Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1599 State: PUBLISHED Published: 2022-07-11T12:56:01 Last Updated: 2024-08-03T00:10:03.993Z Vendors: Unknown Products: Admin Management Xtended Problem Types: CWE-352 Description: The Admin Management Xtended WordPress plugin before 2.4.5 does not have CSRF checks in some of its AJAX actions, allowing attackers to make a logged users with the right capabilities to call them. This can lead to changes in post status (draft, published), slug, post date, comment status (enabled, disabled) and more. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4a36e876-7e3b-4a81-9f16-9ff5fbb20dd6
CVE ID: CVE-2022-1600 State: PUBLISHED Published: 2022-08-01T12:48:14 Last Updated: 2024-08-03T00:10:03.637Z Vendors: Unknown Products: YOP Poll Problem Types: CWE-639 Description: The YOP Poll WordPress plugin before 6.4.3 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations to vote in certain situations. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2b7445fd-0992-47cd-9a48-f5f18d8171f7
CVE ID: CVE-2022-1601 State: PUBLISHED Published: 2023-08-30T14:22:04.318Z Last Updated: 2024-10-01T18:43:13.026Z Vendors: Unknown Products: User Access Manager Problem Types: CWE-290 Authentication Bypass by Spoofing Description: The User Access Manager WordPress plugin before 2.2.18 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible for attackers to access restricted content in certain situations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/f6d3408c-2ceb-4a89-822b-13f5272a5fce
CVE ID: CVE-2022-1602 State: PUBLISHED Published: 2022-09-13T14:51:42 Last Updated: 2024-08-03T00:10:03.501Z Vendors: n/a Products: HP ThinPro OS Problem Types: Unauthorized modification of certain files Description: A potential security vulnerability has been identified in HP ThinPro 7.2 Service Pack 8 (SP8). The security vulnerability in SP8 is not remedied after upgrading from SP8 to Service Pack 9 (SP9). HP has released Service Pack 10 (SP10) to remediate the potential vulnerability introduced in SP8. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_6415074-6415171-16/hpsbhf03789
CVE ID: CVE-2022-1603 State: PUBLISHED Published: 2022-06-20T10:25:51 Last Updated: 2024-08-03T00:10:03.703Z Vendors: Unknown Products: Mail Subscribe List Problem Types: CWE-352 Description: The Mail Subscribe List WordPress plugin before 2.1.4 does not have CSRF check in place when deleting subscribed users, which could allow attackers to make a logged in admin perform such action and delete arbitrary users from the subscribed list Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0e12ba6f-a86f-4cc6-9013-8a15586098d0
CVE ID: CVE-2022-1604 State: PUBLISHED Published: 2022-06-13T12:42:06 Last Updated: 2024-08-03T00:10:03.757Z Vendors: Unknown Products: MailerLite – Signup forms (official) Problem Types: CWE-79 Description: The MailerLite WordPress plugin before 1.5.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/557c1c49-7195-4085-b67a-9fd8aca57845
CVE ID: CVE-2022-1605 State: PUBLISHED Published: 2022-06-13T12:42:08 Last Updated: 2024-08-03T00:10:03.598Z Vendors: Unknown Products: Email Users Problem Types: CWE-352 Description: The Email Users WordPress plugin through 4.8.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and change the notification settings of arbitrary users Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a1b69615-690a-423b-afdf-729dcd32bc2f
CVE ID: CVE-2022-1606 State: PUBLISHED Published: 2022-11-30T14:05:15.099Z Last Updated: 2024-08-28T18:09:14.648Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: M-Files Products: M-Files Server Problem Types: CWE-269 Description: Incorrect privilege assignment in M-Files Server versions before 22.3.11164.0 and before 22.3.11237.1 allows user to read unmanaged objects. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.m-files.com/about/trust-center/security-advisories/cve-2022-1606/ - https://product.m-files.com/security-advisories/cve-2022-1606/
CVE ID: CVE-2022-1607 State: PUBLISHED Published: 2023-02-24T04:49:49.418Z Last Updated: 2025-03-11T15:54:58.100Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: ABB Products: Pulsar Plus System Controller NE843_S , Infinity DC Power Plant Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in ABB Pulsar Plus System Controller NE843_S, ABB Infinity DC Power Plant allows Cross Site Request Forgery.This issue affects Pulsar Plus System Controller NE843_S : comcode 150042936; Infinity DC Power Plant: H5692448 G104 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415. Additional Analyst Notes: - CVE Program Container: - CISA ADP
04 G842 G224L G630-4 G451C(2) G461(2) – comcode 150047415. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=9AKK108467A6732&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-1608 State: PUBLISHED Published: 2022-06-13T12:42:09 Last Updated: 2024-08-03T00:10:03.660Z Vendors: Unknown Products: OnePress Social Locker Problem Types: CWE-352 Description: The OnePress Social Locker WordPress plugin through 5.6.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/56d2d55b-bd09-47af-988c-7f47eec4151f
CVE ID: CVE-2022-1609 State: PUBLISHED Published: 2024-01-16T15:52:21.658Z Last Updated: 2025-06-02T15:10:34.673Z Vendors: Unknown Products: school-management-pro Problem Types: CWE-94 Improper Control of Generation of Code ('Code Injection') Description: The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e2d546c9-85b6-47a4-b951-781b9ae5d0f2/
CVE ID: CVE-2022-1610 State: PUBLISHED Published: 2022-06-20T10:25:53 Last Updated: 2024-08-03T00:10:03.683Z Vendors: Unknown Products: Seamless Donations: A Platform for Global Fundraising and Rebuilding using Stripe and PayPal Problem Types: CWE-352 Description: The Seamless Donations WordPress plugin before 5.1.9 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/88014da6-6179-4527-8f67-fbb610804d93
CVE ID: CVE-2022-1611 State: PUBLISHED Published: 2022-05-30T08:36:06 Last Updated: 2024-08-03T00:10:03.748Z Vendors: Unknown Products: Bulk Page Creator Problem Types: CWE-352 Description: The Bulk Page Creator WordPress plugin before 1.1.4 does not protect its page creation functionalities with nonce checks, which makes them vulnerable to CSRF. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3843b867-7784-4976-b5ab-8a1e7d45618a
CVE ID: CVE-2022-1612 State: PUBLISHED Published: 2022-06-13T12:42:11 Last Updated: 2024-08-03T00:10:03.626Z Vendors: Unknown Products: Webriti SMTP Mail Problem Types: CWE-352 Description: The Webriti SMTP Mail WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a8cec792-6435-4047-bca8-597c104dbc1f
CVE ID: CVE-2022-1613 State: PUBLISHED Published: 2022-09-26T12:35:30.000Z Last Updated: 2025-05-21T19:26:08.662Z Vendors: Unknown Products: Restricted Site Access Problem Types: CWE-639 Description: The Restricted Site Access WordPress plugin before 7.3.2 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based limitations in certain situations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c03863ef-9ac9-402b-8f8d-9559c9988e2b
CVE ID: CVE-2022-1614 State: PUBLISHED Published: 2022-06-20T10:25:54 Last Updated: 2024-08-03T00:10:03.664Z Vendors: Unknown Products: WP-EMail Problem Types: CWE-639 Description: The WP-EMail WordPress plugin before 2.69.0 prioritizes getting a visitor's IP from certain HTTP headers over PHP's REMOTE_ADDR, which makes it possible to bypass IP-based anti-spamming restrictions. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a5940d0b-6b88-4418-87e2-02c0897bc2f1
CVE ID: CVE-2022-1615 State: PUBLISHED Published: 2022-09-01T00:00:00 Last Updated: 2024-08-03T00:10:03.686Z Vendors: n/a Products: Samba Problem Types: CWE-330 Description: In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.samba.org/show_bug.cgi?id=15103 - https://gitlab.com/samba-team/samba/-/merge_requests/2644 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTTOLTHUHOV4SHCHCB5TAA4FQVJAWN4P/ - https://security.gentoo.org/glsa/202309-06
CVE ID: CVE-2022-1616 State: PUBLISHED Published: 2022-05-07T00:00:00.000Z Last Updated: 2025-11-03T20:34:35.839Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use after free in append_command in GitHub repository vim/vim prior to 8.2.4895. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/40f1d75f-fb2f-4281-b585-a41017f217e2 - https://github.com/vim/vim/commit/d88934406c5375d88f8f1b65331c9f0cab68cc6c - https://lists.fedoraproject.org/a
7f217e2 - https://github.com/vim/vim/commit/d88934406c5375d88f8f1b65331c9f0cab68cc6c - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6BY5P7ERZS7KXSBCGFCOXLMLGWUUJIH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUN33257RUM4RS2I4GZETKFSAXPETATG/ - https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://secl
rg/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1617 State: PUBLISHED Published: 2024-01-16T15:52:49.812Z Last Updated: 2025-06-11T17:14:19.258Z Vendors: Unknown Products: WP-Invoice Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in some of them, allowing attacker to make a logged in admin change them and add XSS payload in them Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7e40e506-ad02-44ca-9d21-3634f3907aad/
CVE ID: CVE-2022-1618 State: PUBLISHED Published: 2024-01-16T15:52:50.183Z Last Updated: 2024-08-29T14:32:10.834Z Vendors: Unknown Products: Coru LFMember Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The Coru LFMember WordPress plugin through 1.0.2 does not have CSRF check in place when adding a new game, and is lacking sanitisation as well as escaping in their settings, allowing attacker to make a logged in admin add an arbitrary game with XSS payloads Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ddafcab2-b5db-4839-8ae1-188383f4250d/
CVE ID: CVE-2022-1619 State: PUBLISHED Published: 2022-05-08T00:00:00 Last Updated: 2024-08-03T00:10:03.595Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in function cmdline_erase_chars in GitHub repository vim/vim prior to 8.2.4899. This vulnerabilities are capable of crashing software, modify memory, and possible remote execution Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b3200483-624e-4c76-a070-e246f62a7450 - https://github.com/vim/vim/commit/ef02f16609ff0a26ffc6e20263523424980898fe - https://lists.fedoraproject.org/arch
7450 - https://github.com/vim/vim/commit/ef02f16609ff0a26ffc6e20263523424980898fe - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6BY5P7ERZS7KXSBCGFCOXLMLGWUUJIH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUN33257RUM4RS2I4GZETKFSAXPETATG/ - https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI/ - https://security.gentoo.org/glsa/202208-32 - https://security.netapp.com/advisory/ntap-20220930-0007/ - https://support.apple.com/kb/HT213488 - http
glsa/202208-32 - https://security.netapp.com/advisory/ntap-20220930-0007/ - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1620 State: PUBLISHED Published: 2022-05-08T00:00:00 Last Updated: 2024-08-03T00:10:03.680Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-476 Description: NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7a4c59f3-fcc0-4496-995d-5ca6acd2da51 - https://github.com/vim/vim/commit/8e4b7
References: - https://huntr.dev/bounties/7a4c59f3-fcc0-4496-995d-5ca6acd2da51 - https://github.com/vim/vim/commit/8e4b76da1d7e987d43ca960dfbc372d1c617466f - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/A6BY5P7ERZS7KXSBCGFCOXLMLGWUUJIH/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JUN33257RUM4RS2I4GZETKFSAXPETATG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://se
.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1621 State: PUBLISHED Published: 2022-05-09T00:00:00 Last Updated: 2024-08-03T00:10:03.947Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap buffer overflow in vim_strncpy find_word in GitHub repository vim/vim prior to 8.2.4919. This vulnerability is capable of crashing software, Bypass Protection Mechanism, Modify Memory, and possible remote execution Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/520ce714-bfd2-4646-9458-f52cd22bb2fb - https://github.com/vim/vim/commit/7c824682d2028432ee082703ef0ab399867a089b - https://lists.debian.org/
58-f52cd22bb2fb - https://github.com/vim/vim/commit/7c824682d2028432ee082703ef0ab399867a089b - https://lists.debian.org/debian-lts-announce/2022/05/msg00022.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HIP7KG7TVS5YF3QREAY2GOGUT3YUBZAI/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1622 State: PUBLISHED Published: 2022-05-11T00:00:00 Last Updated: 2024-08-03T00:10:03.771Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Out-of-bounds read in libtiff Description: LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:619, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/410 - https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6
nces: - https://gitlab.com/libtiff/libtiff/-/issues/410 - https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1622.json - https://security.netapp.com/advisory/ntap-20220616-0005/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXAFOP6QQRNZD3HPZ6BMCEZZOM4YIZMK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7IWZTB4J2N4F5OR5QY4VHDSKWKZSWN3/ - https://support.apple.com/kb/HT213443 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213446 - https://support.apple.com/kb/HT2134
43 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213446 - https://support.apple.com/kb/HT213488 - https://support.apple.com/kb/HT213486 - https://support.apple.com/kb/HT213487 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/39
CVE ID: CVE-2022-1623 State: PUBLISHED Published: 2022-05-11T00:00:00 Last Updated: 2024-08-03T00:10:03.766Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: libtiff Products: libtiff Problem Types: Out-of-bounds read in libtiff Description: LibTIFF master branch has an out-of-bounds read in LZWDecode in libtiff/tif_lzw.c:624, allowing attackers to cause a denial-of-service via a crafted tiff file. For users that compile libtiff from sources, the fix is available with commit b4e79bfa. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/libtiff/libtiff/-/issues/410 - https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6
nces: - https://gitlab.com/libtiff/libtiff/-/issues/410 - https://gitlab.com/libtiff/libtiff/-/commit/b4e79bfa0c7d2d08f6f1e7ec38143fc8cb11394a - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1623.json - https://security.netapp.com/advisory/ntap-20220616-0005/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UXAFOP6QQRNZD3HPZ6BMCEZZOM4YIZMK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C7IWZTB4J2N4F5OR5QY4VHDSKWKZSWN3/ - https://security.gentoo.org/glsa/202210-10 - https://www.debian.org/security/2023/dsa-5333
CVE ID: CVE-2022-1624 State: PUBLISHED Published: 2022-06-13T12:42:12 Last Updated: 2024-08-03T00:10:03.893Z Vendors: Unknown Products: Latest Tweets Widget Problem Types: CWE-352 Description: The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/06e547fd-cddf-4294-87be-54f58d6138a7
CVE ID: CVE-2022-1625 State: PUBLISHED Published: 2022-06-27T08:57:11 Last Updated: 2024-08-03T00:10:03.782Z Vendors: Unknown Products: New User Approve Problem Types: CWE-352 Description: The New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding invitation codes, which could allow attackers to add invitation codes (for bypassing the provided restrictions) and to change plugin settings by tricking admin users into visiting specially crafted websites. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e1693318-900c-47f1-bb77-008b0d33327f
CVE ID: CVE-2022-1626 State: PUBLISHED Published: 2022-07-11T12:56:06 Last Updated: 2024-08-03T00:10:03.787Z Vendors: Unknown Products: Sharebar Problem Types: CWE-352 Description: The Sharebar WordPress plugin through 1.4.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and also lead to Stored Cross-Site Scripting issue due to the lack of sanitisation and escaping in some of them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3d1f90d9-45da-42f8-93f8-15c8a4ff90ca
CVE ID: CVE-2022-1627 State: PUBLISHED Published: 2022-06-27T08:57:17 Last Updated: 2024-08-03T00:10:03.670Z Vendors: Unknown Products: My Private Site Problem Types: CWE-352 Description: The My Private Site WordPress plugin before 3.0.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/70ce3654-8fd9-4c33-b594-fac13ec26137
CVE ID: CVE-2022-1628 State: PUBLISHED Published: 2022-09-06T17:18:55.000Z Last Updated: 2025-01-31T18:51:59.157Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: coleds Products: Simple SEO Problem Types: CWE-79 Description: The Simple SEO plugin for WordPress is vulnerable to attribute-based stored Cross-Site Scripting in versions up to, and including 1.7.91, due to insufficient sanitization or escaping on the SEO social and standard title parameters. This can be exploited by authenticated users with Contributor and above permissions to inject arbitrary web scripts into posts/pages that execute whenever an administrator access the page. Additional Analyst N
ject arbitrary web scripts into posts/pages that execute whenever an administrator access the page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2754807%40cds-simple-seo&new=2754807%40cds-simple-seo&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1628