Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4948 State: PUBLISHED Published: 2023-06-07T01:51:25.584Z Last Updated: 2024-12-20T23:52:51.217Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: FlyingWeb Products: FlyingPress Problem Types: CWE-862 Missing Authorization Description: The FlyingPress plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 3.9.6. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to interact with the plugin in ways administrators are intended to. One action (save_config) allows for the configuration of an external CDN. This
in ways administrators are intended to. One action (save_config) allows for the configuration of an external CDN. This could be used to include malicious javascript from a source controlled by the attacker. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6d1d541b-7010-4dbf-9b1c-d59c84390065?source=cve - https://blog.nintechnet.com/wordpress-flyingpress-plugin-fixed-broken-access-control-vulnerability/
CVE ID: CVE-2022-4949 State: PUBLISHED Published: 2023-06-07T01:51:50.838Z Last Updated: 2025-02-13T16:38:38.288Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: https://adsanityplugin.com/ Products: AdSanity Problem Types: CWE-434 Unrestricted Upload of File with Dangerous Type Description: The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with Contributor+ level privileges to upload arbitrary files on the affected sites server which makes remote code execution possible. Additiona
privileges to upload arbitrary files on the affected sites server which makes remote code execution possible. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/effd72d2-876d-4f8d-b1e4-5ab38eab401b?source=cve - https://blog.nintechnet.com/critical-vulnerability-in-wordpress-adsanity-plugin/ - http://xenbits.xen.org/xsa/advisory-443.html - http://www.openwall.com/lists/oss-security/2023/11/09/3
CVE ID: CVE-2022-4950 State: PUBLISHED Published: 2023-06-07T01:51:53.458Z Last Updated: 2024-12-23T16:20:36.227Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: narinder-singh, blackworks1, coolplugins Products: The Events Calendar Countdown Addon, The Events Calendar Events Notification Bar Addon, Cool Timeline (Horizontal & Vertical Timeline), Cryptocurrency Payment & Donation Box – Accept Payments in any Cryptocurrency on your WP Site for Free, Events Search For The Events Calendar, Cryptocurrency Widgets For Elementor, Event Single Page Builder For The Event Calendar, Events Shortcodes For The Events Calendar, Cryptocurrency Widgets – Price Ticker & Coins
Builder For The Event Calendar, Events Shortcodes For The Events Calendar, Cryptocurrency Widgets – Price Ticker & Coins List, Events Widgets For Elementor And The Events Calendar Problem Types: CWE-862 Missing Authorization Description: Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve - https://plugins.trac.wordpress.org/
om/threat-intel/vulnerabilities/id/f6f0fb78-ad6b-4a9e-ae1a-5793f3426379?source=cve - https://plugins.trac.wordpress.org/changeset/2705076/cool-timeline/trunk/admin/timeline-addon-page/timeline-addon-page.php - https://blog.nintechnet.com/8-wordpress-plugins-fixed-high-severity-vulnerability/
CVE ID: CVE-2022-4952 State: PUBLISHED Published: 2023-07-17T02:00:03.787Z Last Updated: 2024-08-03T01:55:46.088Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: OmniSharp Products: csharp-language-server-protocol Problem Types: CWE-400 Description: A vulnerability has been found in OmniSharp csharp-language-server-protocol up to 0.19.6 and classified as problematic. This vulnerability affects the function CreateSerializerSettings of the file src/JsonRpc/Serialization/SerializerBase.cs of the component JSON Serializer. The manipulation leads to resource consumption. Upgrading to version 0.19.7 is able to address this issue. The patch is identified as 7fd2219f19
o resource consumption. Upgrading to version 0.19.7 is able to address this issue. The patch is identified as 7fd2219f194a9ef2a8901bb131c5fa12272305ce. It is recommended to upgrade the affected component. VDB-234238 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.234238 - https://vuldb.com/?ctiid.234238 - https://github.com/OmniSharp/csharp-language-server-protocol/pull/902 - https://github.com/OmniSharp/csharp-language-server-protocol/commit/7fd2219f194a9ef2a8901bb131c5fa12272305ce - https://github.com/OmniSharp/csharp-language-server-protocol/releases/tag/v0.19.7
CVE ID: CVE-2022-4953 State: PUBLISHED Published: 2023-08-14T19:10:18.365Z Last Updated: 2024-08-03T01:55:46.165Z Vendors: Unknown Products: Elementor Website Builder Problem Types: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) Description: The Elementor Website Builder WordPress plugin before 3.5.5 does not filter out user-controlled URLs from being loaded into the DOM. This could be used to inject rogue iframes that point to malicious URLs. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/8273357e-f9e1-44bc-8082-8faab838eda7 - https://github.com/elementor/elementor/commit/292fc49e0f979bd52d838f0326d1faa
ity/8273357e-f9e1-44bc-8082-8faab838eda7 - https://github.com/elementor/elementor/commit/292fc49e0f979bd52d838f0326d1faaebfa59f5e
CVE ID: CVE-2022-4954 State: PUBLISHED Published: 2023-10-20T06:35:14.619Z Last Updated: 2025-02-05T19:10:34.573Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: pluginbuilders Products: Waiting: One-click countdowns Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Waiting: One-click countdowns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Countdown name in versions up to, and including, 0.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inj
put escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/2ef5b0de-0b8b-4286-86ea-6dca0dbc1a52?source=cve - https://plugins.trac.wordpress.org/browser/waiting/trunk/waiting.php?rev=2826039
CVE ID: CVE-2022-4955 State: PUBLISHED Published: 2023-08-04T19:13:28.553Z Last Updated: 2024-08-03T01:55:46.242Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_29.html - https://crbug.com/1349146
CVE ID: CVE-2022-4956 State: PUBLISHED Published: 2023-09-30T17:00:05.382Z Last Updated: 2024-08-03T01:55:46.100Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Caphyon Products: Advanced Installer Problem Types: CWE-427 Description: A vulnerability classified as critical has been found in Caphyon Advanced Installer 19.7. This affects an unknown part of the component WinSxS DLL Handler. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used. Upgrading to version 19.7.1 is able to address this issue. It is recommended to upgrade the affected component. The associated
ng to version 19.7.1 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-240903. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.240903 - https://vuldb.com/?ctiid.240903 - https://heegong.github.io/posts/Advaned-Installer-Local-Privilege-Escalation-Vulnerability/ - https://www.advancedinstaller.com/release-19.7.1.html#bugfixes
CVE ID: CVE-2022-4957 State: PUBLISHED Published: 2023-12-03T19:00:04.692Z Last Updated: 2025-06-03T02:17:16.540Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: librespeed Products: speedtest Problem Types: CWE-79 Description: A vulnerability was found in librespeed speedtest up to 5.2.4. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file results/stats.php. The manipulation of the argument id leads to cross site scripting. The attack can be launched remotely. Upgrading to version 5.2.5 is able to address this issue. The patch is named a85f2c086f3449dffa8fe2edb5e2ef3ee72dc0e9. It is recommended to upgrade the affected compon
his issue. The patch is named a85f2c086f3449dffa8fe2edb5e2ef3ee72dc0e9. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-246643. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.246643 - https://vuldb.com/?ctiid.246643 - https://github.com/librespeed/speedtest/commit/a85f2c086f3449dffa8fe2edb5e2ef3ee72dc0e9 - https://github.com/librespeed/speedtest/releases/tag/5.2.5
CVE ID: CVE-2022-4958 State: PUBLISHED Published: 2024-01-11T11:31:03.460Z Last Updated: 2025-06-17T20:07:39.913Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: qkmc-rk Products: redbbs Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in qkmc-rk redbbs 1.0. Affected is an unknown function of the component Post Handler. The manipulation of the argument title leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-250236. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http
nerability is VDB-250236. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250236 - https://vuldb.com/?ctiid.250236 - https://github.com/qkmc-rk/redbbs/issues/1
CVE ID: CVE-2022-4959 State: PUBLISHED Published: 2024-01-11T20:31:03.369Z Last Updated: 2024-10-25T20:32:48.342Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: qkmc-rk Products: redbbs Problem Types: CWE-79 Description: A vulnerability classified as problematic was found in qkmc-rk redbbs 1.0. Affected by this vulnerability is an unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-250237 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: -
ssigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250237 - https://vuldb.com/?ctiid.250237 - https://github.com/qkmc-rk/redbbs/issues/2
CVE ID: CVE-2022-4960 State: PUBLISHED Published: 2024-01-12T02:31:04.016Z Last Updated: 2025-05-14T15:44:46.673Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: cloudfavorites Products: favorites-web Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in cloudfavorites favorites-web 1.3.0. Affected by this issue is some unknown functionality of the component Nickname Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-250238 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container
be used. VDB-250238 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250238 - https://vuldb.com/?ctiid.250238 - https://github.com/cloudfavorites/favorites-web/issues/127
CVE ID: CVE-2022-4961 State: PUBLISHED Published: 2024-01-12T05:00:05.110Z Last Updated: 2025-06-16T18:45:43.932Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Weitong Products: Mall Problem Types: CWE-89 Description: A vulnerability was found in Weitong Mall 1.0.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file platform-shop\src\main\resources\com\platform\dao\OrderDao.xml. The manipulation of the argument sidx/order leads to sql injection. The associated identifier of this vulnerability is VDB-250243. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:/
ability is VDB-250243. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250243 - https://vuldb.com/?ctiid.250243 - https://gitee.com/fuyang_lipengjun/platform/issues/I5XC79
CVE ID: CVE-2022-4962 State: PUBLISHED Published: 2024-01-12T22:00:04.477Z Last Updated: 2025-02-13T16:38:38.950Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: n/a Products: Apollo Problem Types: CWE-285 Description: A vulnerability was found in Apollo 2.0.0/2.0.1 and classified as problematic. Affected by this issue is some unknown functionality of the file /users of the component Configuration Center. The manipulation leads to improper authorization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assign
ay be used. The real existence of this vulnerability is still doubted at the moment. VDB-250430 is the identifier assigned to this vulnerability. NOTE: The maintainer explains that user data information like user id, name, and email are not sensitive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.250430 - https://vuldb.com/?ctiid.250430 - https://github.com/apolloconfig/apollo/issues/4684
CVE ID: CVE-2022-4963 State: PUBLISHED Published: 2024-03-20T18:31:04.616Z Last Updated: 2024-08-20T17:39:55.321Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Folio Products: Spring Module Core Problem Types: CWE-89 Description: A vulnerability was found in Folio Spring Module Core up to 1.1.5. It has been rated as critical. Affected by this issue is the function dropSchema of the file tenant/src/main/java/org/folio/spring/tenant/hibernate/HibernateSchemaService.java of the component Schema Name Handler. The manipulation leads to sql injection. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is d374a5f77e6b58e36f0e0e4419be1
ection. Upgrading to version 2.0.0 is able to address this issue. The name of the patch is d374a5f77e6b58e36f0e0e4419be18b95edcd7ff. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-257516. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.257516 - https://vuldb.com/?ctiid.257516 - https://github.com/folio-org/spring-module-core/pull/39 - https://github.com/folio-org/spring-module-core/commit/d374a5f77e6b58e36f0e0e4419be18b95edcd7ff - https://github.com/folio-org/spring-module-core/releases/tag/v2.0.0
CVE ID: CVE-2022-4964 State: PUBLISHED Published: 2024-01-24T00:58:14.236Z Last Updated: 2025-06-20T19:20:11.172Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: Canonical Ltd. Products: Ubuntu pipewire-pulse Description: Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/ubuntu/+source/pipewire/+bug/1995707/ - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4964 - https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1779 - https://gitlab.freedesktop.org/pipew
022-4964 - https://gitlab.freedesktop.org/pipewire/pipewire/-/merge_requests/1779 - https://gitlab.freedesktop.org/pipewire/wireplumber/-/merge_requests/567
CVE ID: CVE-2022-4965 State: PUBLISHED Published: 2024-04-09T19:05:06.563Z Last Updated: 2024-08-03T01:55:46.097Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: CreativeMinds Products: Invitation Code Content Restriction Plugin from CreativeMinds Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Invitation Code Content Restriction Plugin from CreativeMinds plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘target_id’ parameter in all versions up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for un
ns up to, and including, 1.5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d3d0f705-2458-4cc6-8730-997314084f24?source=cve - https://www.cminds.com/changelog/?id=255
CVE ID: CVE-2022-4966 State: PUBLISHED Published: 2024-04-01T12:00:06.142Z Last Updated: 2024-08-19T17:13:26.894Z Severity: N/A (CVSS 4 AV:N/AC:L/Au:S/C:N/I:P/A:N) Vendors: sequentech Products: admin-console Problem Types: CWE-79 Description: A vulnerability was found in sequentech admin-console up to 6.1.7 and classified as problematic. Affected by this issue is some unknown functionality of the component Election Description Handler. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 7.0.0-beta.1 is able to address this issue. The patch is identified as 0043a6b1e6e0f5abc9557e73f9ffc524fc5d609d. It is recommended to upgrade the affected
is issue. The patch is identified as 0043a6b1e6e0f5abc9557e73f9ffc524fc5d609d. It is recommended to upgrade the affected component. VDB-258782 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.258782 - https://vuldb.com/?ctiid.258782 - https://github.com/sequentech/admin-console/pull/292 - https://github.com/sequentech/admin-console/pull/293 - https://github.com/sequentech/admin-console/commit/0043a6b1e6e0f5abc9557e73f9ffc524fc5d609d - https://github.com/sequentech/admin-console/releases/tag/7.0.0-beta.1
CVE ID: CVE-2022-4967 State: PUBLISHED Published: 2024-05-13T12:09:19.104Z Last Updated: 2025-02-13T16:38:39.882Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: strongSwan Products: strongSwan Problem Types: CWE-297 Description: strongSwan versions 5.9.2 through 5.9.5 are affected by authorization bypass through improper validation of certificate with host mismatch (CWE-297). When certificates are used to authenticate clients in TLS-based EAP methods, the IKE or EAP identity supplied by a client is not enforced to be contained in the client's certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their
s certificate. So clients can authenticate with any trusted certificate and claim an arbitrary IKE/EAP identity as their own. This is problematic if the identity is used to make policy decisions. A fix was released in strongSwan version 5.9.6 in August 2022 (e4b4aabc4996fc61c37deab7858d07bc4d220136). Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/strongswan/strongswan/commit/e4b4aabc4996fc61c37deab7858d07bc4d220136 - https://www.strongswan.org/blog/2024/05/13/strongswan-vulnerability-(cve-2022-4967).html - https://www.cve.org/CVERecord?id=CVE-2022-4967 - https://security.netapp.com/advisory/ntap-20240614-0006/
CVE ID: CVE-2022-4968 State: PUBLISHED Published: 2024-06-07T00:14:22.528Z Last Updated: 2024-08-03T01:55:46.232Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: Canonical Ltd. Products: Netplan Problem Types: CWE-497 Description: netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://github.com/canonical/netplan/commit/4c39b75b5c6ae7d976bda6da68da60d9a7f085ee - https://bugs.launchpad.net/netplan/+bug/1987842 - https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/2065738 - https://www.cve.org/CVERecord?id=CVE-2022-49
87842 - https://bugs.launchpad.net/ubuntu/+source/netplan.io/+bug/2065738 - https://www.cve.org/CVERecord?id=CVE-2022-4968
CVE ID: CVE-2022-4969 State: PUBLISHED Published: 2024-05-27T16:31:04.738Z Last Updated: 2024-08-03T01:55:46.111Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: bwoodsend Products: rockhopper Problem Types: CWE-120 Description: A vulnerability, which was classified as critical, has been found in bwoodsend rockhopper up to 0.1.2. Affected by this issue is the function count_rows of the file rockhopper/src/ragged_array.c of the component Binary Parser. The manipulation of the argument raw leads to buffer overflow. Local access is required to approach this attack. Upgrading to version 0.2.0 is able to address this issue. The name of the patch is 1a15fad5e06ae6
approach this attack. Upgrading to version 0.2.0 is able to address this issue. The name of the patch is 1a15fad5e06ae693eb9b8908363d2c8ef455104e. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-266312. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://vuldb.com/?id.266312 - https://vuldb.com/?ctiid.266312 - https://github.com/bwoodsend/rockhopper/commit/1a15fad5e06ae693eb9b8908363d2c8ef455104e - https://github.com/bwoodsend/rockhopper/releases/tag/v0.2.0
CVE ID: CVE-2022-4971 State: PUBLISHED Published: 2024-10-16T06:43:35.013Z Last Updated: 2024-10-16T18:04:03.516Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: heateor Products: Social Sharing Plugin – Sassy Social Share Problem Types: CWE-79 Description: The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tric