Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3226 State: PUBLISHED Published: 2022-12-01T00:00:00.000Z Last Updated: 2025-04-24T20:13:16.366Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: n/a Description: An OS command injection vulnerability allows admins to execute code via SSL VPN configuration uploads in Sophos Firewall releases older than version 19.5 GA. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20221201-sfos-19-5-0
CVE ID: CVE-2022-3228 State: PUBLISHED Published: 2022-10-28T17:17:46.811Z Last Updated: 2025-04-16T16:07:13.798Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Host Engineering Products: H0-ECOM100 Communications Module Problem Types: CWE-121 Description: Using custom code, an attacker can write into name or description fields larger than the appropriate buffer size causing a stack-based buffer overflow on Host Engineering H0-ECOM100 Communications Module Firmware versions v5.0.155 and prior. This may allow an attacker to crash the affected device or cause it to become unresponsive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment
ed device or cause it to become unresponsive. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-263-04
CVE ID: CVE-2022-3229 State: PUBLISHED Published: 2023-02-06T22:52:55.198Z Last Updated: 2025-03-25T15:53:29.559Z Vendors: Unified Intents AB Products: Unified Remote Problem Types: CWE-285 Description: Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated access to run code of the attacker's choosing. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/rapid7/metasploit-framework/pull/16989
CVE ID: CVE-2022-3231 State: PUBLISHED Published: 2022-09-17T17:00:21 Last Updated: 2024-08-03T01:00:10.551Z Severity: MEDIUM (CVSS 5.6 CVSS:3.0/AV:A/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: librenms Products: librenms/librenms Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.9.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/bcb6ee68-1452-4fdb-932a-f1031d10984f - https://github.com/librenms/librenms/commit/08050020861230ff96a6507b309cc172a9e70af8
CVE ID: CVE-2022-3232 State: PUBLISHED Published: 2022-09-17T19:40:08 Last Updated: 2024-08-03T01:00:10.579Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.5. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/15c8fd98-7f50-4d46-b013-42710af1f99c - https://github.com/ikus060/rdiffweb/commit/422791ea45713aaaa865bdca74addb9fffd93a71
CVE ID: CVE-2022-3233 State: PUBLISHED Published: 2022-09-21T19:40:08.000Z Last Updated: 2025-05-23T20:32:31.520Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/5ec206e0-eca0-4957-9af4-fdd9185d1db3 - https://github.com/ikus060/rdiffweb/commit/18a5aabd48fa6d2d2771a25f95610c28a1a097ca
CVE ID: CVE-2022-3234 State: PUBLISHED Published: 2022-09-17T00:00:00 Last Updated: 2024-08-03T01:00:10.976Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.0483. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/90fdf374-bf04-4386-8a23-38c83b88f0da - https://github.com/vim/vim/commit/c249913edc35c0e666d783bfc21595cf9f7d9e0d - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/ - https://lists.fedoraproject.org/archi
age-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/ - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/ - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-3235 State: PUBLISHED Published: 2022-09-18T00:00:00 Last Updated: 2024-08-03T01:00:10.715Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.0490. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/96d5f7a0-a834-4571-b73b-0fe523b941af - https://github.com/vim/vim/commit/1c3dd8ddcba63c1af5112e567215b3cec2de11d0 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/ - https://lists.fedoraproject.org/archives/list/pac
%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/ - https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-3236 State: PUBLISHED Published: 2022-09-23T12:50:13.000Z Last Updated: 2025-10-21T23:15:34.699Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: n/a Description: A code injection vulnerability in the User Portal and Webadmin allows a remote attacker to execute code in Sophos Firewall version v19.0 MR1 and older. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220923-sfos-rce
CVE ID: CVE-2022-3237 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T15:44:34.153Z Vendors: Unknown Products: WP Contact Slider Problem Types: CWE-79 Description: The WP Contact Slider WordPress plugin before 2.4.8 does not sanitize and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/cd2fd6cd-a839-4de8-af28-b5134873c40e
CVE ID: CVE-2022-3238 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-05-01T13:32:41.092Z Vendors: n/a Products: Kernel Problem Types: CWE-459 Description: A double-free flaw was found in the Linux kernel’s NTFS3 subsystem in how a user triggers remount and umount simultaneously. This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2127927
CVE ID: CVE-2022-3239 State: PUBLISHED Published: 2022-09-19T00:00:00 Last Updated: 2024-08-03T01:00:10.867Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xx_usb_probe() for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c08eadca1bdfa099e20a32f8fa4b52b2f672236d - https://security.netapp.com/advisory/ntap-20230214-0006/
CVE ID: CVE-2022-3240 State: PUBLISHED Published: 2022-11-15T13:25:57.082Z Last Updated: 2025-01-31T18:25:44.342Z Severity: HIGH (CVSS 8.8 CVSS:3.1/A:H/I:H/C:H/S:U/UI:R/PR:N/AC:L/AV:N) Vendors: brian-chappell Products: Follow Me Plugin Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The "Follow Me Plugin" plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.1. This is due to missing nonce validation on the FollowMeIgniteSocialMedia_options_page() function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site
ckers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/follow-me/trunk/follow-me.php#L261 - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3240
CVE ID: CVE-2022-3241 State: PUBLISHED Published: 2023-01-02T21:49:12.027Z Last Updated: 2025-04-10T19:12:40.463Z Vendors: Unknown Products: Build App Online Problem Types: CWE-89 SQL Injection Description: The Build App Online WordPress plugin before 1.0.19 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a995dd67-43fc-4087-a7f1-5db57f4c828c
CVE ID: CVE-2022-3242 State: PUBLISHED Published: 2022-09-20T10:15:20.000Z Last Updated: 2025-05-29T13:56:54.376Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: microweber Products: microweber/microweber Problem Types: CWE-94 Description: Code Injection in GitHub repository microweber/microweber prior to 1.3.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/3e6b218a-a5a6-40d9-9f7e-5ab0c6214faf - https://github.com/microweber/microweber/commit/68f0721571653db865a5fa01c7986642c82e919c
CVE ID: CVE-2022-3243 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T20:17:07.691Z Vendors: Unknown Products: Import all XML, CSV & TXT into WordPress Problem Types: CWE-89 Description: The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not properly sanitise and escape imported data before using them back SQL statements, leading to SQL injection exploitable by high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/9f03bc1a-214f-451a-89fd-2cd3517e8f8a
CVE ID: CVE-2022-3244 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-13T15:55:04.083Z Vendors: Unknown Products: Import all XML, CSV & TXT into WordPress Problem Types: CWE-862 Description: The Import all XML, CSV & TXT WordPress plugin before 6.5.8 does not have authorisation in some places, which could allow any authenticated users to access some of the plugin features if they manage to get the related nonce Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/de4bc449-3dd4-4776-943f-ac59ae813132
CVE ID: CVE-2022-3245 State: PUBLISHED Published: 2022-09-20T13:15:20.000Z Last Updated: 2025-05-27T18:08:26.195Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-94 Description: HTML injection attack is closely related to Cross-site Scripting (XSS). HTML injection uses HTML to deface the page. XSS, as the name implies, injects JavaScript into the page. Both attacks exploit insufficient validation of user input. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/747c2924-95ca-4311-9e69-58ee0fb440a0 - https://github.com/microweber/mic
hment: References: - https://huntr.dev/bounties/747c2924-95ca-4311-9e69-58ee0fb440a0 - https://github.com/microweber/microweber/commit/f20abf30a1d9c1426c5fb757ac63998dc5b92bfc
CVE ID: CVE-2022-3246 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-05-07T20:10:58.452Z Vendors: Unknown Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-89 Description: The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ece049b2-9a21-463d-9e8b-b4ce61919f0c
CVE ID: CVE-2022-3247 State: PUBLISHED Published: 2022-10-25T00:00:00.000Z Last Updated: 2025-05-09T18:57:04.900Z Vendors: Unknown Products: Blog2Social: Social Media Auto Post & Scheduler Problem Types: CWE-918 Description: The Blog2Social: Social Media Auto Post & Scheduler WordPress plugin before 6.9.10 does not have authorisation in an AJAX action, and does not ensure that the URL to make a request to is an external one. As a result, any authenticated users, such as subscriber could perform SSRF attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ee312f22-ca58-451d-a1cb-3f78a6e5ecaf
CVE ID: CVE-2022-3248 State: PUBLISHED Published: 2023-10-05T13:28:27.973Z Last Updated: 2024-08-29T20:01:55.479Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N) Vendors: n/a, Red Hat Products: kubernetes, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat Ansible Automation Platform 1.2, Red Hat Ansible Tower 3, Red Hat OpenShift Container Platform 3.11, Red Hat OpenShift Container Platform 4 Problem Types: CWE-863 Description: A flaw was found in OpenShift API, as admission checks do not enforce "custom-host" permissions. This issue could allow an attacker to violate the boundaries, as permissions will not be applied. Additional Analyst Notes: - CVE Prog
ld allow an attacker to violate the boundaries, as permissions will not be applied. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-3248 - https://bugzilla.redhat.com/show_bug.cgi?id=2072188
CVE ID: CVE-2022-3249 State: PUBLISHED Published: 2022-12-05T16:50:36.452Z Last Updated: 2025-04-23T15:06:38.699Z Vendors: Unknown Products: WP CSV Exporter Problem Types: CWE-89 SQL Injection Description: The WP CSV Exporter WordPress plugin before 1.3.7 does not properly sanitise and escape some parameters before using them in a SQL statement, allowing high privilege users such as admin to perform SQL injection attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6503da78-a2bf-4b4c-b56d-21c8c55b076e
CVE ID: CVE-2022-3250 State: PUBLISHED Published: 2022-09-21T16:55:14.000Z Last Updated: 2025-05-28T13:43:28.339Z Severity: MEDIUM (CVSS 4.9 CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-614 Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/rdiffweb prior to 2.4.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/39889a3f-8bb7-448a-b0d4-a18c671bbd23 - https://github.com/ikus060/rdiffweb/commit/ac334dd27ceadac0661b1e2e059a8423433c3fee
CVE ID: CVE-2022-3251 State: PUBLISHED Published: 2022-09-21T16:55:08.000Z Last Updated: 2025-05-28T13:44:19.262Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: ikus060 Products: ikus060/minarca Problem Types: CWE-614 Description: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in GitHub repository ikus060/minarca prior to 4.2.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b9a1b411-060b-4235-9426-e39bd0a1d6d9 - https://github.com/ikus060/minarca/commit/7b5c7e6cbd59268d5cd4f1b5f42e721db116f71a
CVE ID: CVE-2022-3252 State: PUBLISHED Published: 2022-09-21T18:45:16 Last Updated: 2024-08-03T01:07:05.521Z Vendors: Swift Project Products: SwiftNIO Extras Problem Types: CWE-606 Description: Improper detection of complete HTTP body decompression SwiftNIO Extras provides a pair of helpers for transparently decompressing received HTTP request or response bodies. These two objects (HTTPRequestDecompressor and HTTPResponseDecompressor) both failed to detect when the decompressed body was considered complete. If trailing junk data was appended to the HTTP message body, the code would repeatedly attempt to decompress this data and fail. This would lead to an infinite loop making no forward prog
de would repeatedly attempt to decompress this data and fail. This would lead to an infinite loop making no forward progress, leading to livelock of the system and denial-of-service. This issue can be triggered by any attacker capable of sending a compressed HTTP message. Most commonly this is HTTP servers, as compressed HTTP messages cannot be negotiated for HTTP requests, but it is possible that users have configured decompression for HTTP requests as well. The attack is low effort, and likely to be reached without requiring any privilege or system access. The impact on availability is high: the process immediately becomes unavailable but does not immediately crash, meaning that it is poss
vailability is high: the process immediately becomes unavailable but does not immediately crash, meaning that it is possible for the process to remain in this state until an administrator intervenes or an automated circuit breaker fires. If left unchecked this issue will very slowly exhaust memory resources due to repeated buffer allocation, but the buffers are not written to and so it is possible that the processes will not terminate for quite some time. This risk can be mitigated by removing transparent HTTP message decompression. The issue is fixed by correctly detecting the termination of the compressed body as reported by zlib and refusing to decompress further data. The issue was found
the termination of the compressed body as reported by zlib and refusing to decompress further data. The issue was found by Vojtech Rylko (https://github.com/vojtarylko) and reported publicly on GitHub. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/apple/swift-nio-extras/security/advisories/GHSA-773g-x274-8qmf
CVE ID: CVE-2022-3254 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T15:43:16.746Z Vendors: Unknown Products: WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds Problem Types: CWE-89 Description: The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/546c47c2-5b4b-46db-b754-c6b43aef2660
CVE ID: CVE-2022-3255 State: PUBLISHED Published: 2022-09-21T12:00:21.000Z Last Updated: 2025-05-28T15:21:33.438Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify any information that the user is able to modify. Initiate interactions with other application users, including malicious attacks, that wi
hat the user is able to modify. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/0ea45cf9-b256-454c-9031-2435294c0902 - https://github.com/pimcore/pimcore/commit/1e916e7d668c9e47b217e20cc0ea4812f466201b
CVE ID: CVE-2022-3256 State: PUBLISHED Published: 2022-09-22T00:00:00.000Z Last Updated: 2025-05-23T20:31:50.981Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 9.0.0530. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/8336a3df-212a-4f8d-ae34-76ef1f936bb3 - https://github.com/vim/vim/commit/8ecfa2c56b4992c7f067b92488aa9acea5a454ad - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/ - https://lists.fedor
archives/list/package-announce%40lists.fedoraproject.org/message/LSSEWQLK55MCNT4Z2IIJEJYEI5HLCODI/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QI7AETXBHPC7SGA77Q7O5IEGULWYET7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTBVD4J2SKVSWK4VBN5JP5OEVK6GDS3N/ - https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-3257 State: PUBLISHED Published: 2022-09-23T14:13:39 Last Updated: 2024-12-06T23:07:48.369Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Mattermost version 7.1.x and earlier fails to sufficiently process a specifically crafted GIF file when it is uploaded while drafting a post, which allows authenticated users to cause resource exhaustion while processing the file, resulting in server-side Denial of Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/ - https://hackerone.com/reports/162017
: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/ - https://hackerone.com/reports/1620170
CVE ID: CVE-2022-3258 State: PUBLISHED Published: 2022-11-03T18:04:32.101Z Last Updated: 2025-05-01T18:36:47.476Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:P/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L) Vendors: HYPR Products: Workforce Access Problem Types: CWE-732 Description: Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on Windows allows Authentication Abuse. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hypr.com/security-advisories
CVE ID: CVE-2022-3259 State: PUBLISHED Published: 2022-12-09T00:00:00.000Z Last Updated: 2025-04-22T20:25:52.328Z Vendors: n/a Products: OpenShift Problem Types: CWE-665 Description: Openshift 4.9 does not use HTTP Strict Transport Security (HSTS) which may allow man-in-the-middle (MITM) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2103220