Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
nager/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2732977%40duracelltomi-google-tag-manager&new=2732977%40duracelltomi-google-tag-manager&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1961
CVE ID: CVE-2022-1962 State: PUBLISHED Published: 2022-08-09T20:18:18 Last Updated: 2024-08-03T00:24:43.737Z Vendors: Go standard library Products: go/parser Problem Types: CWE-674: Uncontrolled Recursion Description: Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations. Additional Analyst Notes: - CVE Program Container: References: - https://go.dev/cl/417063 - https://go.googlesource.com/go/+/695be961d57508da5a82217f7415200a11845879 - https://go.dev/issue/53616 - https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE - https://pkg.go.dev/vuln/GO-2022-05
ps://go.dev/issue/53616 - https://groups.google.com/g/golang-announce/c/nqrv9fbR0zE - https://pkg.go.dev/vuln/GO-2022-0515
CVE ID: CVE-2022-1963 State: PUBLISHED Published: 2022-07-01T17:00:05 Last Updated: 2024-08-03T00:24:43.676Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 13.4 before 14.10.5, all versions starting from 15.0 before 15.0.4, all versions starting from 15.1 before 15.1.1. GitLab reveals if a user has enabled two-factor authentication on their account in the HTML source, to unauthenticated users. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-
enticated users. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/352210 - https://hackerone.com/reports/1470023 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1963.json
CVE ID: CVE-2022-1964 State: PUBLISHED Published: 2022-06-27T08:58:57 Last Updated: 2024-08-03T00:24:43.600Z Vendors: Unknown Products: Easy SVG Support Problem Types: CWE-79 Description: The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/52cf7e3c-2a0c-45c4-be27-be87424f1338
CVE ID: CVE-2022-1965 State: PUBLISHED Published: 2022-06-24T07:46:07.918368Z Last Updated: 2024-09-16T17:53:43.937Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) Vendors: CODESYS Products: Runtime Toolkit, PLCWinNT Problem Types: CWE-755 Description: Multiple products of CODESYS implement a improper error handling. A low privilege remote attacker may craft a request, which is not properly processed by the error handling. In consequence, the file referenced by the request could be deleted. User interaction is not required. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a43
- CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17139&token=ec67d15a433b61c77154166c20c78036540cacb0&download=
CVE ID: CVE-2022-1966 State: REJECTED Published: 2022-06-06T18:01:49.639Z Last Updated: 2025-02-13T15:46:17.699Z Description: No description available.
CVE ID: CVE-2022-1967 State: PUBLISHED Published: 2022-07-04T13:05:56 Last Updated: 2024-08-03T00:24:43.403Z Vendors: Unknown Products: WP Championship Problem Types: CWE-352 Description: The WP Championship WordPress plugin before 9.3 is lacking CSRF checks in various places, allowing attackers to make a logged in admin perform unwanted actions, such as create and delete arbitrary teams as well as update the plugin's settings. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/02d25736-c796-49bd-b774-66e0e3fcf4c9
CVE ID: CVE-2022-1968 State: PUBLISHED Published: 2022-06-02T00:00:00 Last Updated: 2024-08-03T00:24:43.777Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/949090e5-f4ea-4edf-bd79-cd98f0498a5b - https://github.com/vim/vim/commit/409510c588b1eec1ae33511ae97a21eb8e110895 - https://lists.debian.org/debian-lts-announce/2022/06/msg00014.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosur
- https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1969 State: PUBLISHED Published: 2022-06-13T13:15:13.000Z Last Updated: 2025-05-05T16:40:17.686Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: scriptcoil Products: Mobile browser color select Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Mobile browser color select plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.1. This is due to missing or incorrect nonce validation on the admin_update_data() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via forged request granted they can trick a site administrator into perfor
ted attackers to inject malicious web scripts via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/687cd0ac-5f78-4429-b6b5-dd1113143a4d?source=cve - https://plugins.trac.wordpress.org/browser/mobile-browser-color-select/trunk/mobile-browser-color-select.php#L62 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1969
CVE ID: CVE-2022-1970 State: REJECTED Published: 2023-02-02T14:12:35.042Z Last Updated: 2024-05-29T01:48:08.364Z Description: No description available.
CVE ID: CVE-2022-1971 State: PUBLISHED Published: 2022-06-27T08:59:02 Last Updated: 2024-08-03T00:24:44.067Z Vendors: Unknown Products: NextCellent Gallery – NextGEN Legacy Problem Types: CWE-79 Description: The NextCellent Gallery WordPress plugin through 1.9.35 does not sanitise and escape some of its image settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1bffbbef-7876-43a6-9cb0-6e09bb4ff2b0
CVE ID: CVE-2022-1972 State: REJECTED Published: 2022-09-14T18:59:30 Last Updated: 2022-09-14T18:59:30 Description: No description available.
CVE ID: CVE-2022-1973 State: PUBLISHED Published: 2022-08-05T00:00:00 Last Updated: 2024-08-03T00:24:43.660Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel in log_replay in fs/ntfs3/fslog.c in the NTFS journal. This flaw allows a local attacker to crash the system and leads to a kernel information leak problem. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2092542 - https://security.netapp.com/advisory/ntap-20230120-0001/
CVE ID: CVE-2022-1974 State: PUBLISHED Published: 2022-08-31T15:32:58 Last Updated: 2024-08-03T00:24:43.567Z Vendors: n/a Products: Linux kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel's NFC core functionality due to a race condition between kobject creation and delete. This vulnerability allows a local attacker with CAP_NET_ADMIN privilege to leak kernel information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/da5c0f119203ad9728920456a0f52a6d850c01cd
CVE ID: CVE-2022-1975 State: PUBLISHED Published: 2022-08-31T15:32:58 Last Updated: 2024-08-03T00:24:43.885Z Vendors: n/a Products: Linux kernel Problem Types: CWE-248 Description: There is a sleep-in-atomic bug in /net/nfc/netlink.c that allows an attacker to crash the Linux kernel by simulating a nfc device from user-space. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/4071bf121d59944d5cd2238de0642f3d7995a997
CVE ID: CVE-2022-1976 State: PUBLISHED Published: 2022-08-31T00:00:00 Last Updated: 2024-08-03T00:24:43.557Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A flaw was found in the Linux kernel’s implementation of IO-URING. This flaw allows an attacker with local executable permission to create a string of requests that can cause a use-after-free flaw within the kernel. This issue leads to memory corruption and possible privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2092549 - https://security.netapp.com/advisory/ntap-20230214-0005/
CVE ID: CVE-2022-1977 State: PUBLISHED Published: 2022-06-27T08:59:05 Last Updated: 2024-08-03T00:24:44.033Z Vendors: Unknown Products: Import Export All WordPress Images, Users & Post Types Problem Types: CWE-918 Description: The Import Export All WordPress Images, Users & Post Types WordPress plugin before 6.5.3 does not fully validate the file to be imported via an URL before making an HTTP request to it, which could allow high privilege users such as admin to perform Blind SSRF attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1b640519-75e1-48cb-944e-b9bff9de6d3d
CVE ID: CVE-2022-1979 State: PUBLISHED Published: 2022-06-02T17:25:12.000Z Last Updated: 2025-04-15T14:37:49.929Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Product Show Room Site Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been declared as problematic. This vulnerability affects p=contact. The manipulation of the Message textbox with the input <script>alert(1)</script> leads to cross site scripting. The attack can be initiated remotely but requires authentication. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Containe
ires authentication. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Product%20Show%20Room%20Site/%27Message%27%20Stored%20Cross-Site%20Scripting%28XSS%29.md - https://vuldb.com/?id.200950
CVE ID: CVE-2022-1980 State: PUBLISHED Published: 2022-06-02T17:25:14.000Z Last Updated: 2025-04-15T14:37:37.787Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Product Show Room Site Problem Types: CWE-79 Description: A vulnerability was found in SourceCodester Product Show Room Site 1.0. It has been rated as problematic. This issue affects the file /admin/?page=system_info/contact_info. The manipulation of the textbox Telephone with the input <script>alert(1)</script> leads to cross site scripting. The attack may be initiated remotely but requires authentication. Exploit details have been disclosed to the public. Additional Analyst N
initiated remotely but requires authentication. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Product%20Show%20Room%20Site/%27Telephone%27%20Stored%20Cross-Site%20Scripting%28XSS%29.md - https://vuldb.com/?id.200951
CVE ID: CVE-2022-1981 State: PUBLISHED Published: 2022-07-01T16:05:41 Last Updated: 2024-08-03T00:24:44.102Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: An issue has been discovered in GitLab EE affecting all versions starting from 12.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1. In GitLab, if a group enables the setting to restrict access to users belonging to specific domains, that allow-list may be bypassed if a Maintainer uses the 'Invite a group' feature to invite a group that has members that don't comply with domain allow-list. Additional Analy
e 'Invite a group' feature to invite a group that has members that don't comply with domain allow-list. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/354791 - https://hackerone.com/reports/1501733 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1981.json
CVE ID: CVE-2022-1982 State: PUBLISHED Published: 2022-06-02T17:03:07 Last Updated: 2024-12-06T23:08:59.559Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: Mattermost Products: Mattermost Problem Types: CWE-400 Description: Uncontrolled resource consumption in Mattermost version 6.6.0 and earlier allows an authenticated attacker to crash the server via a crafted SVG attachment on a post. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2022-1983 State: PUBLISHED Published: 2022-07-01T15:56:23 Last Updated: 2024-08-03T00:24:43.972Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper access control in GitLab Description: Incorrect authorization in GitLab EE affecting all versions from 10.7 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allowed an attacker already in possession of a valid Deploy Key or a Deploy Token to misuse it from any location to access Container Registries even when IP address restrictions were configured. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-o
strictions were configured. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/363651 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1983.json
CVE ID: CVE-2022-1984 State: PUBLISHED Published: 2022-07-19T14:07:45 Last Updated: 2024-08-03T00:24:44.075Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: HYPR Products: HYPR Windows WFA Problem Types: CWE-502 Description: This issue affects: HYPR Windows WFA versions prior to 7.2; Unsafe Deserialization vulnerability in HYPR Workforce Access (WFA) before version 7.2 may allow local authenticated attackers to elevate privileges via a malicious serialized payload. Additional Analyst Notes: - CVE Program Container: References: - https://www.hypr.com/security-advisories/
CVE ID: CVE-2022-1985 State: PUBLISHED Published: 2022-06-13T12:44:35 Last Updated: 2024-08-03T00:24:43.920Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: codename065 Products: Download Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the ~/src/Package/views/shortcode-iframe.php file. Additional Analyst Notes: - CVE Program Container: References: -
in the ~/src/Package/views/shortcode-iframe.php file. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/79fcf18e-39f7-42f2-90e4-3a5bac3382e0?source=cve - https://wordpress.org/plugins/download-manager/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2736071%40download-manager&new=2736071%40download-manager&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1985 - https://www.wordfence.com/blog/2022/06/security-vulnerability-download-manager-plugin/
CVE ID: CVE-2022-1986 State: PUBLISHED Published: 2022-06-09T03:35:11 Last Updated: 2024-08-03T00:24:44.142Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: gogs Products: gogs/gogs Problem Types: CWE-78 Description: OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930 - https://github.com/gogs/gogs/commit/38aff73251cc46ced96dd608dab6190415032a82
CVE ID: CVE-2022-1987 State: PUBLISHED Published: 2022-06-03T07:50:10 Last Updated: 2024-08-03T00:24:43.784Z Severity: LOW (CVSS 2.5 CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: bfabiszewski Products: bfabiszewski/libmobi Problem Types: CWE-126 Description: Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e8197737-7557-443e-a59f-2a86e8dda75f - https://github.com/bfabiszewski/libmobi/commit/612562bc1ea38f1708b044e7a079c47a05b1291d
CVE ID: CVE-2022-1988 State: PUBLISHED Published: 2022-06-03T08:05:11 Last Updated: 2024-08-03T00:24:44.171Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: neorazorx Products: neorazorx/facturascripts Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7882a35a-b27e-4d7e-9fcc-e9e009d0b01c - https://github.com/neorazorx/facturascripts/commit/93fc65ced3847a8e0837561e9fdfa0dbace2cfcb
CVE ID: CVE-2022-1989 State: PUBLISHED Published: 2022-08-23T09:55:29.938259Z Last Updated: 2024-09-16T18:29:51.457Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: CODESYS Products: CODESYS Visualization Problem Types: CWE-204 Description: All CODESYS Visualization versions before V4.2.0.0 generate a login dialog vulnerable to information exposure allowing a remote, unauthenticated attacker to enumerate valid users. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17142&token=a3696ab41fef800d2eaee8043d40d5fbe94277fd&download=
CVE ID: CVE-2022-1990 State: PUBLISHED Published: 2022-06-27T08:59:11 Last Updated: 2024-11-20T15:45:07.130Z Vendors: Unknown Products: Nested Pages Problem Types: CWE-79 Description: The Nested Pages WordPress plugin before 3.1.21 does not escape and sanitize the some of its settings, which could allow high privilege users to perform Stored Cross-Site Scripting attacks when the unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/42f1bf1f-95a8-41ee-a637-88deb80ab870
CVE ID: CVE-2022-1991 State: PUBLISHED Published: 2022-06-03T14:25:11.000Z Last Updated: 2025-04-15T14:37:30.688Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Fast Food Ordering System Problem Types: CWE-79 Description: A vulnerability classified as problematic has been found in Fast Food Ordering System 1.0. Affected is the file Master.php of the Master List. The manipulation of the argument Description with the input foo "><img src="" onerror="alert(document.cookie)"> leads to cross site scripting. It is possible to launch the attack remotely but it requires authentication. Exploit details have been disclosed to the public. Additional
launch the attack remotely but it requires authentication. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://cyberthoth.medium.com/fast-food-ordering-system-1-0-cross-site-scripting-7927f4b1edd6 - https://vuldb.com/?id.201276
CVE ID: CVE-2022-1992 State: PUBLISHED Published: 2022-06-08T13:30:14 Last Updated: 2024-08-03T00:24:43.718Z Severity: CRITICAL (CVSS 10 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: gogs Products: gogs/gogs Problem Types: CWE-22 Description: Path Traversal in GitHub repository gogs/gogs prior to 0.12.9. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab - https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0
CVE ID: CVE-2022-1993 State: PUBLISHED Published: 2022-06-08T13:55:11 Last Updated: 2024-08-03T00:24:44.031Z Severity: HIGH (CVSS 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N) Vendors: gogs Products: gogs/gogs Problem Types: CWE-22 Description: Path Traversal in GitHub repository gogs/gogs prior to 0.12.9. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/22f9c074-cf60-4c67-b5c4-72fdf312609d - https://github.com/gogs/gogs/commit/9bf748b6c4c9a17d3aa77f6b9abcfae65451febf
CVE ID: CVE-2022-1994 State: PUBLISHED Published: 2022-06-27T08:59:16 Last Updated: 2024-08-03T00:24:43.944Z Vendors: Unknown Products: Login With OTP Over SMS, Email, WhatsApp and Google Authenticator Problem Types: CWE-79 Description: The Login With OTP Over SMS, Email, WhatsApp and Google Authenticator WordPress plugin before 1.0.8 does not escape its settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/114d94be-b567-4b4b-9a44-f2c05cdbe18e
CVE ID: CVE-2022-1995 State: PUBLISHED Published: 2022-06-27T08:59:22 Last Updated: 2024-08-03T00:24:43.913Z Vendors: Unknown Products: Malware Scanner Problem Types: CWE-79 Description: The Malware Scanner WordPress plugin before 4.5.2 does not sanitise and escape some of its settings, leading to malicious users with administrator privileges to store malicious Javascript code leading to Cross-Site Scripting attacks when unfiltered_html is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/62fb399d-3327-45d0-b10f-769d2d164903
CVE ID: CVE-2022-1996 State: PUBLISHED Published: 2022-06-06T00:00:00 Last Updated: 2024-08-03T00:24:43.677Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N) Vendors: emicklei Products: emicklei/go-restful Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key in GitHub repository emicklei/go-restful prior to v3.8.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/be837427-415c-4d8c-808b-62ce20aa84f1 - https://github.com/emicklei/go-restful/commit/fd3c327a379ce08c68ef18765bdc925f5d9bad10 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBDD3Q23
925f5d9bad10 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OBDD3Q23RCGAGHIXUCWBU6N3S4RNAKXB/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/575BLJ3Y2EQBRNTFR2OSQQ6L2W6UCST3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZY2SLWOQR4ZURQ7UBRZ7JIX6H6F5JHJR/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z55VUVGO7E5PJFXIOVAY373NZRHBNCI5/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RQXU752ALW53OJAF5MG3WMR5CCZVLWW6/ - https://security.net