Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0289 State: PUBLISHED Published: 2022-02-12T01:35:35 Last Updated: 2024-08-02T23:25:39.974Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Safe browsing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1284367 - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - http://packetstormsecurity.com/files/166547/Chrome-safe_browsing-ThreatDetails-OnReceivedThreatDOMDetails-Use-After-Free.html
CVE ID: CVE-2022-0290 State: PUBLISHED Published: 2022-02-12T01:35:37 Last Updated: 2024-08-02T23:25:39.655Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Site isolation in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1260134 - http://packetstormsecurity.com/files/166080/Chrome-RenderFrameHostImpl-Use-After-Free.html
CVE ID: CVE-2022-0291 State: PUBLISHED Published: 2022-02-12T01:35:38 Last Updated: 2024-08-02T23:25:40.522Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Storage in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1281084
CVE ID: CVE-2022-0292 State: PUBLISHED Published: 2022-02-12T01:35:40 Last Updated: 2024-08-02T23:25:40.064Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Fenced Frames in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass navigation restrictions via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1270358
CVE ID: CVE-2022-0293 State: PUBLISHED Published: 2022-02-12T01:35:41 Last Updated: 2024-08-02T23:25:40.193Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Web packaging in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1283371
CVE ID: CVE-2022-0294 State: PUBLISHED Published: 2022-02-12T01:35:43 Last Updated: 2024-08-02T23:25:40.520Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Push messaging in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1273017
CVE ID: CVE-2022-0295 State: PUBLISHED Published: 2022-02-12T01:35:44 Last Updated: 2024-08-02T23:25:39.765Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1278180
CVE ID: CVE-2022-0296 State: PUBLISHED Published: 2022-02-12T01:35:46 Last Updated: 2024-08-02T23:25:39.949Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Printing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced the user to engage is specific user interactions to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1283375
CVE ID: CVE-2022-0297 State: PUBLISHED Published: 2022-02-12T01:35:47 Last Updated: 2024-08-02T23:25:40.087Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Vulkan in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1274316
CVE ID: CVE-2022-0298 State: PUBLISHED Published: 2022-02-12T01:35:49 Last Updated: 2024-08-02T23:25:40.506Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Scheduling in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1212957
CVE ID: CVE-2022-0300 State: PUBLISHED Published: 2022-02-12T01:35:50 Last Updated: 2024-08-02T23:25:40.389Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Text Input Method Editor in Google Chrome on Android prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1275438
CVE ID: CVE-2022-0301 State: PUBLISHED Published: 2022-02-12T01:35:52 Last Updated: 2024-08-02T23:25:39.523Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in DevTools in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1276331
CVE ID: CVE-2022-0302 State: PUBLISHED Published: 2022-02-12T01:35:53 Last Updated: 2024-08-02T23:25:39.827Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Omnibox in Google Chrome prior to 97.0.4692.99 allowed an attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1278613
CVE ID: CVE-2022-0303 State: REJECTED Published: N/A Last Updated: 2025-01-17T22:20:15.391Z Description: No description available.
CVE ID: CVE-2022-0304 State: PUBLISHED Published: 2022-02-12T01:35:55 Last Updated: 2024-08-02T23:25:40.389Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Bookmarks in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1282118
CVE ID: CVE-2022-0305 State: PUBLISHED Published: 2022-02-12T01:35:56 Last Updated: 2024-08-02T23:25:39.800Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Service Worker API in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1282354
CVE ID: CVE-2022-0306 State: PUBLISHED Published: 2022-02-12T01:35:57 Last Updated: 2024-08-02T23:25:39.887Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1283198 - http://packetstormsecurity.com/files/166367/Chrome-chrome_pdf-PDFiumEngine-RequestThumbnail-Heap-Buffer-Overflow.html
CVE ID: CVE-2022-0307 State: PUBLISHED Published: 2022-02-12T01:35:59 Last Updated: 2024-08-02T23:25:40.175Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Optimization Guide in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1281881
CVE ID: CVE-2022-0308 State: PUBLISHED Published: 2022-02-12T01:36:01 Last Updated: 2024-08-02T23:25:40.426Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Data Transfer in Google Chrome on Chrome OS prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1282480
CVE ID: CVE-2022-0309 State: PUBLISHED Published: 2022-02-12T01:36:02 Last Updated: 2024-08-02T23:25:40.110Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in Autofill in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1240472
CVE ID: CVE-2022-0310 State: PUBLISHED Published: 2022-02-12T01:36:04 Last Updated: 2024-08-02T23:25:40.125Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via specific user interactions. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1283805
CVE ID: CVE-2022-0311 State: PUBLISHED Published: 2022-02-12T01:36:05 Last Updated: 2024-08-02T23:25:40.493Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in Task Manager in Google Chrome prior to 97.0.4692.99 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/01/stable-channel-update-for-desktop_19.html - https://crbug.com/1283807
CVE ID: CVE-2022-0313 State: PUBLISHED Published: 2022-02-21T10:46:15 Last Updated: 2024-08-02T23:25:40.041Z Vendors: Unknown Products: Float menu – awesome floating side menu Problem Types: CWE-352 Description: The Float menu WordPress plugin before 4.3.1 does not have CSRF check in place when deleting menu, which could allow attackers to make a logged in admin delete them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1ce6c8f4-6f4b-4d56-8d11-43355ef32e8c - https://plugins.trac.wordpress.org/changeset/2661431
CVE ID: CVE-2022-0314 State: PUBLISHED Published: 2022-04-11T14:40:43 Last Updated: 2024-08-02T23:25:39.813Z Vendors: Unknown Products: Nimble Page Builder Problem Types: CWE-79 Description: The Nimble Page Builder WordPress plugin before 3.2.2 does not sanitise and escape the preview-level-guid parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/17585f16-c62c-422d-ad9c-9138b6da97b7
CVE ID: CVE-2022-0315 State: PUBLISHED Published: 2022-03-24T08:30:14 Last Updated: 2024-08-02T23:25:40.485Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: horovod Products: horovod/horovod Problem Types: CWE-377 Description: Insecure Temporary File in GitHub repository horovod/horovod prior to 0.24.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7e50397b-dd63-4bb5-b56d-704094a7da45 - https://github.com/horovod/horovod/commit/b96ecae4dc69fc0a83c7c2d3f1dde600c20a1b41
CVE ID: CVE-2022-0316 State: PUBLISHED Published: 2023-01-23T14:48:05.590Z Last Updated: 2025-04-03T19:12:48.241Z Vendors: Unknown Products: WeStand, footysquare, aidreform, statfort, club-theme, kingclub-theme, spikes, spikes-black, soundblast, bolster Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The WeStand WordPress theme before 2.1, footysquare WordPress theme, aidreform WordPress theme, statfort WordPress theme, club-theme WordPress theme, kingclub-theme WordPress theme, spikes WordPress theme, spikes-black WordPress theme, soundblast WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload va
last WordPress theme, bolster WordPress theme from ChimpStudio and PixFill does not have any authorisation and upload validation in the lang_upload.php file, allowing any unauthenticated attacker to upload arbitrary files to the web server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9ab3d6cf-aad7-41bc-9aae-dc5313f12f7c
CVE ID: CVE-2022-0317 State: PUBLISHED Published: 2022-02-04T22:33:03.136Z Last Updated: 2025-04-21T13:56:50.110Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Google LLC Products: go-attestation Problem Types: CWE-20 Description: An improper input validation vulnerability in go-attestation before 0.3.3 allows local users to provide a maliciously-formed Quote over no/some PCRs, causing AKPublic.Verify to succeed despite the inconsistency. Subsequent use of the same set of PCR values in Eventlog.Verify lacks the authentication performed by quote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventl
uote verification, meaning a local attacker could couple this vulnerability with a maliciously-crafted TCG log in Eventlog.Verify to spoof events in the TCG log, hence defeating remotely-attested measured-boot. We recommend upgrading to Version 0.4.0 or above. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/google/go-attestation/security/advisories/GHSA-99cg-575x-774p
CVE ID: CVE-2022-0318 State: PUBLISHED Published: 2022-01-21T00:00:00 Last Updated: 2024-11-15T13:08:06.801Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0d10ba02-b138-4e68-a284-67f781a62d08 - https://github.com/vim/vim/commit/57df9e8a9f9ae1aafdde9b86b10ad907627a87dc - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.o
kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/43 - https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html
CVE ID: CVE-2022-0319 State: PUBLISHED Published: 2022-01-21T00:00:00 Last Updated: 2024-08-02T23:25:40.514Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: vim Products: vim/vim Problem Types: CWE-125 Description: Out-of-bounds Read in vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ba622fd2-e6ef-4ad9-95b4-17f87b68755b - https://github.com/vim/vim/commit/05b27615481e72e3b338bb12990fb3e0c2ecc2a9 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http:
curity.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213444 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - http://seclists.org/fulldisclosure/2022/Oct/43 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0320 State: PUBLISHED Published: 2022-02-01T12:21:42 Last Updated: 2024-08-02T23:25:39.945Z Vendors: Unknown Products: Essential Addons for Elementor Problem Types: CWE-22 Description: The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0d02b222-e672-4ac0-a1d4-d34e1ecf4a95
CVE ID: CVE-2022-0321 State: PUBLISHED Published: 2022-03-14T14:41:28 Last Updated: 2024-08-02T23:25:40.235Z Vendors: Unknown Products: WP Voting Contest Problem Types: CWE-79 Description: The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/286b81a0-6f6d-4024-9bbc-6cb373990a7a
CVE ID: CVE-2022-0322 State: PUBLISHED Published: 2022-03-25T18:02:58 Last Updated: 2024-08-02T23:25:40.198Z Vendors: n/a Products: kernel Problem Types: CWE-681 Description: A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS). Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2042822 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2d859e3fc97e79d907761550dbc03ff1b
42822 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2d859e3fc97e79d907761550dbc03ff1b36479c - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-0323 State: PUBLISHED Published: 2022-01-21T18:00:17 Last Updated: 2024-08-02T23:25:40.163Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: bobthecow Products: bobthecow/mustache.php Problem Types: CWE-1336 Description: Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a5f5a988-aa52-4443-839d-299a63f44fb7 - https://github.com/bobthecow/mustache.php/commit/579ffa5c96e1d292c060b3dd62811ff01ad8c24e
CVE ID: CVE-2022-0324 State: PUBLISHED Published: 2022-11-14T16:08:34.224Z Last Updated: 2025-04-30T13:37:45.488Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: Linux Foundation Products: Software for Open Networking in the Cloud (SONiC) Problem Types: CWE-120 Description: There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that could cause buffer overflow in a memcpy call, leading to out-of-bounds memory write that would cause dhcp6relay to crash. Dhcp6relay is a critical process and could cause dhcp relay docker to shutdown. Discovered by Eugene Lim of GovTech Singapore. Additional Analyst Notes
s and could cause dhcp relay docker to shutdown. Discovered by Eugene Lim of GovTech Singapore. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/sonic-net/sonic-buildimage/security/advisories/GHSA-m4qf-8rrq-mph9 - https://govtech-csg.github.io/security-advisories/2022/11/14/CVE-2022-0324.html
CVE ID: CVE-2022-0326 State: PUBLISHED Published: 2022-01-21T06:45:12 Last Updated: 2024-08-02T23:25:40.180Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-476 Description: NULL Pointer Dereference in Homebrew mruby prior to 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/795dcbd9-1695-44bb-8c59-ad327c97c976 - https://github.com/mruby/mruby/commit/b611c43a5de061ec21b343967e1b64c45c373d7e
CVE ID: CVE-2022-0327 State: PUBLISHED Published: 2022-03-14T14:41:29 Last Updated: 2024-08-02T23:25:40.050Z Vendors: Unknown Products: Master Addons for Elementor Problem Types: CWE-79 Description: The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/df38cc99-da3c-4cc0-b179-1e52e841b883
CVE ID: CVE-2022-0328 State: PUBLISHED Published: 2022-02-28T09:06:45 Last Updated: 2024-08-02T23:25:40.479Z Vendors: Unknown Products: Simple Membership Problem Types: CWE-352 Description: The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/44532b7c-4d0d-4959-ada4-733f377d6ec9 - https://plugins.trac.wordpress.org/changeset/2662855
CVE ID: CVE-2022-0329 State: REJECTED Published: 2022-01-21T10:30:10 Last Updated: 2022-02-02T20:10:18 Description: No description available.