Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1296 State: PUBLISHED Published: 2022-04-11T11:30:16 Last Updated: 2024-08-02T23:55:24.624Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-125 Description: Out-of-bounds read in `r_bin_ne_get_relocs` function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/52b57274-0e1a-4d61-ab29-1373b555fea0 - https://github.com/radareorg/radare2/commit/153bcdc29f11cd8c90e7d639a7405450f644ddb6
CVE ID: CVE-2022-1297 State: PUBLISHED Published: 2022-04-11T11:50:10 Last Updated: 2024-08-02T23:55:24.535Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-125 Description: Out-of-bounds Read in r_bin_ne_get_entrypoints function in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability may allow attackers to read sensitive information or cause a crash. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ec538fa4-06c6-4050-a141-f60153ddeaac - https://github.com/radareorg/radare2/commit/0a557045476a2969c7079aec9eeb29d02f2809c6
CVE ID: CVE-2022-1298 State: PUBLISHED Published: 2022-05-23T07:15:32 Last Updated: 2024-08-02T23:55:24.702Z Vendors: Unknown Products: Tabs Problem Types: CWE-79 Description: The Tabs WordPress plugin before 2.2.8 does not sanitise and escape Tab descriptions, which could allow high privileged users with a role as low as editor to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e124d1ab-3e02-4ca5-8218-ce635e8bf074
CVE ID: CVE-2022-1299 State: PUBLISHED Published: 2022-05-30T08:35:42 Last Updated: 2024-08-02T23:55:24.587Z Vendors: Unknown Products: Slideshow Problem Types: CWE-79 Description: The Slideshow WordPress plugin through 2.3.1 does not sanitize and escape some of its default slideshow settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8c46adb1-82d7-4621-a8c3-15cd90e98b96
CVE ID: CVE-2022-1300 State: PUBLISHED Published: 2022-05-02T10:20:09.499479Z Last Updated: 2024-09-17T01:05:59.399Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: TRUMPF Products: TruTops Boost, TruTops Fab (incl. TruTops Monitor) Problem Types: CWE-306 Description: Multiple Version of TRUMPF TruTops products expose a service function without necessary authentication. Execution of this function may result in unauthorized access to change of data or disruption of the whole service. Additional Analyst Notes: - CVE Program Container: References: - https://cert.vde.com/en/advisories/VDE-2022-016/
CVE ID: CVE-2022-1301 State: PUBLISHED Published: 2022-07-04T13:05:44 Last Updated: 2024-08-02T23:55:24.764Z Vendors: Unknown Products: WP Contact Slider Problem Types: CWE-79 Description: The WP Contact Slider WordPress plugin before 2.4.7 does not sanitize and escape the Text to Display settings of sliders, which could allow high privileged users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/69b75983-1010-453e-bf67-27b4a2a327a8
CVE ID: CVE-2022-1302 State: PUBLISHED Published: 2022-04-12T07:30:18.399338Z Last Updated: 2024-09-16T18:02:57.190Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: MZ Automation Products: libIEC61850 Problem Types: CWE-20 Description: In the MZ Automation LibIEC61850 in versions prior to 1.5.1 an unauthenticated attacker can craft a goose message, which may result in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://libiec61850.com/new-release-1-5-1-of-libiec61850/
CVE ID: CVE-2022-1303 State: PUBLISHED Published: 2022-05-09T16:50:48 Last Updated: 2024-08-02T23:55:24.664Z Vendors: Unknown Products: Slide Anything – Responsive Content / HTML Slider and Carousel Problem Types: CWE-79 Description: The Slide Anything WordPress plugin before 2.3.44 does not sanitize and escape sliders' description, which could allow high privilege users such as editor and above to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/590b446d-f8bc-49b0-93e7-2a6f2e6f62f1
CVE ID: CVE-2022-1304 State: PUBLISHED Published: 2022-04-14T20:05:47.000Z Last Updated: 2025-04-23T18:39:51.708Z Vendors: n/a Products: e2fsprogs Problem Types: CWE-125 Description: An out-of-bounds read/write vulnerability was found in e2fsprogs 1.46.5. This issue leads to a segmentation fault and possibly arbitrary code execution via a specially crafted filesystem. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2069726
CVE ID: CVE-2022-1305 State: PUBLISHED Published: 2022-07-25T13:39:29 Last Updated: 2024-08-03T00:03:05.119Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1285234 - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1306 State: PUBLISHED Published: 2022-07-25T13:39:42 Last Updated: 2024-08-03T00:03:05.177Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in compositing in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://crbug.com/1299287 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1307 State: PUBLISHED Published: 2022-07-25T13:39:56 Last Updated: 2024-08-03T00:03:05.006Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in full screen in Google Chrome on Android prior to 100.0.4896.88 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://crbug.com/1301873 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1308 State: PUBLISHED Published: 2022-07-25T13:40:12 Last Updated: 2024-08-03T00:03:05.162Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in BFCache in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://crbug.com/1283050 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1309 State: PUBLISHED Published: 2022-07-25T13:40:26 Last Updated: 2024-08-03T00:03:05.164Z Vendors: Google Products: Chrome Problem Types: Insufficient policy enforcement Description: Insufficient policy enforcement in developer tools in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://crbug.com/1106456 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1310 State: PUBLISHED Published: 2022-07-25T13:40:40 Last Updated: 2024-08-03T00:03:05.260Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in regular expressions in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://crbug.com/1307610 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1311 State: PUBLISHED Published: 2022-07-25T13:40:51 Last Updated: 2024-08-03T00:03:05.429Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in shell in Google Chrome on ChromeOS prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://crbug.com/1310717 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1312 State: PUBLISHED Published: 2022-07-25T13:41:06 Last Updated: 2024-08-03T00:03:05.111Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in storage in Google Chrome prior to 100.0.4896.88 allowed an attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via a crafted Chrome Extension. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://crbug.com/1311701 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1313 State: PUBLISHED Published: 2022-07-25T13:41:19 Last Updated: 2024-08-03T00:03:05.102Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in tab groups in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://crbug.com/1270539 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1314 State: PUBLISHED Published: 2022-07-25T00:00:00 Last Updated: 2024-08-03T00:03:05.143Z Vendors: Google Products: Chrome Problem Types: Type Confusion Description: Type confusion in V8 in Google Chrome prior to 100.0.4896.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_11.html - https://crbug.com/1304658 - https://security.gentoo.org/glsa/202208-25 - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-1314
CVE ID: CVE-2022-1316 State: PUBLISHED Published: 2022-04-11T20:05:16 Last Updated: 2024-08-03T00:03:05.615Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: zerotier Products: zerotier/zerotierone Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource in GitHub repository zerotier/zerotierone prior to 1.8.8. Local Privilege Escalation Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e7835226-1b20-4546-b256-3f625badb022 - https://github.com/zerotier/zerotierone/commit/ffb444dbeb6bea3cb155502395e61cb6d18708c9
CVE ID: CVE-2022-1318 State: PUBLISHED Published: 2022-04-20T15:30:35.000Z Last Updated: 2025-04-16T16:28:22.881Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: Interlogix Products: ComNav Problem Types: CWE-326 Description: Hills ComNav version 3002-19 suffers from a weak communication channel. Traffic across the local network for the configuration pages can be viewed by a malicious actor. The size of certain communications packets are predictable. This would allow an attacker to learn the state of the system if they can observe the traffic. This would be possible even if the traffic were encrypted, e.g., using WPA2, as the packet sizes would remain observ
ic. This would be possible even if the traffic were encrypted, e.g., using WPA2, as the packet sizes would remain observable. The communication encryption scheme is theoretically sound, but is not strong enough for the level of protection required. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.corporate.carrier.com/Images/CARR-PSA-Hills-ComNav-002-1121_tcm558-149392.pdf
CVE ID: CVE-2022-1319 State: PUBLISHED Published: 2022-08-31T00:00:00 Last Updated: 2024-08-03T00:03:05.119Z Vendors: n/a Products: undertow Problem Types: CWE-252 Description: A flaw was found in Undertow. For an AJP 400 response, EAP 7 is improperly sending two response packets, and those packets have the reuse flag set even though JBoss EAP closes the connection. A failure occurs when the connection is reused after a 400 by CPING since it reads in the second SEND_HEADERS response packet instead of a CPONG. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2073890 - https://issues.redhat.com/browse/UNDERTOW-2060 - https://github.co
https://bugzilla.redhat.com/show_bug.cgi?id=2073890 - https://issues.redhat.com/browse/UNDERTOW-2060 - https://github.com/undertow-io/undertow/commit/1443a1a2bbb8e32e56788109d8285db250d55c8b - https://github.com/undertow-io/undertow/commit/7c5b3ab885b5638fd3f1e8a935d5063d68aa2df3 - https://access.redhat.com/security/cve/CVE-2022-1319 - https://security.netapp.com/advisory/ntap-20221014-0006/
CVE ID: CVE-2022-1320 State: PUBLISHED Published: 2022-05-23T07:15:34 Last Updated: 2024-08-03T00:03:05.772Z Vendors: Unknown Products: Sliderby10Web Problem Types: CWE-79 Description: The Sliderby10Web WordPress plugin before 1.2.52 does not properly sanitize and escape some of its settings, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/43581d6b-333a-48d9-a1ae-b9479da8ff87
CVE ID: CVE-2022-1321 State: PUBLISHED Published: 2022-06-27T08:56:28 Last Updated: 2024-08-03T00:03:05.439Z Vendors: Unknown Products: miniOrange's Google Authenticator – WordPress Two Factor Authentication (2FA , Two Factor, OTP SMS and Email) | Passwordless login Problem Types: CWE-79 Description: The miniOrange's Google Authenticator WordPress plugin before 5.5.6 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan
allowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b8784995-0deb-4c83-959f-52b37881e05c
CVE ID: CVE-2022-1322 State: PUBLISHED Published: 2022-08-22T14:57:45 Last Updated: 2024-08-03T00:03:06.264Z Vendors: Unknown Products: Coming Soon – Under Construction Problem Types: CWE-79 Description: The Coming Soon - Under Construction WordPress plugin through 1.1.9 does not sanitize and escape some of its settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e1724471-26bd-4cb3-a279-51783102ed0c
CVE ID: CVE-2022-1323 State: PUBLISHED Published: 2022-08-08T13:45:37 Last Updated: 2024-08-03T00:03:05.614Z Vendors: Unknown Products: Discy Problem Types: CWE-862 Missing Authorization Description: The Discy WordPress theme before 5.0 lacks authorization checks then processing ajax requests to the discy_update_options action, allowing any logged in users (with privileges as low as Subscriber,) to change Theme options by sending a crafted POST request. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2d8020e1-6489-4555-9956-2dc190aaa61b
CVE ID: CVE-2022-1324 State: PUBLISHED Published: 2022-08-01T12:47:32 Last Updated: 2024-08-03T00:03:05.478Z Vendors: Unknown Products: Event Timeline – Vertical Timeline Problem Types: CWE-79 Description: The Event Timeline WordPress plugin through 1.1.5 does not sanitize and escape Timeline Text, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/2ce2a387-acc8-482a-9452-a4d9acb187fd
CVE ID: CVE-2022-1325 State: PUBLISHED Published: 2022-08-31T15:33:00 Last Updated: 2024-08-03T00:03:05.399Z Vendors: n/a Products: Clmg Problem Types: CWE-400 Description: A flaw was found in Clmg, where with the help of a maliciously crafted pandore or bmp file with modified dx and dy header field values it is possible to trick the application into allocating huge buffer sizes like 64 Gigabyte upon reading the file from disk or from a virtual buffer. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2074549 - https://huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2/ - https://github.com/GreycLab/CImg/issues/343 - https://git
s://huntr.dev/bounties/a5e4fc45-8f14-4dd1-811b-740fc50c95d2/ - https://github.com/GreycLab/CImg/issues/343 - https://github.com/GreycLab/CImg/pull/348 - https://github.com/GreycLab/CImg/commit/619cb58dd90b4e03ac68286c70ed98acbefd1c90 - https://access.redhat.com/security/cve/CVE-2022-1325
CVE ID: CVE-2022-1326 State: PUBLISHED Published: 2022-06-27T08:56:33 Last Updated: 2024-08-03T00:03:05.654Z Vendors: Unknown Products: Form – Contact Form Problem Types: CWE-79 Description: The Form - Contact Form WordPress plugin through 1.2.0 does not sanitize and escape Custom text fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f57615d9-a567-4c2a-9f06-2c6b61f56074
CVE ID: CVE-2022-1327 State: PUBLISHED Published: 2022-06-27T08:56:38 Last Updated: 2024-08-03T00:03:05.781Z Vendors: Unknown Products: Image Gallery – Grid Gallery Problem Types: CWE-79 Description: The Image Gallery WordPress plugin before 1.1.6 does not sanitize and escape some of its Image fields, which could allow high-privileged users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6b71eb38-0a4a-49d1-96bc-84bbe675be1e
CVE ID: CVE-2022-1328 State: PUBLISHED Published: 2022-04-14T00:00:00 Last Updated: 2024-08-03T00:03:05.707Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: Mutt Products: Mutt Problem Types: Improper restriction of operations within the bounds of a memory buffer in Mutt Description: Buffer Overflow in uudecoder in Mutt affecting all versions starting from 0.94.13 before 2.2.3 allows read past end of input line Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/muttmua/mutt/-/issues/404 - https://gitlab.com/muttmua/mutt/-/commit/e5ed080c00e59701ca62ef9b2a6d2612ebf765a5 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/C
muttmua/mutt/-/commit/e5ed080c00e59701ca62ef9b2a6d2612ebf765a5 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1328.json
CVE ID: CVE-2022-1329 State: PUBLISHED Published: 2022-04-19T00:00:00.000Z Last Updated: 2025-02-07T20:49:07.945Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: elemntor Products: Elementor Website Builder Problem Types: CWE-862, CWE-434 Description: The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to uploading malicious files that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2. Additional Analyst Notes: - CVE Program
es that can be used to obtain remote code execution, in versions 3.6.0 to 3.6.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/04/elementor-critical-remote-code-execution-vulnerability/ - https://plugins.trac.wordpress.org/changeset/2708766/elementor/trunk/core/app/modules/onboarding/module.php - https://www.pluginvulnerabilities.com/2022/04/12/5-million-install-wordpress-plugin-elementor-contains-authenticated-remote-code-execution-rce-vulnerability/ - http://packetstormsecurity.com/files/168615/WordPress-Elementor-3.6.2-Shell-Upload.html
CVE ID: CVE-2022-1330 State: PUBLISHED Published: 2022-04-12T20:40:10 Last Updated: 2024-08-03T00:03:05.700Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H) Vendors: alvarotrigo Products: alvarotrigo/fullpage.js Problem Types: CWE-79 Description: stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss . Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/08d2a6d0-772f-4b05-834e-86343f263c35 - https://github.com/alvarotrigo/fullpage.js/commit/e7a5db42711700c8a584e61b5e532a64039fe92b
CVE ID: CVE-2022-1331 State: PUBLISHED Published: 2022-05-03T18:44:32.887Z Last Updated: 2025-04-16T16:25:48.513Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Delta Electronics Products: DMARS Problem Types: CWE-611 Description: In four instances DMARS (All versions prior to v2.1.10.24) does not properly restrict references of XML external entities while processing specific project files, which may allow unauthorized information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-104-01
CVE ID: CVE-2022-1332 State: PUBLISHED Published: 2022-04-13T17:06:03 Last Updated: 2024-12-06T23:09:44.384Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: One of the API in Mattermost version 6.4.1 and earlier fails to properly protect the permissions, which allows the authenticated members with restricted custom admin role to bypass the restrictions and view the server logs and server config.json file contents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2022-1333 State: PUBLISHED Published: 2022-04-13T17:06:01 Last Updated: 2024-12-06T23:09:55.390Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Playbooks Problem Types: CWE-770 Description: Mattermost Playbooks plugin v1.24.0 and earlier fails to properly check the limit on the number of webhooks, which allows authenticated and authorized users to create a specifically drafted Playbook which could trigger a large amount of webhook requests leading to Denial of Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/