Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4701 State: PUBLISHED Published: 2023-01-10T16:55:47.253Z Last Updated: 2025-01-13T17:13:00.573Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-285 Improper Authorization Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with sub
gins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'contact-form-7', 'media-library-assistant', or 'woocommerce' plugins if they are installed on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/55f7e39b-e7a5-462b-b1e4-c3d92038f17e - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
CVE ID: CVE-2022-4702 State: PUBLISHED Published: 2023-01-10T16:55:10.309Z Last Updated: 2025-01-13T17:14:11.737Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-284 Improper Access Control Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_fix_royal_compatibility' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subs
ity' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to deactivate every plugin on the site unless it is part of an extremely limited hardcoded selection. This also switches the site to the 'royal-elementor-kit' theme, potentially resulting in availability issues. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/cb47b6cc-87e4-4d29-bbc7-6d7552bc3943 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046 - https://www.wordfence.com/blog/2023/01/eleven
browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
CVE ID: CVE-2022-4703 State: PUBLISHED Published: 2023-01-10T16:55:42.835Z Last Updated: 2025-01-13T17:13:11.280Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-284 Improper Access Control Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_reset_previous_import' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscr
t' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to reset previously imported data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/62a5c796-1c14-4cb1-9f21-340b40e418df - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
CVE ID: CVE-2022-4704 State: PUBLISHED Published: 2023-01-10T16:55:34.177Z Last Updated: 2025-01-13T17:13:30.457Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-284 Improper Access Control Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscri
' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site configuration templates including images and settings. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/64cce528-0ad0-45ec-a8f6-e8791b0bece0 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
CVE ID: CVE-2022-4705 State: PUBLISHED Published: 2023-01-10T16:55:38.800Z Last Updated: 2025-01-13T17:13:21.184Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-284 Improper Access Control Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_final_settings_setup' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscri
' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to finalize activation of preset site configuration templates, which can be chosen and imported via a separate action documented in CVE-2022-4704. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/0a941aef-85f6-4719-b6ab-ace77a03e93e - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
CVE ID: CVE-2022-4706 State: PUBLISHED Published: 2023-01-23T14:31:41.490Z Last Updated: 2025-04-02T16:31:57.563Z Vendors: Unknown Products: Genesis Columns Advanced Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Genesis Columns Advanced WordPress plugin before 2.0.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks which could be used against high-privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/30882a45-ca03-4
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/30882a45-ca03-4ff1-a36d-758d9b9b641c
CVE ID: CVE-2022-4707 State: PUBLISHED Published: 2023-01-10T16:55:51.653Z Last Updated: 2025-01-13T17:12:52.036Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Royal Elementor Addons plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This al
including, 1.3.59. This is due to missing nonce validation in the 'wpr_create_mega_menu_template' AJAX function. This allows unauthenticated attackers to create Mega Menu templates, granted they can trick an administrator into performing an action, such as clicking a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/55db7d81-7ffb-49da-b64e-23e892bddc57 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/mega-menu.php?rev=2809656 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
CVE ID: CVE-2022-4708 State: PUBLISHED Published: 2023-01-10T16:55:21.210Z Last Updated: 2025-01-13T17:13:50.121Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-284 Improper Access Control Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with sub
ions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to modify the conditions under which templates are displayed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e12653-ddfe-4e02-9d9e-0263b9f71def - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/includes/wpr-templates-actions.php?rev=2834217 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
CVE ID: CVE-2022-4709 State: PUBLISHED Published: 2023-01-10T16:55:00.175Z Last Updated: 2025-01-13T17:14:35.500Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-284 Improper Access Control Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_library_template' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subs
ate' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import and activate templates from the plugin's template library. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/fa530112-a7cd-4c54-aa87-9e7337d01557 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/includes/wpr-templates-actions.php?rev=2834217 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
CVE ID: CVE-2022-4710 State: PUBLISHED Published: 2023-01-10T16:55:29.753Z Last Updated: 2025-01-13T17:13:39.947Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Royal Elementor Addons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization a
Reflected Cross-Site Scripting in versions up to, and including, 1.3.59, due to due to insufficient input sanitization and output escaping of the 'wpr_ajax_search_link_target' parameter in the 'data_fetch' function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is occurring because 'sanitize_text_field' is insufficient to prevent attribute-based Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6c6ce4-9944-4c8e-89aa-6
CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/ac6c6ce4-9944-4c8e-89aa-6a2e870ef205 - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/classes/wpr-ajax-search.php?rev=2809656 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
CVE ID: CVE-2022-4711 State: PUBLISHED Published: 2023-01-10T16:55:15.181Z Last Updated: 2025-01-13T17:14:00.957Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: wproyal Products: Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) Problem Types: CWE-284 Improper Access Control Description: The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_mega_menu_settings' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subs
ngs' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to enable and modify Mega Menu settings for any menu item. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/c23e9810-40ea-43e2-9292-f05f300a7ddf - https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/mega-menu.php?rev=2809656 - https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
CVE ID: CVE-2022-4712 State: PUBLISHED Published: 2023-10-20T06:35:32.603Z Last Updated: 2025-02-05T19:06:42.205Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) Vendors: gioni Products: WP Cerber Security, Anti-spam & Malware Scan Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The WP Cerber Security plugin for WordPress is vulnerable to stored cross-site scripting via the log parameter when logging in to the site in versions up to, and including, 9.1. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injecte
unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6cd9cbba-10b0-4fb0-ad49-4593a307a615?source=cve - https://plugins.trac.wordpress.org/browser/wp-cerber/trunk/admin/cerber-dashboard.php?rev=2721561#L1338
CVE ID: CVE-2022-4714 State: PUBLISHED Published: 2023-02-21T08:51:04.598Z Last Updated: 2025-05-05T16:11:27.958Z Vendors: Unknown Products: WP Dark Mode Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Dark Mode WordPress plugin before 4.0.0 does not validate and escape one of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/61b475f1-bbfb-4450-a3b2-b8caf5df2340
CVE ID: CVE-2022-4715 State: PUBLISHED Published: 2023-01-23T14:31:56.331Z Last Updated: 2025-04-03T19:20:22.459Z Vendors: Unknown Products: Structured Content (JSON-LD) #wpsc Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Structured Content WordPress plugin before 1.5.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4394fe86-4240
st Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/4394fe86-4240-4454-b724-81464b04123a
CVE ID: CVE-2022-4716 State: PUBLISHED Published: 2023-01-23T14:31:27.599Z Last Updated: 2025-04-02T15:38:02.920Z Vendors: Unknown Products: WP Popups Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WP Popups WordPress plugin before 2.1.4.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/24176ad3-2317-4853-b4db-8394384d52cd
CVE ID: CVE-2022-4717 State: PUBLISHED Published: 2023-02-06T19:59:15.762Z Last Updated: 2025-03-25T20:42:26.553Z Vendors: Unknown Products: Strong Testimonials Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Strong Testimonials WordPress plugin before 3.0.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/14b679f5-44a8-46d4-89dd-94e
E Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/14b679f5-44a8-46d4-89dd-94eb647cb672
CVE ID: CVE-2022-4718 State: PUBLISHED Published: 2023-01-23T14:32:00.887Z Last Updated: 2025-04-03T19:16:45.791Z Vendors: Unknown Products: Landing Page Builder Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Landing Page Builder WordPress plugin before 1.4.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/04d7cd44-9e18-42b9-9f79
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/04d7cd44-9e18-42b9-9f79-cc9cd6980526
CVE ID: CVE-2022-4719 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:39:58.256Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-840 Description: Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9f746881-ad42-446b-9b1d-153391eacc09 - https://github.com/ikus060/rdiffweb/commit/bc4bed89affcba71251fe54ed10639da9d392c1d
CVE ID: CVE-2022-4720 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:40:19.211Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-601 Description: Open Redirect in GitHub repository ikus060/rdiffweb prior to 2.5.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d - https://huntr.dev/bounties/339687af-6e25-4ad8-823d-c097f607ea70
CVE ID: CVE-2022-4721 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:40:39.894Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-75 Description: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3c48ef5d-da4d-4ee4-aaca-af65e7273720 - https://github.com/ikus060/rdiffweb/commit/6afaae56a29536f0118b3380d296c416aa6d078d
CVE ID: CVE-2022-4722 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:41:08.079Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-305 Description: Authentication Bypass by Primary Weakness in GitHub repository ikus060/rdiffweb prior to 2.5.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/c62126dc-d9a6-4d3e-988d-967031876c58 - https://github.com/ikus060/rdiffweb/commit/d1aaa96b665a39fba9e98d6054a9de511ba0a837
CVE ID: CVE-2022-4723 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:41:31.234Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/9369681b-8bfc-4146-a54c-c5108442d92c - https://github.com/ikus060/rdiffweb/commit/6e9ee210548f6d3210704cac302cfc7cdb239765
CVE ID: CVE-2022-4724 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-09T20:41:49.661Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-284 Description: Improper Access Control in GitHub repository ikus060/rdiffweb prior to 2.5.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e6fb1931-8d9c-4895-be4a-59839b4b6445 - https://github.com/ikus060/rdiffweb/commit/c4a19cf67d575c4886171b8efcbf4675d51f3929
CVE ID: CVE-2022-4725 State: PUBLISHED Published: 2022-12-24T00:00:00 Last Updated: 2024-08-03T01:48:40.303Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: AWS SDK Problem Types: CWE-918 Description: A vulnerability was found in AWS SDK 2.59.0. It has been rated as critical. This issue affects the function XpathUtils of the file aws-android-sdk-core/src/main/java/com/amazonaws/util/XpathUtils.java of the component XML Parser. The manipulation leads to server-side request forgery. Upgrading to version 2.59.1 is able to address this issue. The name of the patch is c3e6d69422e1f0c80fe53f2d757b8df97619af2b. It is recommended to upgrade the affecte