Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
r authenticated attackers with access to the Beaver Builder editor to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2517 - https://www.wpbeaverbuilder.com/change-logs/
CVE ID: CVE-2022-2518 State: PUBLISHED Published: 2022-09-06T17:18:58.000Z Last Updated: 2025-05-05T16:18:09.859Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: dholovnia Products: Stockists Manager for Woocommerce Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Stockists Manager for Woocommerce plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.2.1. This is due to missing nonce validation on the stockist_settings_main() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they ca
nticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/5b5e0204-4a05-45c1-833a-c2e4016d9830?source=cve - https://wordpress.org/plugins/stockists-manager/ - https://plugins.trac.wordpress.org/browser/stockists-manager/trunk/stockist_settings.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2518
CVE ID: CVE-2022-2519 State: PUBLISHED Published: 2022-08-31T00:00:00 Last Updated: 2024-08-03T00:39:08.088Z Vendors: n/a Products: libtiff Problem Types: CWE-415 Description: There is a double free or corruption in rotateImage() at tiffcrop.c:8839 found in libtiff 4.4.0rc1 Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/423 - https://gitlab.com/libtiff/libtiff/-/merge_requests/378 - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-2520 State: PUBLISHED Published: 2022-08-31T00:00:00 Last Updated: 2024-08-03T00:39:07.943Z Vendors: n/a Products: libtiff Problem Types: CWE-131 Description: A flaw was found in libtiff 4.4.0rc1. There is a sysmalloc assertion fail in rotateImage() at tiffcrop.c:8621 that can cause program crash when reading a crafted input. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/424 - https://gitlab.com/libtiff/libtiff/-/merge_requests/378 - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-2521 State: PUBLISHED Published: 2022-08-31T00:00:00 Last Updated: 2024-08-03T00:39:08.062Z Vendors: n/a Products: libtiff Problem Types: CWE-763 Description: It was found in libtiff 4.4.0rc1 that there is an invalid pointer free operation in TIFFClose() at tif_close.c:131 called by tiffcrop.c:2522 that can cause a program crash and denial of service while processing crafted input. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/422 - https://gitlab.com/libtiff/libtiff/-/merge_requests/378 - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-2522 State: PUBLISHED Published: 2022-07-25T00:00:00 Last Updated: 2024-08-03T00:39:08.000Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0061. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22 - https://github.com/vim/vim/commit/5fa9f23a63651a8abdb074b4fc2ec9b1adc6b089 - https://github.com/vim/vim/commit/b9e717367c395490149495cf375911b5d9de889e - https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22/ - https://security.gentoo.or
149495cf375911b5d9de889e - https://huntr.dev/bounties/3a2d83af-9542-4d93-8784-98b115135a22/ - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-2523 State: PUBLISHED Published: 2022-07-25T13:43:39 Last Updated: 2024-08-03T00:39:08.063Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: beancount Products: beancount/fava Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository beancount/fava prior to 1.22.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2a1802d8-1c2e-4919-96a7-d4dcf7ffcf8f - https://github.com/beancount/fava/commit/dccfb6a2f4567f35ce2e9a78e24f92ebf946bc9b
CVE ID: CVE-2022-2525 State: PUBLISHED Published: 2023-04-15T00:00:00.000Z Last Updated: 2025-02-06T16:02:55.497Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: janeczku Products: janeczku/calibre-web Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository janeczku/calibre-web prior to 0.6.20. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9ff87820-c14c-4454-9764-406496254ef0 - https://github.com/janeczku/calibre-web/commit/49e4f540c9b204c7e39b3c27ceadecd83ed60e7e
CVE ID: CVE-2022-2526 State: PUBLISHED Published: 2022-09-09T00:00:00 Last Updated: 2024-08-03T00:39:08.031Z Vendors: n/a Products: systemd-resolved Problem Types: CWE-416 Description: A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and dns_stream_complete() function in 'resolved-dns-stream.c' not incrementing the reference counting for the DnsStream object. Therefore, other functions and callbacks called can dereference the DNSStream object, causing the use-after-free when the reference is still used later. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/systemd/systemd/commit/d973d94dec349fb676fdd
al Analyst Notes: - CVE Program Container: References: - https://github.com/systemd/systemd/commit/d973d94dec349fb676fdd844f6fe2ada3538f27c - https://security.netapp.com/advisory/ntap-20221111-0005/
CVE ID: CVE-2022-2527 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T19:34:35.460Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue in Incident Timelines has been discovered in GitLab CE/EE affecting all versions starting from 14.9 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2.which allowed an authenticated attacker to inject arbitrary content. A victim interacting with this content could lead to arbitrary requests.
nticated attacker to inject arbitrary content. A victim interacting with this content could lead to arbitrary requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/368676 - https://hackerone.com/reports/1647446 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2527.json
CVE ID: CVE-2022-2528 State: PUBLISHED Published: 2022-09-09T07:50:08 Last Updated: 2024-08-03T00:39:08.062Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Broken Access Control Description: In affected versions of Octopus Deploy it is possible to upload a package to built-in feed with insufficient permissions after re-indexing packages. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/post/2022/sa2022-13/
CVE ID: CVE-2022-2529 State: PUBLISHED Published: 2022-09-30T10:45:11.000Z Last Updated: 2025-05-20T16:03:07.474Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Cloudflare Products: goflow Problem Types: CWE-20, CWE-400 Description: sflow decode package does not employ sufficient packet sanitisation which can lead to a denial of service attack. Attackers can craft malformed packets causing the process to consume large amounts of memory resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/cloudflare/goflow/security/advisories/GHSA-9rpw-2h95-666c
CVE ID: CVE-2022-2530 State: REJECTED Published: N/A Last Updated: 2022-12-30T00:00:00 Description: No description available.
CVE ID: CVE-2022-2531 State: PUBLISHED Published: 2022-08-05T15:09:05 Last Updated: 2024-08-03T00:39:08.030Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper limitation of a pathname to a restricted directory ('path traversal') in GitLab Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.5 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was not performing correct authentication on Grafana API under specific conditions allowing unauthenticated users to perform queries through a path traversal vulnerabil
fana API under specific conditions allowing unauthenticated users to perform queries through a path traversal vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/364252 - https://hackerone.com/reports/1566306 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2531.json
CVE ID: CVE-2022-2532 State: PUBLISHED Published: 2022-08-22T15:03:21 Last Updated: 2024-08-03T00:39:07.947Z Vendors: Unknown Products: Feed Them Social – for Twitter feed, Youtube and more Problem Types: CWE-79 Description: The Feed Them Social WordPress plugin before 3.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/07278b12-58e6-4230-b2fb-19237e9785d8
CVE ID: CVE-2022-2533 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T19:32:13.138Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 12.10 before 15.1.6, all versions starting from 15.2 before 15.2.4, all versions starting from 15.3 before 15.3.2. GitLab was not performing correct authentication with some Package Registries when IP address restrictions were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location. Addi
were configured, allowing an attacker already in possession of a valid Deploy Token to misuse it from any location. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/363863 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2533.json
CVE ID: CVE-2022-2534 State: PUBLISHED Published: 2022-08-05T15:11:53 Last Updated: 2024-08-03T00:39:08.000Z Severity: LOW (CVSS 2.2 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 9.3 before 15.0.5, all versions starting from 15.1 before 15.1.4, all versions starting from 15.2 before 15.2.1. GitLab was returning contributor emails due to improper data handling in the Datadog integration. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/361654 - https://gitlab.c
st Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/361654 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2534.json
CVE ID: CVE-2022-2535 State: PUBLISHED Published: 2022-08-15T08:38:10 Last Updated: 2024-08-03T00:39:08.017Z Vendors: Unknown Products: SearchWP Live Ajax Search Problem Types: CWE-639 Description: The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0e13c375-044c-4c2e-ab8e-48cb89d90d02
CVE ID: CVE-2022-2536 State: PUBLISHED Published: 2022-12-15T04:01:45.987Z Last Updated: 2025-01-23T20:29:18.923Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) Vendors: oferwald Products: Transposh WordPress Translation Problem Types: CWE-285 Improper Authorization Description: The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient validation of settings on the 'tp_translation' AJAX action which makes it possible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note thi
sible for unauthenticated attackers to bypass any restrictions and influence the data shown on the site. Please note this is a separate issue from CVE-2022-2461. Notes from the researcher: When installed Transposh comes with a set of pre-configured options, one of these is the "Who can translate" setting under the "Settings" tab. However, this option is largely ignored, if Transposh has enabled its "autotranslate" feature (it's enabled by default) and the HTTP POST parameter "sr0" is larger than 0. This is caused by a faulty validation in "wp/transposh_db.php." Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vul
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c774b520-9d9f-4102-8564-49673d5ae1e6 - https://www.rcesecurity.com/2022/07/WordPress-Transposh-Exploiting-a-Blind-SQL-Injection-via-XSS/ - https://plugins.trac.wordpress.org/browser/transposh-translation-filter-for-wordpress/trunk/transposh.php?rev=2682425#L1989 - https://packetstormsecurity.com/files/168120/wptransposh1081-authz.txt - https://www.exploitalert.com/view-details.html?id=38949 - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-2536 - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-2536.txt
CVE ID: CVE-2022-2537 State: PUBLISHED Published: 2022-08-29T17:15:36 Last Updated: 2024-08-03T00:39:08.074Z Vendors: Unknown Products: WooCommerce PDF Invoices & Packing Slips Problem Types: CWE-79 Description: The WooCommerce PDF Invoices & Packing Slips WordPress plugin before 3.0.1 does not sanitise and escape some parameters before outputting them back in an attributes of an admin page, leading to Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ae613148-85d8-47a0-952d-49c29584676f
CVE ID: CVE-2022-2538 State: PUBLISHED Published: 2022-08-29T17:15:36 Last Updated: 2024-08-03T00:39:08.067Z Vendors: Unknown Products: WP Hide & Security Enhancer Problem Types: CWE-79 Description: The WP Hide & Security Enhancer WordPress plugin before 1.8 does not escape a parameter before outputting it back in an attribute of a backend page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/afa1e159-30bc-42d2-b3f8-8c868b113d3e
CVE ID: CVE-2022-2539 State: PUBLISHED Published: 2022-08-05T15:09:58 Last Updated: 2024-08-03T00:39:08.068Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.6 prior to 15.0.5, 15.1 prior to 15.1.4, and 15.2 prior to 15.2.1, allowed a project member to filter issues by contact and organization. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/364315 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-2539.json
CVE ID: CVE-2022-2540 State: PUBLISHED Published: 2022-09-06T17:18:59 Last Updated: 2024-08-03T00:39:08.050Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: adambard Products: Link Optimizer Lite Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 1.4.5. This is due to missing nonce validation on the admin_page function found in the ~/admin.php file. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they
thenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ca64692b-b194-4ceb-975e-72e4041252f2?source=cve - https://plugins.trac.wordpress.org/browser/link-optimizer-lite/1.4.5/admin.php#L20 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2540
CVE ID: CVE-2022-2541 State: PUBLISHED Published: 2022-09-06T17:18:59.000Z Last Updated: 2025-05-05T16:18:00.544Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: gcornelisse Products: uContext for Amazon Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The uContext for Amazon plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the ~/app/sites/ajax/actions/keyword_save.php file that is called via the doAjax() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious
ax() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0f7c43d4-cf21-4324-bc77-50bdc2c24661?source=cve - https://plugins.trac.wordpress.org/browser/ucontext-for-amazon/trunk/app/sites/ajax/actions/keyword_save.php - https://plugins.trac.wordpress.org/browser/ucontext-for-amazon/trunk/app/Ucontext4a_Ajax.php - https://www.wordfence.com/vulnerability-advi
c.wordpress.org/browser/ucontext-for-amazon/trunk/app/Ucontext4a_Ajax.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2541
CVE ID: CVE-2022-2542 State: PUBLISHED Published: 2022-09-06T17:18:59.000Z Last Updated: 2025-05-05T16:17:51.090Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: gcornelisse Products: uContext for Clickbank Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The uContext for Clickbank plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 3.9.1. This is due to missing nonce validation in the ~/app/sites/ajax/actions/keyword_save.php file that is called via the doAjax() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject mal
e doAjax() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/4af83d4b-2eae-481f-b3fd-d5bcacc1d709?source=cve - https://plugins.trac.wordpress.org/browser/ucontext/trunk/app/Ucontext_Ajax.php - https://plugins.trac.wordpress.org/browser/ucontext/trunk/app/sites/ajax/actions/keyword_save.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2
/ucontext/trunk/app/sites/ajax/actions/keyword_save.php - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-2542
CVE ID: CVE-2022-2543 State: PUBLISHED Published: 2022-09-05T12:35:20 Last Updated: 2024-08-03T00:39:07.976Z Vendors: Unknown Products: Visual Portfolio, Photo Gallery & Post Grid Problem Types: CWE-862 Description: The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5dc8b671-f2fa-47be-8664-9005c4fdbea8
CVE ID: CVE-2022-2544 State: PUBLISHED Published: 2022-08-22T15:03:39 Last Updated: 2024-08-03T00:39:08.036Z Vendors: Unknown Products: Ninja Job Board – Ultimate WordPress Job Board Plugin Problem Types: CWE-425 Description: The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a9bcc68c-eeda-4647-8463-e7e136733053 - https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=
- https://plugins.trac.wordpress.org/changeset/2758420/ninja-job-board/trunk/includes/Classes/File/FileHandler.php?old=2126467&old_path=ninja-job-board%2Ftrunk%2Fincludes%2FClasses%2FFile%2FFileHandler.php
CVE ID: CVE-2022-2546 State: PUBLISHED Published: 2023-02-02T08:28:46.865Z Last Updated: 2025-03-26T14:24:03.385Z Vendors: Unknown Products: All-in-One WP Migration Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wm_export AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response that will be executed in the victims session. Note: This requires knowledge of a static secret key Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
requires knowledge of a static secret key Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f84920e4-a1fe-47cf-9ba5-731989c70f58
CVE ID: CVE-2022-2547 State: PUBLISHED Published: 2022-08-17T20:06:38.000Z Last Updated: 2025-04-16T16:13:29.833Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Softing Products: Secure Integration Server Problem Types: CWE-476 Description: A crafted HTTP packet without a content-type header can create a denial-of-service condition in Softing Secure Integration Server V1.22. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://industrial.softing.com/fileadmin/psirt/downloads/syt-2022-4.html - https://www.cisa.gov/uscert/ics/advisories/icsa-22-228-04