Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-40663 State: PUBLISHED Published: 2022-09-15T15:26:38.000Z Last Updated: 2025-04-29T18:38:35.378Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: NIKON Products: NIS-Elements Viewer Problem Types: CWE-125 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of NIKON NIS-Elements Viewer 1.2100.1483.0. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of TIF images. Crafted data in a TIF image can trigger a read past the end of an allocated buffer. An attacker can lev
g of TIF images. Crafted data in a TIF image can trigger a read past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-15697. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-1219/
CVE ID: CVE-2022-40664 State: PUBLISHED Published: 2022-10-12T00:00:00.000Z Last Updated: 2025-05-15T15:02:41.513Z Vendors: Apache Software Foundation Products: Apache Shiro Problem Types: CWE-287 Description: Apache Shiro before 1.10.0, Authentication Bypass Vulnerability in Shiro when forwarding or including via RequestDispatcher. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.apache.org/thread/loc2ktxng32xpy7lfwxto13k4lvnhjwg - http://www.openwall.com/lists/oss-security/2022/10/12/1 - http://www.openwall.com/lists/oss-security/2022/10/12/2 - http://www.openwall.com/lists/oss-security/2022/10/13/1 - https://security.netapp.com/adviso
oss-security/2022/10/12/2 - http://www.openwall.com/lists/oss-security/2022/10/13/1 - https://security.netapp.com/advisory/ntap-20221118-0005/
CVE ID: CVE-2022-40665 State: REJECTED Published: 2022-09-23T19:17:07 Last Updated: 2022-09-23T19:17:07 Description: No description available.
CVE ID: CVE-2022-40666 State: REJECTED Published: 2022-09-23T19:17:07 Last Updated: 2022-09-23T19:17:07 Description: No description available.
CVE ID: CVE-2022-40667 State: REJECTED Published: 2022-09-23T19:17:07 Last Updated: 2022-09-23T19:17:07 Description: No description available.
CVE ID: CVE-2022-40668 State: REJECTED Published: 2022-09-23T19:17:07 Last Updated: 2022-09-23T19:17:07 Description: No description available.
CVE ID: CVE-2022-40669 State: REJECTED Published: 2022-09-23T19:17:08 Last Updated: 2022-09-23T19:17:08 Description: No description available.
CVE ID: CVE-2022-40671 State: PUBLISHED Published: 2022-09-23T14:19:17.924Z Last Updated: 2025-02-20T20:03:52.164Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Blaz K. Products: Rate my Post – WP Rating System (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Rate my Post – WP Rating System plugin <= 3.3.4 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/rate-my-post/wordpress-rate-my-post-wp-rating-system-plugin-3-3-4-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/plu
y-post-wp-rating-system-plugin-3-3-4-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/plugins/rate-my-post/#developers
CVE ID: CVE-2022-40672 State: PUBLISHED Published: 2022-09-23T14:38:36.966Z Last Updated: 2025-02-20T20:02:28.676Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: WPChill Products: CPO Shortcodes (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in CPO Shortcodes plugin <= 1.5.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/cpo-shortcodes/wordpress-cpo-shortcodes-plugin-1-5-0-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpress.org/plugins/cpo-sh
lugin-1-5-0-authenticated-stored-cross-site-scripting-xss-vulnerability/_s_id=cve - https://wordpress.org/plugins/cpo-shortcodes/
CVE ID: CVE-2022-40673 State: PUBLISHED Published: 2022-09-14T05:12:16 Last Updated: 2024-08-03T12:21:46.575Z Vendors: n/a Products: n/a Problem Types: n/a Description: KDiskMark before 3.1.0 lacks authorization checking for D-Bus methods such as Helper::flushPageCache. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/JonMagon/KDiskMark/releases/tag/3.1.0 - https://github.com/JonMagon/KDiskMark/commit/3c90083a4f5ba3f240a797e509d818221542bbdc - https://github.com/JonMagon/KDiskMark/compare/3.0.0...3.1.0 - http://www.openwall.com/lists/oss-security/2022/09/14/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/
ecurity/2022/09/14/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YYO3GWTNPHNCLHSI562Q3KX43PW7FQ4Q/
CVE ID: CVE-2022-40674 State: PUBLISHED Published: 2022-09-14T00:00:00.000Z Last Updated: 2025-05-30T19:18:52.952Z Vendors: n/a Products: n/a Problem Types: n/a Description: libexpat before 2.4.9 has a use-after-free in the doContent function in xmlparse.c. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/libexpat/libexpat/pull/629 - https://github.com/libexpat/libexpat/pull/640 - https://www.debian.org/security/2022/dsa-5236 - https://lists.debian.org/debian-lts-announce/2022/09/msg00029.html - https://security.gentoo.org/glsa/202209-24 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/messa
ntoo.org/glsa/202209-24 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2ZKEPGFCZ7R6DRVH3K6RBJPT42ZBEG/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/J2IGJNHFV53PYST7VQV3T4NHVYAMXA36/ - https://security.netapp.com/advisory/ntap-20221028-0008/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSVZN3IJ6OCPSJL7AEX3ZHSHAHFOGESK/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraprojec
/XCGBVQQ47URGJAZWHCISHDWF6QBTV2LE/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LQB6FJAM5YQ35SF5B2MN25Y2FX56EOEZ/ - https://security.gentoo.org/glsa/202211-06
CVE ID: CVE-2022-40675 State: PUBLISHED Published: 2023-02-16T18:06:52.567Z Last Updated: 2024-10-23T14:32:50.215Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:U/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-310 Description: Some cryptographic issues in Fortinet FortiNAC versions 9.4.0 through 9.4.1, 9.2.0 through 9.2.7, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an attacker to decrypt and forge protocol communication messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-312
CVE ID: CVE-2022-40676 State: PUBLISHED Published: 2023-03-07T16:04:55.119Z Last Updated: 2024-10-23T14:31:22.301Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:U/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-79 Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.8, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted http requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
mands via specially crafted http requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-281
CVE ID: CVE-2022-40677 State: PUBLISHED Published: 2023-02-16T18:06:57.630Z Last Updated: 2024-10-23T14:32:34.591Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-88 Description: A improper neutralization of argument delimiters in a command ('argument injection') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 allows attacker to execute unauthorized code or commands via specially crafted input parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment:
nds via specially crafted input parameters. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-280
CVE ID: CVE-2022-40678 State: PUBLISHED Published: 2023-02-16T18:06:47.487Z Last Updated: 2024-10-23T14:46:07.411Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H/RL:U/RC:C) Vendors: Fortinet Products: FortiNAC Problem Types: CWE-522 Description: An insufficiently protected credentials in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow a local attacker with database access to recover user passwords. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-265
CVE ID: CVE-2022-40679 State: PUBLISHED Published: 2023-04-11T16:05:49.688Z Last Updated: 2024-10-23T14:30:02.463Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiDDoS, FortiDDoS-F, FortiADC Problem Types: CWE-78 Description: An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, 6.1 all versions, 6.2.0 through 6.2.4, 7.0.0 through 7.0.3, 7.1.0; FortiDDoS 4.x all versions, 5.0 all versions, 5.1 all versions, 5.2 all versions, 5.3 all versions, 5.4 all versions, 5.5 all versions, 5.6 all versions and FortiDDoS-F 6.4.0, 6.3.0 through 6.3.3,
ons, 5.3 all versions, 5.4 all versions, 5.5 all versions, 5.6 all versions and FortiDDoS-F 6.4.0, 6.3.0 through 6.3.3, 6.2.0 through 6.2.2, 6.1.0 through 6.1.4 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-335
CVE ID: CVE-2022-40680 State: PUBLISHED Published: 2022-12-06T16:00:38.136Z Last Updated: 2024-10-22T20:51:47.554Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N/E:P/RL:X/RC:C) Vendors: Fortinet Products: FortiProxy, FortiOS Problem Types: CWE-79 Description: A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiOS 6.0.7 - 6.0.15, 6.2.2 - 6.2.12, 6.4.0 - 6.4.9 and 7.0.0 - 7.0.3 allows a privileged attacker to execute unauthorized code or commands via storing malicious payloads in replacement messages. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-21-248
CVE ID: CVE-2022-40681 State: PUBLISHED Published: 2023-11-14T18:08:24.769Z Last Updated: 2024-08-30T18:06:47.506Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:H/RL:U/RC:C) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-863 Description: A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to cause denial of service via sending a crafted request to a specific named pipe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-299
CVE ID: CVE-2022-40682 State: PUBLISHED Published: 2023-04-11T16:05:59.314Z Last Updated: 2024-10-23T14:29:52.549Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R) Vendors: Fortinet Products: FortiClientWindows Problem Types: CWE-863 Description: A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacker to execute unauthorized code or commands via sending a crafted request to a specific named pipe. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-336
CVE ID: CVE-2022-40683 State: PUBLISHED Published: 2023-02-16T18:07:04.143Z Last Updated: 2024-10-23T14:32:25.398Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:U/RC:R) Vendors: Fortinet Products: FortiWeb Problem Types: CWE-415 Description: A double free in Fortinet FortiWeb version 7.0.0 through 7.0.3 may allows attacker to execute unauthorized code or commands via specially crafted commands Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-348
CVE ID: CVE-2022-40684 State: PUBLISHED Published: 2022-10-18T00:00:00.000Z Last Updated: 2025-10-21T23:15:33.167Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:U/RC:C) Vendors: Fortinet Products: Fortinet FortiOS, FortiProxy, FortiSwitchManager Problem Types: Execute unauthorized code or commands Description: An authentication bypass using an alternate path or channel [CWE-288] in Fortinet FortiOS version 7.2.0 through 7.2.1 and 7.0.0 through 7.0.6, FortiProxy version 7.2.0 and version 7.0.0 through 7.0.6 and FortiSwitchManager version 7.2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially cr
2.0 and 7.0.0 allows an unauthenticated atttacker to perform operations on the administrative interface via specially crafted HTTP or HTTPS requests. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fortiguard.com/psirt/FG-IR-22-377 - http://packetstormsecurity.com/files/169431/Fortinet-FortiOS-FortiProxy-FortiSwitchManager-Authentication-Bypass.html - http://packetstormsecurity.com/files/171515/Fortinet-7.2.1-Authentication-Bypass.html
CVE ID: CVE-2022-40685 State: PUBLISHED Published: 2023-05-10T13:17:09.768Z Last Updated: 2025-01-27T18:01:43.229Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) DCM software Problem Types: information disclosure, CWE-522 Description: Insufficiently protected credentials in the Intel(R) DCM software before version 5.0.1 may allow an authenticated user to potentially enable information disclosure via network access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00772.html
CVE ID: CVE-2022-40686 State: PUBLISHED Published: 2022-11-18T18:38:45.709Z Last Updated: 2025-02-20T19:52:56.803Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Constant Contact Products: Creative Mail (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/creative-mail-by-constant-contact/wordpress-creative-mail-plugin-1-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-40687 State: PUBLISHED Published: 2022-11-18T18:47:19.961Z Last Updated: 2025-02-20T19:52:41.503Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Constant Contact Products: Creative Mail (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Creative Mail plugin <= 1.5.4 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/creative-mail-by-constant-contact/wordpress-creative-mail-easier-wordpress-woocommerce-email-marketing-plugin-1-5-4-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-40688 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:20:48.115Z Description: No description available.
CVE ID: CVE-2022-40689 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:20:49.481Z Description: No description available.
CVE ID: CVE-2022-40690 State: PUBLISHED Published: 2022-10-24T00:00:00.000Z Last Updated: 2025-05-07T14:12:25.210Z Vendors: BookStack Products: BookStack Problem Types: Cross-site scripting Description: Cross-site scripting vulnerability in BookStack versions prior to v22.09 allows a remote authenticated attacker to inject an arbitrary script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bookstackapp.com/blog/bookstack-release-v22-09/ - https://www.bookstackapp.com/docs/admin/security/#using-bookstack-content-externally - https://jvn.jp/en/jp/JVN78862034/index.html
CVE ID: CVE-2022-40691 State: PUBLISHED Published: 2023-02-07T16:52:02.533Z Last Updated: 2024-08-03T12:21:46.623Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Moxa Products: SDS-3008 Series Industrial Ethernet Switch Problem Types: CWE-200 Description: An information disclosure vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted HTTP request can lead to a disclosure of sensitive information. An attacker can send an HTTP request to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.c
y. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1621 - https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities
CVE ID: CVE-2022-40692 State: PUBLISHED Published: 2023-02-02T15:58:56.754Z Last Updated: 2025-01-13T15:58:29.677Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: WP Sunshine Products: Sunshine Photo Cart Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WP Sunshine Sunshine Photo Cart plugin <= 2.9.13 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/sunshine-photo-cart/wordpress-sunshine-photo-cart-plugin-2-9-13-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-40693 State: PUBLISHED Published: 2023-02-07T16:52:04.022Z Last Updated: 2024-08-03T12:21:46.601Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Moxa Products: SDS-3008 Series Industrial Ethernet Switch Problem Types: CWE-319 Description: A cleartext transmission vulnerability exists in the web application functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. A specially-crafted network sniffing can lead to a disclosure of sensitive information. An attacker can sniff network traffic to trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligen
ility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://talosintelligence.com/vulnerability_reports/TALOS-2022-1616 - https://www.moxa.com/en/support/product-support/security-advisory/sds-3008-series-multiple-web-vulnerabilities
CVE ID: CVE-2022-40694 State: PUBLISHED Published: 2022-11-17T22:17:27.196834Z Last Updated: 2024-09-16T18:39:23.704Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: StoreApps Products: News Announcement Scroll (WordPress plugin) Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in News Announcement Scroll plugin <= 8.8.8 on WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/news-announcement-scroll/wordpress-news-announcement-scroll-plugin-8-8-8-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-40695 State: PUBLISHED Published: 2022-11-18T22:16:12.015Z Last Updated: 2025-02-20T19:50:50.818Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: WP-buy Products: SEO Redirection Plugin – 301 Redirect Manager (WordPress plugin) Problem Types: CWE-352 Description: Multiple Cross-Site Scripting (CSRF) vulnerabilities in SEO Redirection Plugin plugin <= 8.9 on WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/seo-redirection/#developers - https://patchstack.com/database/vulnerability/seo-redirection/wordpress-seo-redirection-plugin-plugin-8-9-multiple-cross-site-sc
patchstack.com/database/vulnerability/seo-redirection/wordpress-seo-redirection-plugin-plugin-8-9-multiple-cross-site-scripting-csrf-vulnerabilities?_s_id=cve
CVE ID: CVE-2022-40696 State: PUBLISHED Published: 2024-01-08T22:02:53.269Z Last Updated: 2025-06-17T20:29:15.877Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: WP Engine Products: Advanced Custom Fields (ACF) Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields (ACF).This issue affects Advanced Custom Fields (ACF): from 3.1.1 through 6.0.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-3-1-1-6-0-2-custom-field-value-e
m/database/vulnerability/advanced-custom-fields/wordpress-advanced-custom-fields-plugin-3-1-1-6-0-2-custom-field-value-exposure?_s_id=cve
CVE ID: CVE-2022-40697 State: PUBLISHED Published: 2023-01-19T16:32:46.382Z Last Updated: 2025-01-13T15:59:15.480Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: 3COM Marketing Products: 3com – Asesor de Cookies para normativa española Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 3com – Asesor de Cookies para normativa española plugin <= 3.4.3 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/3com-asesor-de-cookies/wordpress-3com-asesor-de-cookies-plugin-3-4-3-auth-stored-cross-site-scripting-xss-vulnerabili
ty/3com-asesor-de-cookies/wordpress-3com-asesor-de-cookies-plugin-3-4-3-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-40698 State: PUBLISHED Published: 2022-11-18T21:45:19.326473Z Last Updated: 2024-09-17T00:46:22.569Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: ExpressTech Products: Quiz And Survey Master (WordPress plugin) Problem Types: CWE-79 Description: Auth. (subscriber+) Cross-Site Scripting (XSS) vulnerability in Quiz And Survey Master plugin <= 7.3.10 on WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/quiz-master-next/wordpress-quiz-and-survey-master-plugin-7-3-10-cross-site-scripting-xss-vulnerability?_s_id=cve