Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4847 State: PUBLISHED Published: 2022-12-29T00:00:00.000Z Last Updated: 2025-04-09T15:46:21.274Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:H) Vendors: usememos Products: usememos/memos Problem Types: CWE-941 Description: Incorrectly Specified Destination in a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ff6d4b5a-5e75-4a14-b5ce-f318f8613b73 - https://github.com/usememos/memos/commit/c9bb2b785dc5852655405d5c9ab127a2d5aa3948
CVE ID: CVE-2022-4848 State: PUBLISHED Published: 2022-12-29T00:00:00.000Z Last Updated: 2025-04-09T15:45:54.926Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: usememos Products: usememos/memos Problem Types: CWE-940 Description: Improper Verification of Source of a Communication Channel in GitHub repository usememos/memos prior to 0.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/c9bb2b785dc5852655405d5c9ab127a2d5aa3948 - https://huntr.dev/bounties/25de88cc-8d0d-41a1-b069-9ef1327770bc
CVE ID: CVE-2022-4849 State: PUBLISHED Published: 2022-12-29T00:00:00.000Z Last Updated: 2025-04-09T15:44:54.692Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: usememos Products: usememos/memos Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/c9bb2b785dc5852655405d5c9ab127a2d5aa3948 - https://huntr.dev/bounties/404ce7dd-f345-4d98-ad80-c53ac74f4e5c
CVE ID: CVE-2022-4850 State: PUBLISHED Published: 2022-12-29T00:00:00.000Z Last Updated: 2025-04-10T16:37:37.605Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: usememos Products: usememos/memos Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository usememos/memos prior to 0.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/c9bb2b785dc5852655405d5c9ab127a2d5aa3948 - https://huntr.dev/bounties/46dc4728-eacc-43f5-9831-c203fdbcc346
CVE ID: CVE-2022-4851 State: PUBLISHED Published: 2022-12-29T00:00:00.000Z Last Updated: 2025-04-10T16:36:55.682Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: usememos Products: usememos/memos Problem Types: CWE-229 Description: Improper Handling of Values in GitHub repository usememos/memos prior to 0.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53 - https://huntr.dev/bounties/e3cebc1a-1326-4a08-abad-0414a717fa0f
CVE ID: CVE-2022-4852 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-4853 State: REJECTED Published: N/A Last Updated: 2023-05-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-4854 State: REJECTED Published: N/A Last Updated: 2023-07-02T21:50:54.392231Z Description: No description available.
CVE ID: CVE-2022-4855 State: PUBLISHED Published: 2022-12-30T08:46:56.398Z Last Updated: 2025-04-09T15:44:05.593Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Lead Management System Problem Types: CWE-89 Description: A vulnerability, which was classified as critical, was found in SourceCodester Lead Management System 1.0. Affected is an unknown function of the file login.php. The manipulation of the argument username leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-217020. Additional Analyst Notes: - CVE Pro
d to the public and may be used. The identifier of this vulnerability is VDB-217020. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.217020 - https://vuldb.com/?ctiid.217020 - https://github.com/joinia/webray.com.cn/blob/main/lead-management-system/leadmanasql.md
CVE ID: CVE-2022-4856 State: PUBLISHED Published: 2022-12-30T09:02:47.469Z Last Updated: 2024-08-03T01:55:45.703Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Modbus Tools Products: Modbus Slave Problem Types: CWE-120 Description: A vulnerability has been found in Modbus Tools Modbus Slave up to 7.5.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the file mbslave.exe of the component mbs File Handler. The manipulation leads to buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-217021 was assigned to this vulnerability. Additional
s been disclosed to the public and may be used. The identifier VDB-217021 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217021 - https://vuldb.com/?ctiid.217021 - https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Slave/Modbus%20Slave%20(version%207.5.1%20and%20earlier)%20mbs%20file%20has%20a%20buffer%20overflow%20vulnerability.md - https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Slave/poc/poc.mbs
CVE ID: CVE-2022-4857 State: PUBLISHED Published: 2022-12-30T09:05:15.425Z Last Updated: 2025-04-09T15:43:42.621Z Severity: N/A (CVSS 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P) Vendors: Modbus Tools Products: Modbus Poll Problem Types: CWE-120 Description: A vulnerability was found in Modbus Tools Modbus Poll up to 9.10.0 and classified as critical. Affected by this issue is some unknown functionality of the file mbpoll.exe of the component mbp File Handler. The manipulation leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-217022 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Conta
may be used. VDB-217022 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.217022 - https://vuldb.com/?ctiid.217022 - https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Poll/Modbus%20Poll%20(version%209.10.0%20and%20earlier)%20mbp%20file%20has%20a%20buffer%20overflow%20vulnerability.md - https://github.com/Durian1546/vul/blob/main/webray.com.cn/Modbus%20Poll/poc/poc.mbp
CVE ID: CVE-2022-4858 State: PUBLISHED Published: 2022-12-30T11:24:35.870Z Last Updated: 2024-08-28T20:02:15.797Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: M-Files Products: M-Files Server Problem Types: CWE-532 Description: Insertion of Sensitive Information into Log Files in M-Files Server before 22.10.11846.0 could allow to obtain sensitive tokens from logs, if specific configurations were set. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4858/ - https://product.m-files.com/security-advisories/cve-2022-4858/
CVE ID: CVE-2022-4859 State: PUBLISHED Published: 2022-12-30T11:38:11.484Z Last Updated: 2024-08-03T01:55:46.118Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: Joget Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in Joget up to 7.0.33. This issue affects the function submitForm of the file wflow-core/src/main/java/org/joget/plugin/enterprise/UserProfileMenu.java of the component User Profile Menu. The manipulation of the argument firstName/lastName leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 7.0.34 is able to address this issue. The patch is named 9a77f508a2bf8cf6
ay be initiated remotely. Upgrading to version 7.0.34 is able to address this issue. The patch is named 9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217055. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217055 - https://vuldb.com/?ctiid.217055 - https://github.com/jogetworkflow/jw-community/commit/9a77f508a2bf8cf661d588f37a4cc29ecaea4fc8 - https://github.com/jogetworkflow/jw-community/releases/tag/7.0.34
CVE ID: CVE-2022-4860 State: PUBLISHED Published: 2022-12-30T11:49:50.291Z Last Updated: 2024-08-03T01:55:45.850Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: KBase Products: Metrics Problem Types: CWE-89 Description: A vulnerability was found in KBase Metrics. It has been classified as critical. This affects the function upload_user_data of the file source/daily_cron_jobs/methods_upload_user_stats.py. The manipulation leads to sql injection. The patch is named 959dfb6b05991e30b0fa972a1ecdcaae8e1dae6d. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-217059. Additional Analyst Notes: - CVE Progra
to fix this issue. The associated identifier of this vulnerability is VDB-217059. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217059 - https://vuldb.com/?ctiid.217059 - https://github.com/kbase/metrics/pull/77 - https://github.com/kbase/metrics/commit/959dfb6b05991e30b0fa972a1ecdcaae8e1dae6d
CVE ID: CVE-2022-4861 State: PUBLISHED Published: 2022-12-30T13:31:21.079Z Last Updated: 2024-08-28T20:05:34.948Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N) Vendors: M-Files Products: M-Files Client Problem Types: CWE-303 Description: Incorrect implementation in authentication protocol in M-Files Client before 22.5.11356.0 allows high privileged user to get other users tokens to another resource. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4861/ - https://product.m-files.com/security-advisories/cve-2022-4861/
CVE ID: CVE-2022-4862 State: PUBLISHED Published: 2023-03-06T10:46:20.520Z Last Updated: 2024-08-28T20:06:02.609Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: M-Files Products: M-Files New Web Problem Types: CWE-200 Description: Rendering of HTML provided by another authenticated user is possible in browser on M-Files Web before 22.12.12140.3. This allows the content to steal user sensitive information. This issue affects M-Files New Web: before 22.12.12140.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4862/ - https://product.m-files.com/se
rences: - https://www.m-files.com/about/trust-center/security-advisories/cve-2022-4862/ - https://product.m-files.com/security-advisories/cve-2022-4862/
CVE ID: CVE-2022-4863 State: PUBLISHED Published: 2022-12-30T00:00:00.000Z Last Updated: 2025-04-09T15:16:46.689Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: usememos Products: usememos/memos Problem Types: CWE-280 Description: Improper Handling of Insufficient Permissions or Privileges in GitHub repository usememos/memos prior to 0.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/3556ae4e651d9443dc3bb8a170dd3cc726517a53 - https://huntr.dev/bounties/42751929-e511-49a9-888d-d5b610da2a45
CVE ID: CVE-2022-4864 State: PUBLISHED Published: 2022-12-30T00:00:00.000Z Last Updated: 2025-04-09T15:24:37.022Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-88 Description: Argument Injection in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b7140709-8f84-4f19-9463-78669fa2175b - https://github.com/froxlor/froxlor/commit/f2485ecd9aab8da544b5e12891d82ae6fcff5fc7
CVE ID: CVE-2022-4865 State: PUBLISHED Published: 2022-12-31T00:00:00.000Z Last Updated: 2025-04-09T15:29:11.827Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: usememos Products: usememos/memos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/usememos/memos/commit/7670c9536000bb32c6345d4906a91268dcddd5fc - https://huntr.dev/bounties/cd8765a2-bf28-4019-8647-882ccf63b2be
CVE ID: CVE-2022-4866 State: PUBLISHED Published: 2022-12-31T00:00:00.000Z Last Updated: 2025-04-09T15:29:38.483Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: usememos Products: usememos/memos Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository usememos/memos prior to 0.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/39c04778-6228-4f07-bdd4-ab17f246dbff - https://github.com/usememos/memos/commit/7670c9536000bb32c6345d4906a91268dcddd5fc
CVE ID: CVE-2022-4867 State: PUBLISHED Published: 2022-12-31T00:00:00.000Z Last Updated: 2025-04-09T15:30:05.298Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/c91364dd-9ead-4bf3-96e6-663a017e08fa - https://github.com/froxlor/froxlor/commit/f7f356e896173558248c43f4f68612f78e73a65d
CVE ID: CVE-2022-4868 State: PUBLISHED Published: 2022-12-31T00:00:00.000Z Last Updated: 2025-04-09T15:30:25.859Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-285 Description: Improper Authorization in GitHub repository froxlor/froxlor prior to 2.0.0-beta1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3a8f36ac-5eda-41e7-a9c4-e0f3d63e6e3b - https://github.com/froxlor/froxlor/commit/0527f22dc942483430f8449e25a096bb8d683a5d
CVE ID: CVE-2022-4869 State: PUBLISHED Published: 2023-01-05T08:04:29.817Z Last Updated: 2024-08-03T01:55:46.045Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:P/I:N/A:N) Vendors: Evolution Events Products: Artaxerxes Problem Types: CWE-200 Description: A vulnerability was found in Evolution Events Artaxerxes. It has been declared as problematic. This vulnerability affects unknown code of the file arta/common/middleware.py of the component POST Parameter Handler. The manipulation of the argument password leads to information disclosure. The attack can be initiated remotely. The patch is identified as 022111407d34815c16c6eada2de69ca34084dc0d. It is recommended to apply a patch to fix this issue. VDB
tch is identified as 022111407d34815c16c6eada2de69ca34084dc0d. It is recommended to apply a patch to fix this issue. VDB-217438 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217438 - https://vuldb.com/?ctiid.217438 - https://github.com/evolution-events/Artaxerxes/commit/022111407d34815c16c6eada2de69ca34084dc0d
CVE ID: CVE-2022-4870 State: PUBLISHED Published: 2023-05-18T00:00:00 Last Updated: 2025-01-21T20:38:12.063Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Network discovery via error message detail Description: In affected versions of Octopus Deploy it is possible to discover network details via error message Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2023/sa2023-09/
CVE ID: CVE-2022-4871 State: PUBLISHED Published: 2023-01-03T11:00:36.489Z Last Updated: 2024-08-03T01:55:46.201Z Severity: N/A (CVSS 5.8 AV:N/AC:L/Au:M/C:P/I:P/A:P) Vendors: ummmmm Products: nflpick-em.com Problem Types: CWE-89 Description: A vulnerability classified as problematic was found in ummmmm nflpick-em.com up to 2.2.x. This vulnerability affects the function _Load_Users of the file html/includes/runtime/admin/JSON/LoadUsers.php. The manipulation of the argument sort leads to sql injection. The attack can be initiated remotely. The patch is identified as dd77a35942f527ea0beef5e0ec62b92e8b93211e. It is recommended to apply a patch to fix this issue. VDB-217270 is the identifier assi
2f527ea0beef5e0ec62b92e8b93211e. It is recommended to apply a patch to fix this issue. VDB-217270 is the identifier assigned to this vulnerability. NOTE: JSON entrypoint is only accessible via an admin account Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217270 - https://vuldb.com/?ctiid.217270 - https://github.com/ummmmm/nflpick-em.com/commit/dd77a35942f527ea0beef5e0ec62b92e8b93211e
CVE ID: CVE-2022-4872 State: PUBLISHED Published: 2023-01-30T20:31:34.088Z Last Updated: 2025-03-27T20:05:55.692Z Vendors: Unknown Products: Chained Products Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Chained Products WordPress plugin before 2.12.0 does not have authorisation and CSRF checks, as well as does not ensure that the option to be updated belong to the plugin, allowing unauthenticated attackers to set arbitrary options to 'no' Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c76a1c0b-8a5b-4639-85b6-9eebc63c3aa6
CVE ID: CVE-2022-4873 State: PUBLISHED Published: 2023-01-11T20:39:53.548Z Last Updated: 2025-11-04T19:14:30.799Z Vendors: Netcomm Products: NF20, NF20MESH, NL1902 Problem Types: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Description: On Netcomm router models NF20MESH, NF20, and NL1902 a stack based buffer overflow affects the sessionKey parameter. By providing a specific number of bytes, the instruction pointer is able to be overwritten on the stack and crashes the application at a known location. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/scarvell/advisories/blob/main/2022_netcomm_nf20mesh
Container: - CISA ADP Vulnrichment: References: - https://github.com/scarvell/advisories/blob/main/2022_netcomm_nf20mesh_unauth_rce.md
CVE ID: CVE-2022-4874 State: PUBLISHED Published: 2023-01-11T20:39:25.219Z Last Updated: 2025-11-04T19:14:31.884Z Vendors: Netcomm Products: NF20, NF20MESH, NL1902 Problem Types: CWE-288 Description: Authentication bypass in Netcomm router models NF20MESH, NF20, and NL1902 allows an unauthenticated user to access content. In order to serve static content, the application performs a check for the existence of specific characters in the URL (.css, .png etc). If it exists, it performs a "fake login" to give the request an active session to load the file and not redirect to the login page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.co
login page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/scarvell/advisories/blob/main/2022_netcomm_nf20mesh_unauth_rce.md
CVE ID: CVE-2022-4875 State: PUBLISHED Published: 2023-01-04T21:34:59.111Z Last Updated: 2025-04-09T15:33:23.324Z Severity: N/A (CVSS 3.3 AV:N/AC:L/Au:M/C:N/I:P/A:N) Vendors: n/a Products: fossology Problem Types: CWE-79 Description: A vulnerability has been found in fossology and classified as problematic. This vulnerability affects unknown code. The manipulation of the argument sql/VarValue leads to cross site scripting. The attack can be initiated remotely. The patch is identified as 8e0eba001662c7eb35f045b70dd458a4643b4553. It is recommended to apply a patch to fix this issue. VDB-217426 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container:
issue. VDB-217426 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.217426 - https://vuldb.com/?ctiid.217426 - https://github.com/fossology/fossology/pull/2356 - https://github.com/fossology/fossology/commit/8e0eba001662c7eb35f045b70dd458a4643b4553
CVE ID: CVE-2022-4876 State: PUBLISHED Published: 2023-01-04T22:02:54.952Z Last Updated: 2025-05-28T13:38:27.829Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: Kaltura Products: mwEmbed Problem Types: CWE-79 Description: A vulnerability was found in Kaltura mwEmbed up to 2.96.rc1 and classified as problematic. This issue affects some unknown processing of the file includes/DefaultSettings.php. The manipulation of the argument HTTP_X_FORWARDED_HOST leads to cross site scripting. The attack may be initiated remotely. Upgrading to version 2.96.rc2 is able to address this issue. The patch is named 13b8812ebc8c9fa034eed91ab35ba8423a528c0b. It is recommended to upgrade the affected co
ss this issue. The patch is named 13b8812ebc8c9fa034eed91ab35ba8423a528c0b. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217427. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.217427 - https://vuldb.com/?ctiid.217427 - https://github.com/kaltura/mwEmbed/pull/4266 - https://github.com/kaltura/mwEmbed/commit/13b8812ebc8c9fa034eed91ab35ba8423a528c0b - https://github.com/kaltura/mwEmbed/releases/tag/v2.96.rc2
CVE ID: CVE-2022-4877 State: PUBLISHED Published: 2023-01-05T09:14:02.136Z Last Updated: 2024-08-03T01:55:46.161Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: snoyberg Products: keter Problem Types: CWE-79 Description: A vulnerability has been found in snoyberg keter up to 1.8.1 and classified as problematic. This vulnerability affects unknown code of the file Keter/Proxy.hs. The manipulation of the argument host leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 1.8.2 is able to address this issue. The name of the patch is d41f3697926b231782a3ad8050f5af1ce5cc40b7. It is recommended to upgrade the affected component. The identifier of this
is d41f3697926b231782a3ad8050f5af1ce5cc40b7. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217444. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217444 - https://vuldb.com/?ctiid.217444 - https://github.com/snoyberg/keter/pull/246 - https://github.com/snoyberg/keter/commit/d41f3697926b231782a3ad8050f5af1ce5cc40b7 - https://github.com/snoyberg/keter/releases/tag/keter%2F1.8.2
CVE ID: CVE-2022-4878 State: PUBLISHED Published: 2023-01-06T09:30:21.960Z Last Updated: 2024-08-03T01:55:46.075Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: JATOS Problem Types: CWE-22 Description: A vulnerability classified as critical has been found in JATOS. Affected is the function ZipUtil of the file modules/common/app/utils/common/ZipUtil.java of the component ZIP Handler. The manipulation leads to path traversal. Upgrading to version 3.7.5-alpha is able to address this issue. The name of the patch is 2b42519f309d8164e8811392770ce604cdabb5da. It is recommended to upgrade the affected component. The identifier of this vulnerability is