Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0949 State: PUBLISHED Published: 2022-04-11T14:40:59 Last Updated: 2024-08-02T23:47:42.892Z Vendors: Unknown Products: Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection Problem Types: CWE-89 Description: The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a0fbb79a-e160-49df-9cf2-18
tional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a0fbb79a-e160-49df-9cf2-18ab64ea66cb
CVE ID: CVE-2022-0950 State: PUBLISHED Published: 2022-03-15T08:20:10 Last Updated: 2024-08-02T23:47:43.257Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/acc23996-bd57-448f-9eb4-05a8a046c2dc - https://github.com/star7th/showdoc/commit/237ac6d43bf3728bf3587c486a23b4a48ea7acb3
CVE ID: CVE-2022-0951 State: PUBLISHED Published: 2022-03-15T08:20:15 Last Updated: 2024-08-02T23:47:43.353Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-434 Description: File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/star7th/showdoc/commit/237ac6d43bf3728bf3587c486a23b4a48ea7acb3 - https://huntr.dev/bounties/b3a983a3-17f9-4aa8-92d7-8a0c92a93932
CVE ID: CVE-2022-0952 State: PUBLISHED Published: 2022-05-02T16:05:46 Last Updated: 2024-08-02T23:47:43.044Z Vendors: Unknown Products: Sitemap by click5 Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog. Additional Analyst Notes: - CVE Program
efault_role, allowing them to create a new admin account and take over the blog. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0f694961-afab-44f9-846c-e80a0f6c768b
CVE ID: CVE-2022-0953 State: PUBLISHED Published: 2022-04-25T15:51:12 Last Updated: 2024-08-02T23:47:42.945Z Vendors: Unknown Products: Anti-Malware Security and Brute-Force Firewall Problem Types: CWE-79 Description: The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/29ab3c7b-58e0-4a72-b7b4-ab12a6d54f5a
CVE ID: CVE-2022-0954 State: PUBLISHED Published: 2022-03-15T11:40:09 Last Updated: 2024-08-02T23:47:42.911Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b99517c0-37fc-4efa-ab1a-3591da7f4d26 - https://github.com/microweber/microweber/commit/955471c27e671c49e4b012e3b120b004082ac3f7
CVE ID: CVE-2022-0955 State: PUBLISHED Published: 2022-03-24T14:45:15 Last Updated: 2024-08-02T23:47:43.224Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: pimcore Products: pimcore/data-hub Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/708971a6-1e6c-4c51-a411-255caeba51df - https://github.com/pimcore/data-hub/commit/15d5b57af2466eebd3bbc531ead5dafa35d0a36e
CVE ID: CVE-2022-0956 State: PUBLISHED Published: 2022-03-15T12:20:10 Last Updated: 2024-08-02T23:47:43.165Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-79 Description: Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5b0e3f02-309f-4b59-8020-d7ac0f1999f2 - https://github.com/star7th/showdoc/commit/56e450c3adf75c707500d7231a78c9fc894c7f13
CVE ID: CVE-2022-0957 State: PUBLISHED Published: 2022-03-15T12:30:12 Last Updated: 2024-08-02T23:47:42.901Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-79 Description: Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b4918d45-b635-40db-bb4b-34035e1aca21 - https://github.com/star7th/showdoc/commit/d1c9ed0d77ea5d56f09be0c492361dca8af745bb
CVE ID: CVE-2022-0958 State: PUBLISHED Published: 2022-04-04T15:35:59 Last Updated: 2024-08-02T23:47:43.271Z Vendors: Unknown Products: Mark Posts Problem Types: CWE-79 Description: The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/05034521-6eb9-43b9-8f03-7e0de60e3022 - https://plugins.trac.wordpress.org/changeset/2679436
CVE ID: CVE-2022-0959 State: PUBLISHED Published: 2022-03-16T14:03:38 Last Updated: 2024-08-02T23:47:42.970Z Vendors: n/a Products: pgadmin Problem Types: CWE-434 Description: A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to any location that the operating system user account under which pgAdmin is running has permission to write. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2063759
CVE ID: CVE-2022-0960 State: PUBLISHED Published: 2022-03-14T14:45:13 Last Updated: 2024-08-02T23:47:42.832Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-434 Description: Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/462cd8a7-b1a9-4e93-af71-b56ba1d7ad4e - https://github.com/star7th/showdoc/commit/92bc6a83a3a60e01a0d2effb98ab47d8d7eab28f
CVE ID: CVE-2022-0961 State: PUBLISHED Published: 2022-03-15T14:55:10 Last Updated: 2024-08-02T23:47:42.940Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-190 Description: The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/cdf00e14-38a7-4b6b-9bb4-3a71bf24e436 - https://github.com/microweber/microweber/commit/f7acbd075df
://huntr.dev/bounties/cdf00e14-38a7-4b6b-9bb4-3a71bf24e436 - https://github.com/microweber/microweber/commit/f7acbd075dff4825b35b597b74958de9edce67fc
CVE ID: CVE-2022-0962 State: PUBLISHED Published: 2022-03-14T15:30:15 Last Updated: 2024-08-02T23:47:42.908Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-434 Description: Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7ebe3e5f-2c86-44de-b83e-2ddb6bbda908 - https://github.com/star7th/showdoc/commit/3caa32334db0c277b84e993eaca2036f5d1dbef8
CVE ID: CVE-2022-0963 State: PUBLISHED Published: 2022-03-15T15:30:13 Last Updated: 2024-08-02T23:47:42.993Z Severity: MEDIUM (CVSS 5.7 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a89a4198-0880-4aa2-8439-a463f39f244c - https://github.com/microweber/microweber/commit/975fc1d6d3fba598ee550849ceb81af23ce72e08
CVE ID: CVE-2022-0964 State: PUBLISHED Published: 2022-03-15T15:35:29 Last Updated: 2024-08-02T23:47:43.228Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-79 Description: Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/star7th/showdoc/commit/3caa32334db0c277b84e993eaca2036f5d1dbef8 - https://huntr.dev/bounties/dbe39998-8eb7-46ea-997f-7b27f6f16ea0
CVE ID: CVE-2022-0965 State: PUBLISHED Published: 2022-03-15T15:35:23 Last Updated: 2024-08-02T23:47:42.789Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-79 Description: Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/star7th/showdoc/commit/3caa32334db0c277b84e993eaca2036f5d1dbef8 - https://huntr.dev/bounties/d66c88ce-63e2-4515-a429-8e43a42aa347
CVE ID: CVE-2022-0966 State: PUBLISHED Published: 2022-03-15T15:35:17 Last Updated: 2024-08-02T23:47:42.947Z Severity: MEDIUM (CVSS 6.4 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-79 Description: Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/star7th/showdoc/commit/3caa32334db0c277b84e993eaca2036f5d1dbef8 - https://huntr.dev/bounties/e06c0d55-00a3-4f82-a009-0310b2e402fe
CVE ID: CVE-2022-0967 State: PUBLISHED Published: 2022-03-15T15:35:11 Last Updated: 2024-08-02T23:47:42.920Z Severity: MEDIUM (CVSS 6.9 CVSS:3.0/AV:P/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: star7th Products: star7th/showdoc Problem Types: CWE-79 Description: Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/star7th/showdoc/commit/3caa32334db0c277b84e993eaca2036f5d1dbef8 - https://huntr.dev/bounties/9dea3c98-7609-480d-902d-149067bd1e2a - http://packetstormsecurity.com/files/167198/Showdoc-2.10.3-Cross-Site-Scripting.html
CVE ID: CVE-2022-0968 State: PUBLISHED Published: 2022-03-15T15:40:18 Last Updated: 2024-08-02T23:47:42.838Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-190 Description: The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/97e36678-11cf-42c6-889c-892d415d9f9e - https://github.com/microwebe
Container: References: - https://huntr.dev/bounties/97e36678-11cf-42c6-889c-892d415d9f9e - https://github.com/microweber/microweber/commit/80e39084729a57dfe749626c3b9d35247a14c49e
CVE ID: CVE-2022-0969 State: PUBLISHED Published: 2022-04-11T14:41:01 Last Updated: 2024-08-02T23:47:42.871Z Vendors: Unknown Products: Image optimization & Lazy Load by Optimole Problem Types: CWE-79 Description: The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/59a7a441-7384-4006-89b4-15345f70fabf - https://plugins.trac.wordpress.org/ch
erences: - https://wpscan.com/vulnerability/59a7a441-7384-4006-89b4-15345f70fabf - https://plugins.trac.wordpress.org/changeset/2695242
CVE ID: CVE-2022-0970 State: PUBLISHED Published: 2022-03-15T16:40:10 Last Updated: 2024-08-02T23:47:42.914Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: getgrav Products: getgrav/grav Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository getgrav/grav prior to 1.7.31. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/dd436c44-cbf4-48ac-8817-3a24872534ec - https://github.com/getgrav/grav/commit/f19297d5f70476e7bedae9f2acef6b43615538b8
CVE ID: CVE-2022-0971 State: PUBLISHED Published: 2022-07-21T21:05:23 Last Updated: 2024-08-02T23:47:43.267Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Blink Layout in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1299422 - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-0972 State: PUBLISHED Published: 2022-07-21T21:05:27 Last Updated: 2024-08-02T23:47:42.984Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Extensions in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html - https://crbug.com/1301320 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-0973 State: PUBLISHED Published: 2022-07-21T21:05:33 Last Updated: 2024-08-02T23:47:43.250Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Safe Browsing in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html - https://crbug.com/1297498 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-0974 State: PUBLISHED Published: 2022-07-21T21:05:39 Last Updated: 2024-08-02T23:47:42.820Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Splitscreen in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html - https://crbug.com/1291986 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-0975 State: PUBLISHED Published: 2022-07-21T21:05:45 Last Updated: 2024-08-02T23:47:43.223Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html - https://crbug.com/1295411 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-0976 State: PUBLISHED Published: 2022-07-21T21:05:51 Last Updated: 2024-08-02T23:47:43.284Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in GPU in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html - https://crbug.com/1296866 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-0977 State: PUBLISHED Published: 2022-07-21T21:05:58 Last Updated: 2024-08-02T23:47:42.933Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Browser UI in Google Chrome on Chrome OS prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html - https://crbug.com/1299225 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-0978 State: PUBLISHED Published: 2022-07-21T21:06:08 Last Updated: 2024-08-02T23:47:42.924Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in ANGLE in Google Chrome prior to 99.0.4844.74 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html - https://crbug.com/1299264 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-0979 State: PUBLISHED Published: 2022-07-21T21:06:15 Last Updated: 2024-08-02T23:47:42.938Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Safe Browsing in Google Chrome on Android prior to 99.0.4844.74 allowed a remote attacker who convinced a user to engage in specific user interaction to potentially exploit heap corruption via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html - https://crbug.com/1302644 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-0980 State: PUBLISHED Published: 2022-07-21T21:06:22 Last Updated: 2024-08-02T23:47:42.981Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in New Tab Page in Google Chrome prior to 99.0.4844.74 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via specific user interactions. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_15.html - https://crbug.com/1302157 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-0981 State: PUBLISHED Published: 2022-03-23T19:46:41 Last Updated: 2024-08-02T23:47:43.241Z Vendors: n/a Products: quarkus Problem Types: CWE-863 Description: A flaw was found in Quarkus. The state and potentially associated permissions can leak from one web request to another in RestEasy Reactive. This flaw allows a low-privileged user to perform operations on the database with a different set of privileges than intended. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2062520 - https://github.com/quarkusio/quarkus/issues/23269
CVE ID: CVE-2022-0982 State: PUBLISHED Published: 2022-03-16T14:04:22.485737Z Last Updated: 2024-09-17T04:20:24.462Z Vendors: https://accel-ppp.org/ Products: Accel-PPP Problem Types: https://cwe.mitre.org/data/definitions/120.html Description: The telnet_input_char function in opt/src/accel-pppd/cli/telnet.c suffers from a memory corruption vulnerability, whereby user input cmdline_len is copied into a fixed buffer b->buf without any bound checks. If the server connects with a malicious client, crafted client requests can remotely trigger this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/xebd/accel-ppp/issues/164
CVE ID: CVE-2022-0983 State: PUBLISHED Published: 2022-03-25T18:03:07 Last Updated: 2024-08-02T23:47:42.821Z Vendors: n/a Products: moodle Problem Types: CWE-89 Description: An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2064119 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/G4GRMWBGHOJMFXMTORECQNULJK7ZJJ6Y/
CVE ID: CVE-2022-0984 State: PUBLISHED Published: 2022-04-29T16:05:10 Last Updated: 2024-08-02T23:47:43.231Z Vendors: n/a Products: moodle Problem Types: CWE-863 Description: Users with the capability to configure badge criteria (teachers and managers by default) were able to configure course badges with profile field criteria, which should only be available for site badges. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2064118
CVE ID: CVE-2022-0985 State: PUBLISHED Published: 2022-04-29T15:48:30 Last Updated: 2024-08-02T23:47:42.833Z Vendors: n/a Products: moodle Problem Types: CWE-287 Description: Insufficient capability checks could allow users with the moodle/site:uploadusers capability to delete users, without having the necessary moodle/user:delete capability. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2064117
CVE ID: CVE-2022-0986 State: PUBLISHED Published: 2022-03-16T12:45:12 Last Updated: 2024-08-02T23:47:43.232Z Severity: LOW (CVSS 2.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N) Vendors: hestiacp Products: hestiacp/hestiacp Problem Types: CWE-79 Description: Reflected Cross-site Scripting (XSS) Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/57635c78-303f-412f-b75a-623df9fa9edd - https://github.com/hestiacp/hestiacp/commit/fd42196718a6fa7fe17b37fab0933d3cbcb3db0d
CVE ID: CVE-2022-0987 State: PUBLISHED Published: 2022-06-28T16:09:26 Last Updated: 2024-08-02T23:47:42.975Z Vendors: n/a Products: PackageKit Problem Types: CWE-200 Description: A flaw was found in PackageKit in the way some of the methods exposed by the Transaction interface examines files. This issue allows a local user to measure the time the methods take to execute and know whether a file owned by root or other users exists. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2064315