Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
64e8811392770ce604cdabb5da. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217548. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217548 - https://vuldb.com/?ctiid.217548 - https://github.com/JATOS/JATOS/commit/2b42519f309d8164e8811392770ce604cdabb5da - https://github.com/JATOS/JATOS/releases/tag/v3.7.5-alpha
CVE ID: CVE-2022-4879 State: PUBLISHED Published: 2023-01-06T10:36:20.105Z Last Updated: 2025-05-28T13:36:09.149Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L) Vendors: n/a Products: Forged Alliance Forever Problem Types: CWE-285 Description: A vulnerability was found in Forged Alliance Forever up to 3746. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the component Vote Handler. The manipulation leads to improper authorization. Upgrading to version 3747 is able to address this issue. The patch is named 6880971bd3d73d942384aff62d53058c206ce644. It is recommended to upgrade the affected component. The associated ident
amed 6880971bd3d73d942384aff62d53058c206ce644. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-217555. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.217555 - https://vuldb.com/?ctiid.217555 - https://github.com/FAForever/fa/pull/4398 - https://github.com/FAForever/fa/commit/6880971bd3d73d942384aff62d53058c206ce644 - https://github.com/FAForever/fa/releases/tag/3747
CVE ID: CVE-2022-4880 State: PUBLISHED Published: 2023-01-07T12:55:54.952Z Last Updated: 2024-08-03T01:55:45.863Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: stakira Products: OpenUtau Problem Types: CWE-22 Description: A vulnerability was found in stakira OpenUtau. It has been classified as critical. This affects the function VoicebankInstaller of the file OpenUtau.Core/Classic/VoicebankInstaller.cs of the component ZIP Archive Handler. The manipulation leads to path traversal. Upgrading to version 0.0.991 is able to address this issue. The identifier of the patch is 849a0a6912aac8b1c28cc32aa1132a3140caff4a. It is recommended to upgrade the affected com
. The identifier of the patch is 849a0a6912aac8b1c28cc32aa1132a3140caff4a. It is recommended to upgrade the affected component. The identifier VDB-217617 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217617 - https://vuldb.com/?ctiid.217617 - https://github.com/stakira/OpenUtau/pull/544 - https://github.com/stakira/OpenUtau/commit/849a0a6912aac8b1c28cc32aa1132a3140caff4a - https://github.com/stakira/OpenUtau/releases/tag/build%2F0.0.991
CVE ID: CVE-2022-4881 State: PUBLISHED Published: 2023-01-08T12:23:02.973Z Last Updated: 2024-08-03T01:55:45.974Z Severity: N/A (CVSS 5 AV:N/AC:L/Au:N/C:N/I:P/A:N) Vendors: CapsAdmin Products: PAC3 Problem Types: CWE-79 Description: A vulnerability was found in CapsAdmin PAC3. It has been rated as problematic. Affected by this issue is some unknown functionality of the file lua/pac3/core/shared/http.lua. The manipulation of the argument url leads to cross site scripting. The attack may be launched remotely. The patch is identified as 8fc9e12dfa21d757be6eb4194c763e848b299ac0. It is recommended to apply a patch to fix this issue. VDB-217646 is the identifier assigned to this vulnerability. Add
. It is recommended to apply a patch to fix this issue. VDB-217646 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217646 - https://vuldb.com/?ctiid.217646 - https://github.com/CapsAdmin/pac3/pull/1210 - https://github.com/CapsAdmin/pac3/commit/8fc9e12dfa21d757be6eb4194c763e848b299ac0
CVE ID: CVE-2022-4882 State: PUBLISHED Published: 2023-01-09T08:50:13.062Z Last Updated: 2024-08-03T01:55:46.036Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: kaltura Products: mwEmbed Problem Types: CWE-79 Description: A vulnerability was found in kaltura mwEmbed up to 2.91. It has been rated as problematic. Affected by this issue is some unknown functionality of the file modules/KalturaSupport/components/share/share.js of the component Share Plugin. The manipulation of the argument res leads to cross site scripting. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has be
ched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used. Upgrading to version 2.92.rc1 is able to address this issue. The name of the patch is 4f11b6f6610acd6d89de5f8be47cf7c610643845. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-217664. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.217664 - https://vuldb.com/?ctiid.217664 - https://github.com/kaltura/mwEmbed/pull/4255 - https://github.com/kaltura/mwEmbed/commit/4f11b6f6610acd6d89de5f8be47cf7c610643845 - https://github.com/kaltura/mwEmbed/releas
//github.com/kaltura/mwEmbed/commit/4f11b6f6610acd6d89de5f8be47cf7c610643845 - https://github.com/kaltura/mwEmbed/releases/tag/v2.92.rc1
CVE ID: CVE-2022-4883 State: PUBLISHED Published: 2023-02-07T00:00:00.000Z Last Updated: 2025-03-20T19:45:33.470Z Vendors: n/a Products: libXpm Problem Types: CWE-426 Description: A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on the PATH environment variable to find these programs, which could allow a malicious user to execute other programs by manipulating the PATH environment variable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2160213 - https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_r
rences: - https://bugzilla.redhat.com/show_bug.cgi?id=2160213 - https://gitlab.freedesktop.org/xorg/lib/libxpm/-/merge_requests/9 - https://lists.x.org/archives/xorg-announce/2023-January/003312.html - https://gitlab.freedesktop.org/xorg/lib/libxpm/-/commit/515294bb8023a45ff91669 - https://lists.debian.org/debian-lts-announce/2023/06/msg00021.html
CVE ID: CVE-2022-4884 State: PUBLISHED Published: 2023-01-09T16:11:16.227Z Last Updated: 2025-04-08T18:46:15.013Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: Tribe29 Products: Checkmk Problem Types: CWE-22 Description: Path-Traversal in MKP storing in Tribe29 Checkmk <=2.0.0p32 and <= 2.1.0p18 allows an administrator to write mkp files to arbitrary locations via a malicious mkp file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://checkmk.com/werk/15065
CVE ID: CVE-2022-4885 State: PUBLISHED Published: 2023-01-11T17:55:09.931Z Last Updated: 2024-08-03T01:55:46.094Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: sviehb Products: jefferson Problem Types: CWE-22 Description: A vulnerability has been found in sviehb jefferson up to 0.3 and classified as critical. This vulnerability affects unknown code of the file src/scripts/jefferson. The manipulation leads to path traversal. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 0.4 is able to address this issue. The name of the patch is 53b3f2fc34af0bb32afbcee29d18213e61471d87. It is reco
version 0.4 is able to address this issue. The name of the patch is 53b3f2fc34af0bb32afbcee29d18213e61471d87. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218020. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218020 - https://vuldb.com/?ctiid.218020 - https://github.com/sviehb/jefferson/pull/36 - https://github.com/sviehb/jefferson/commit/53b3f2fc34af0bb32afbcee29d18213e61471d87 - https://github.com/sviehb/jefferson/releases/tag/v0.4
CVE ID: CVE-2022-4886 State: PUBLISHED Published: 2023-10-25T19:18:45.982Z Last Updated: 2025-02-13T16:34:04.600Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Kubernetes Products: ingress-nginx Problem Types: CWE-20 Description: Ingress-nginx `path` sanitization can be bypassed with `log_format` directive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubernetes/ingress-nginx/issues/10570 - https://groups.google.com/g/kubernetes-security-announce/c/ge7u3qCwZLI - http://www.openwall.com/lists/oss-security/2023/10/25/5 - https://security.netapp.com/advisory/ntap-20240307-0013/
CVE ID: CVE-2022-4888 State: PUBLISHED Published: 2023-07-31T09:37:32.602Z Last Updated: 2024-10-17T21:09:40.165Z Vendors: Unknown Products: Checkout Fields Manager, Abandoned Cart Recovery, Custom Fields for WooCommerce, Custom Order Number, Custom Registration Forms Builder, Advanced Free Gifts, Gift Registry for WooCommerce, Image Watermark for WooCommerce, Order Approval for WooCommerce, Order Tracking for WooCommerce, Price Calculator for WooCommerce, Product Dynamic Pricing and Discounts, Product Labels and Stickers Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin be
SRF) Description: The Checkout Fields Manager WordPress plugin before 1.0.2, Abandoned Cart Recovery WordPress plugin before 1.2.5, Custom Fields for WooCommerce WordPress plugin before 1.0.4, Custom Order Number WordPress plugin through 1.0.1, Custom Registration Forms Builder WordPress plugin before 1.0.2, Advanced Free Gifts WordPress plugin before 1.0.2, Gift Registry for WooCommerce WordPress plugin through 1.0.1, Image Watermark for WooCommerce WordPress plugin before 1.0.1, Order Approval for WooCommerce WordPress plugin before 1.1.0, Order Tracking for WooCommerce WordPress plugin before 1.0.2, Price Calculator for WooCommerce WordPress plugin through 1.0.3, Product Dynamic Pricing a
ordPress plugin before 1.0.2, Price Calculator for WooCommerce WordPress plugin through 1.0.3, Product Dynamic Pricing and Discounts WordPress plugin through 1.0.6, Product Labels and Stickers WordPress plugin through 1.0.1 have flawed CSRF checks in various places, which could allow attackers to make logged in users perform unwanted actions Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2c2379d0-e373-4587-a747-429d7ee8f6cc
CVE ID: CVE-2022-4889 State: PUBLISHED Published: 2023-01-15T07:23:25.010Z Last Updated: 2024-08-03T01:55:46.032Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: visegripped Products: Stracker Problem Types: CWE-89 Description: A vulnerability classified as critical was found in visegripped Stracker. Affected by this vulnerability is the function getHistory of the file doc_root/public_html/stracker/api.php. The manipulation of the argument symbol/startDate/endDate leads to sql injection. The identifier of the patch is 63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this
65ecf5ae1603d29e0a. It is recommended to apply a patch to fix this issue. The identifier VDB-218377 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218377 - https://vuldb.com/?ctiid.218377 - https://github.com/visegripped/stracker/pull/16 - https://github.com/visegripped/stracker/commit/63e1b040373ee5b6c7d1e165ecf5ae1603d29e0a
CVE ID: CVE-2022-4890 State: PUBLISHED Published: 2023-01-16T12:58:03.551Z Last Updated: 2025-04-07T17:43:56.957Z Severity: N/A (CVSS 6.5 AV:N/AC:L/Au:S/C:P/I:P/A:P) Vendors: abhilash1985 Products: PredictApp Problem Types: CWE-502 Description: A vulnerability, which was classified as critical, has been found in abhilash1985 PredictApp. This issue affects some unknown processing of the file config/initializers/new_framework_defaults_7_0.rb of the component Cookie Handler. The manipulation leads to deserialization. The attack may be initiated remotely. The patch is named b067372f3ee26fe1b657121f0f41883ff4461a06. It is recommended to apply a patch to fix this issue. The associated identifier o
7372f3ee26fe1b657121f0f41883ff4461a06. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218387. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.218387 - https://vuldb.com/?ctiid.218387 - https://github.com/abhilash1985/PredictApp/pull/73 - https://github.com/abhilash1985/PredictApp/commit/b067372f3ee26fe1b657121f0f41883ff4461a06
CVE ID: CVE-2022-4891 State: PUBLISHED Published: 2023-01-17T19:58:03.654Z Last Updated: 2024-08-03T01:55:45.948Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Sisimai Problem Types: CWE-1333 Description: A vulnerability has been found in Sisimai up to 4.25.14p11 and classified as problematic. This vulnerability affects the function to_plain of the file lib/sisimai/string.rb. The manipulation leads to inefficient regular expression complexity. The exploit has been disclosed to the public and may be used. Upgrading to version 4.25.14p12 is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e. It is recomme
25.14p12 is able to address this issue. The name of the patch is 51fe2e6521c9c02b421b383943dc9e4bbbe65d4e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-218452. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218452 - https://vuldb.com/?ctiid.218452 - https://github.com/sisimai/rb-sisimai/pull/244 - https://gist.githubusercontent.com/gmcabrita/e5dc0332473fc2e3a7a407434c8d21c7/raw/00b12035e5e1b685469f143b94301a50306376ba/example.html - https://github.com/sisimai/rb-sisimai/commit/51fe2e6521c9c02b421b383943dc9e4bbbe65d4e - https://github.com/sisimai/rb-sisimai/releases/tag/v4.25.14p12
CVE ID: CVE-2022-4892 State: PUBLISHED Published: 2023-01-19T07:58:08.343Z Last Updated: 2024-08-03T01:55:46.082Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: n/a Products: MyCMS Problem Types: CWE-79 Description: A vulnerability was found in MyCMS. It has been classified as problematic. This affects the function build_view of the file lib/gener/view.php of the component Visitors Module. The manipulation of the argument original/converted leads to cross site scripting. It is possible to initiate the attack remotely. The patch is named d64fcba4882a50e21cdbec3eb4a080cb694d26ee. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability i
4a080cb694d26ee. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-218895. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.218895 - https://vuldb.com/?ctiid.218895 - https://github.com/andrzuk/MyCMS/commit/d64fcba4882a50e21cdbec3eb4a080cb694d26ee
CVE ID: CVE-2022-4893 State: REJECTED Published: N/A Last Updated: 2023-04-14T00:00:00 Description: No description available.
CVE ID: CVE-2022-4894 State: PUBLISHED Published: 2023-08-16T20:13:46.840Z Last Updated: 2024-08-03T01:55:45.868Z Vendors: HP Inc. Products: HP and Samsung Printer software Description: Certain HP and Samsung Printer software packages may potentially be vulnerable to elevation of privilege due to Uncontrolled Search Path Element. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_8947379-8947403-16/hpsbpi03857
CVE ID: CVE-2022-4895 State: PUBLISHED Published: 2023-02-28T02:03:52.626Z Last Updated: 2025-03-07T18:13:40.385Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L) Vendors: Hitachi Products: Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer Problem Types: CWE-295 Description: Improper Certificate Validation vulnerability in Hitachi Infrastructure Analytics Advisor on Linux (Analytics probe component), Hitachi Ops Center Analyzer on Linux (Analyzer probe component) allows Man in the Middle Attack.This issue affects Hitachi Infrastructure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.1-00. Add
ure Analytics Advisor: from 2.0.0-00 through 4.4.0-00; Hitachi Ops Center Analyzer: from 10.0.0-00 before 10.9.1-00. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-105/index.html
CVE ID: CVE-2022-4896 State: PUBLISHED Published: 2023-09-12T07:22:31.048Z Last Updated: 2024-09-26T14:16:42.964Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H) Vendors: Control de Ciber Products: Control de Ciber Problem Types: CWE-400 Description: Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows with the messages "PNTMEDIDAS", "PEDIR", "HAYDISCOA" or "SPOOLER". A complete denial of service can be achieved by sending multiple requests simultaneously on a core. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/
tes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso/multiple-vulnerabilities-control-de-ciber
CVE ID: CVE-2022-4897 State: PUBLISHED Published: 2023-02-21T08:50:50.848Z Last Updated: 2025-03-14T13:47:04.786Z Vendors: Unknown Products: BackupBuddy Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The BackupBuddy WordPress plugin before 8.8.3 does not sanitise and escape some parameters before outputting them back in various places, leading to Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/7b0eeafe-b9bc-43b2-8487-a23d3960f73f
CVE ID: CVE-2022-4898 State: PUBLISHED Published: 2023-01-31T00:00:00.000Z Last Updated: 2025-03-27T14:39:44.384Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Stored Cross-Site Scripting (XSS) Description: In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link. This was initially resolved in advisory 2022-07 however it was identified that the fix could be bypassed in certain circumstances. A different approach was taken to prevent the possibility of the support link being susceptible to XSS Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://adviso
ceptible to XSS Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://advisories.octopus.com/post/2022/sa2023-01/
CVE ID: CVE-2022-4899 State: PUBLISHED Published: 2023-03-31T00:00:00.000Z Last Updated: 2025-02-18T17:23:22.964Z Vendors: n/a Products: zstd Problem Types: CWE-400 Description: A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer overrun. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/facebook/zstd/issues/3200 - https://security.netapp.com/advisory/ntap-20230725-0005/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/ - https://lists.fedoraproject.org/archives/li
nounce%40lists.fedoraproject.org/message/C63HAGVLQA6FJNDCHR7CNZZL6VSLILB2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JEHRBBYYTPA4DETOM5XAKGCP37NUTLOA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QYLDK6ODVC4LJSDULLX6Q2YHTFOWABCN/
CVE ID: CVE-2022-4900 State: PUBLISHED Published: 2023-11-02T15:01:28.590Z Last Updated: 2025-11-03T21:46:48.606Z Severity: MEDIUM (CVSS 6.2 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: php, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Software Collections, Fedora Problem Types: CWE-119 Description: A vulnerability was found in PHP where setting the environment variable PHP_CLI_SERVER_WORKERS to a large value leads to a heap buffer overflow. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2022-4900 - https://bugzilla.r
Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2022-4900 - https://bugzilla.redhat.com/show_bug.cgi?id=2179880 - https://security.netapp.com/advisory/ntap-20231130-0008/
CVE ID: CVE-2022-4901 State: PUBLISHED Published: 2023-03-01T00:00:00.000Z Last Updated: 2025-03-07T20:41:28.568Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Sophos Products: Sophos Connect Client Problem Types: n/a Description: Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a malicious VPN configuration that must be manually loaded by the victim. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20230301-scc-csrf
CVE ID: CVE-2022-4902 State: PUBLISHED Published: 2023-02-06T18:31:03.651Z Last Updated: 2024-08-03T01:55:46.060Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: eXo Products: Chat Application Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in eXo Chat Application. Affected is an unknown function of the file application/src/main/webapp/vue-app/components/ExoChatMessageComposer.vue of the component Mention Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 3.3.0-20220417 is able to address this issue. The name of the patch is 26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc.
version 3.3.0-20220417 is able to address this issue. The name of the patch is 26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-220212. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.220212 - https://vuldb.com/?ctiid.220212 - https://github.com/exoplatform/chat-application/pull/485 - https://community.exoplatform.com/portal/dw/tasks/taskDetail/56304 - https://github.com/exoplatform/chat-application/commit/26bf307d3658d1403cfd5c3ad423ce4c4d1cb2dc - https://github.com/exoplatform/chat-application/releases/tag/3.3.0-20220417
CVE ID: CVE-2022-4903 State: PUBLISHED Published: 2023-02-10T14:31:04.394Z Last Updated: 2025-03-24T18:38:11.304Z Severity: N/A (CVSS 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P) Vendors: n/a Products: CodenameOne Problem Types: CWE-927 Description: A vulnerability was found in CodenameOne 7.0.70. It has been classified as problematic. Affected is an unknown function. The manipulation leads to use of implicit intent for sensitive communication. It is possible to launch the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. Upgrading to version 7.0.71 is able to address this issue. The patch is identified as dad49c9ef26a598619fc48d2697151a02987d478. It