: No description available.
CVE ID: CVE-2022-2249 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-05-19T16:53:47.153Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: Avaya Products: Avaya Aura Communication Manager Problem Types: CWE-269 Description: Privilege escalation related vulnerabilities were discovered in Avaya Aura Communication Manager that may allow local administrative users to escalate their privileges. This issue affects Communication Manager versions 8.0.0.0 through 8.1.3.3 and 10.1.0.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://download.avaya.com/css/public/documents/101083760
CVE ID: CVE-2022-2250 State: PUBLISHED Published: 2022-07-01T15:03:14 Last Updated: 2024-08-03T00:32:09.428Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Url redirection to untrusted site ('open redirect') in GitLab Description: An open redirect vulnerability in GitLab EE/CE affecting all versions from 11.1 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to redirect users to an arbitrary location if they trust the URL. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/355509 - https://hackerone.com/reports/1506126 - http
ainer: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/355509 - https://hackerone.com/reports/1506126 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2250.json
CVE ID: CVE-2022-2251 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-04-08T18:20:55.756Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N) Vendors: GitLab Products: GitLab Runner Problem Types: Improper neutralization of special elements used in an os command ('os command injection') in GitLab Runner Description: Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2 allows a user who creates a branch with a specially crafted name and gets another user to trigger a pipeline to execute commands in the runner as that other user. Additional Analyst Notes: - CVE
nother user to trigger a pipeline to execute commands in the runner as that other user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab-runner/-/issues/27386 - https://hackerone.com/reports/1063511 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2251.json
CVE ID: CVE-2022-2252 State: PUBLISHED Published: 2022-06-29T15:15:21 Last Updated: 2024-08-03T00:32:09.308Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: microweber Products: microweber/microweber Problem Types: CWE-601 Description: Open Redirect in GitHub repository microweber/microweber prior to 1.2.19. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4d394bcc-a000-4f96-8cd2-8c565e1347e8 - https://github.com/microweber/microweber/commit/187e949daf7dea6f10b80da70988f0f86444eeff
CVE ID: CVE-2022-2253 State: PUBLISHED Published: 2022-07-01T14:56:56.000Z Last Updated: 2025-04-16T17:51:39.164Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Distributed Data Systems Products: WebHMI Problem Types: CWE-78 Description: A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-04
CVE ID: CVE-2022-2254 State: PUBLISHED Published: 2022-07-01T15:01:57.000Z Last Updated: 2025-04-16T16:15:30.896Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N) Vendors: Distributed Data Systems Products: WebHMI Problem Types: CWE-79 Description: A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 can store a script that could impact other logged in users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-181-04
CVE ID: CVE-2022-2255 State: PUBLISHED Published: 2022-08-25T17:26:19 Last Updated: 2024-08-03T00:32:09.572Z Vendors: n/a Products: mod_wsgi Problem Types: CWE-348 Description: A vulnerability was found in mod_wsgi. The X-Client-IP header is not removed from a request from an untrusted proxy, allowing an attacker to pass the X-Client-IP header to the target WSGI application because the condition to remove it is missing. Additional Analyst Notes: - CVE Program Container: References: - https://modwsgi.readthedocs.io/en/latest/release-notes/version-4.9.3.html - https://github.com/GrahamDumpleton/mod_wsgi/blob/4.9.2/src/server/mod_wsgi.c#L13940-L13941 - https://github.com/GrahamDumpleton/mod_wsg
com/GrahamDumpleton/mod_wsgi/blob/4.9.2/src/server/mod_wsgi.c#L13940-L13941 - https://github.com/GrahamDumpleton/mod_wsgi/blob/4.9.2/src/server/mod_wsgi.c#L14046-L14082 - https://lists.debian.org/debian-lts-announce/2022/09/msg00021.html
CVE ID: CVE-2022-2256 State: PUBLISHED Published: 2022-09-01T19:57:29 Last Updated: 2024-08-03T00:32:09.302Z Vendors: n/a Products: keycloak Problem Types: CWE-79 Description: A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin console, abusing the default roles functionality. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2101942 - https://github.com/keycloak/keycloak/security/advisories/GHSA-w9mf-83w3-fv49
CVE ID: CVE-2022-2257 State: PUBLISHED Published: 2022-06-30T00:00:00 Last Updated: 2024-08-03T00:32:09.557Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository vim/vim prior to 9.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ca581f80-03ba-472a-b820-78f7fd05fe89 - https://github.com/vim/vim/commit/083692d598139228e101b8c521aaef7bcf256e9a - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/ - https://lists.fedoraproject.org/archives/list/pack
40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/ - https://security.gentoo.org/glsa/202208-32 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2258 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-02-27T21:17:59.963Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Able to view tagsets without assigned permissions Description: In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view these items Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2023/sa2023-03/
CVE ID: CVE-2022-2259 State: PUBLISHED Published: 2023-03-13T00:00:00.000Z Last Updated: 2025-03-03T20:30:29.698Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Able to view workerpools without assigned permissions Description: In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view these items Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2023/sa2023-04/
CVE ID: CVE-2022-2260 State: PUBLISHED Published: 2022-08-01T12:50:58 Last Updated: 2024-08-03T00:32:09.543Z Vendors: Unknown Products: GiveWP – Donation Plugin and Fundraising Platform Problem Types: CWE-352 Description: The GiveWP WordPress plugin before 2.21.3 does not have CSRF in place when exporting data, and does not validate the exporting parameters such as dates, which could allow attackers to make a logged in admin DoS the web server via a CSRF attack as the plugin will try to retrieve data from the database many times which leads to overwhelm the target's CPU. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/831b3afa-8fa3-4cb7-8374-
ditional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/831b3afa-8fa3-4cb7-8374-36d0c368292f
CVE ID: CVE-2022-2261 State: PUBLISHED Published: 2022-08-29T17:15:35 Last Updated: 2024-08-03T00:32:09.674Z Vendors: Unknown Products: WPIDE – File Manager & Code Editor Problem Types: CWE-22 Description: The WPIDE WordPress plugin before 3.0 does not sanitize and validate the filename parameter before using it in a require statement in the admin dashboard, leading to a Local File Inclusion issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f6091d7b-97b5-42f2-b2f4-09a0fe6d5a21
CVE ID: CVE-2022-2262 State: PUBLISHED Published: 2022-07-12T14:10:10.000Z Last Updated: 2025-04-15T14:08:05.781Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Online Hotel Booking System Problem Types: CWE-89 Description: A vulnerability has been found in Online Hotel Booking System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file edit_all_room.php of the component Room Handler. The manipulation of the argument id with the input 2828%27%20AND%20(SELECT%203766%20FROM%20(SELECT(SLEEP(5)))BmIK)%20AND%20%27YLPl%27=%27YLPl leads to sql injection. The attack can be launched remotely. Th
ROM%20(SELECT(SLEEP(5)))BmIK)%20AND%20%27YLPl%27=%27YLPl leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Online%20Hotel%20Booking%20System/Online%20Hotel%20Booking%20System%20edit_all_room.php%20id%20SQL%20inject.md - https://vuldb.com/?id.202981
CVE ID: CVE-2022-2263 State: PUBLISHED Published: 2022-07-12T14:10:14.000Z Last Updated: 2025-04-15T14:07:58.418Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: unspecified Products: Online Hotel Booking System Problem Types: CWE-89 Description: A vulnerability was found in Online Hotel Booking System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file edit_room_cat.php of the component Room Handler. The manipulation of the argument roomname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container:
otely. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Online%20Hotel%20Booking%20System/Online%20Hotel%20Booking%20System%20edit_room_cat.php%20id%20SQL%20inject.md - https://vuldb.com/?id.202982
CVE ID: CVE-2022-2264 State: PUBLISHED Published: 2022-07-01T00:00:00 Last Updated: 2024-08-03T00:32:09.533Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2241c773-02c9-4708-b63e-54aef99afa6c - https://github.com/vim/vim/commit/d25f003342aca9889067f2e839963dfeccf1fe05 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/ - https://lists.fedoraproject.org/archives/l
nnounce%40lists.fedoraproject.org/message/UXPO5EHDV6J4B27E65DOQGZFELUFPRSK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/43Y3VJPOTTY3NTREDIFUPITM2POG4ZLP/ - https://security.gentoo.org/glsa/202208-32 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2265 State: PUBLISHED Published: 2022-09-21T13:45:18.149Z Last Updated: 2025-05-29T18:29:02.880Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Çekino Bilgi Teknolojileri Products: Çekino Bilgi Teknolojileri Problem Types: CWE-35 Description: The Identity and Directory Management System developed by Çekino Bilgi Teknolojileri before version 2.1.25 has an unauthenticated Path traversal vulnerability. This has been fixed in the version 2.1.25 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-22-0636
CVE ID: CVE-2022-2266 State: PUBLISHED Published: 2022-09-22T08:50:10.045Z Last Updated: 2025-05-22T18:30:13.365Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Yordam Bilgi Teknolojileri Products: Yordam Bilgi Teknolojileri Problem Types: CWE-79 Description: University Library Automation System developed by Yordam Bilgi Teknolojileri before version 19.2 has an unauthenticated Reflected XSS vulnerability. This has been fixed in the version 19.2 Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.usom.gov.tr/bildirim/tr-22-0637
CVE ID: CVE-2022-2267 State: PUBLISHED Published: 2022-08-29T17:15:35 Last Updated: 2024-08-03T00:32:09.262Z Vendors: Unknown Products: Mailchimp for WooCommerce Problem Types: CWE-918 Description: The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e3bd9f8c-919a-40af-9e80-607573e71870
CVE ID: CVE-2022-2268 State: PUBLISHED Published: 2022-07-04T13:06:04 Last Updated: 2024-08-03T00:32:09.466Z Vendors: Unknown Products: Import any XML or CSV File to WordPress Problem Types: CWE-434 Description: The Import any XML or CSV File to WordPress plugin before 3.6.8 accepts all zip files and automatically extracts the zip file without validating the extracted file type. Allowing high privilege users such as admin to upload an arbitrary file like PHP, leading to RCE Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/578093db-a025-4148-8c4b-ec2df31743f7
CVE ID: CVE-2022-2269 State: PUBLISHED Published: 2022-08-08T13:46:18 Last Updated: 2024-08-03T00:32:09.316Z Vendors: Unknown Products: Website File Changes Monitor Problem Types: CWE-89 Description: The Website File Changes Monitor WordPress plugin before 1.8.3 does not sanitise and escape user input before using it in a SQL statement via an action available to users with the manage_options capability (by default admins), leading to an SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bb348c92-d7e3-4a75-98aa-dd1c463bfd65
CVE ID: CVE-2022-2270 State: PUBLISHED Published: 2022-07-01T16:31:47 Last Updated: 2024-08-03T00:32:09.374Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 12.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab was leaking Conan packages names due to incorrect permissions verification. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/223074 - https://hackerone.com/reports/90147
gram Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/223074 - https://hackerone.com/reports/901473 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2270.json
CVE ID: CVE-2022-2271 State: PUBLISHED Published: 2022-09-05T12:35:18 Last Updated: 2024-08-03T00:32:09.545Z Vendors: Unknown Products: WP Database Backup Problem Types: CWE-79 Description: The WP Database Backup WordPress plugin before 5.9 does not escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b064940f-9614-4b7b-b2c4-e79528746833
CVE ID: CVE-2022-2272 State: PUBLISHED Published: 2022-08-03T15:20:59 Last Updated: 2024-08-03T00:32:09.547Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sante Products: PACS Server Problem Types: CWE-89 Description: This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is not required to exploit this vulnerability. The specific flaw exists within the processing of calls to the login endpoint. When parsing the username element, the process does not properly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerabilit
rly validate a user-supplied string before using it to construct SQL queries. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-17331. Additional Analyst Notes: - CVE Program Container: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-955/