Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3197 State: PUBLISHED Published: 2022-09-26T00:00:00.000Z Last Updated: 2025-05-21T19:39:23.472Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html - https://crbug.com/1358075 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists
75 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-3198 State: PUBLISHED Published: 2022-09-26T00:00:00.000Z Last Updated: 2025-05-21T18:01:25.664Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html - https://crbug.com/1355682 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists
82 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-3199 State: PUBLISHED Published: 2022-09-26T00:00:00.000Z Last Updated: 2025-05-21T17:58:55.960Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html - https://crbug.com/1355237 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40l
355237 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/ - http://packetstormsecurity.com/files/170012/Chrome-blink-LocalFrameView-PerformLayout-Use-After-Free.html
CVE ID: CVE-2022-3200 State: PUBLISHED Published: 2022-09-26T00:00:00.000Z Last Updated: 2025-05-21T17:56:56.478Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html - https://crbug.com/1355103 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/packa
s://crbug.com/1355103 - https://security.gentoo.org/glsa/202209-23 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/
CVE ID: CVE-2022-3201 State: PUBLISHED Published: 2022-09-26T00:00:00 Last Updated: 2024-08-03T01:00:10.807Z Vendors: Google Products: Chrome Problem Types: Insufficient validation of untrusted input Description: Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to 105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_14.html - https://crbug.com/1343104 - https://security.gentoo.org
ogleblog.com/2022/09/stable-channel-update-for-desktop_14.html - https://crbug.com/1343104 - https://security.gentoo.org/glsa/202209-23 - https://www.debian.org/security/2022/dsa-5244 - https://security.gentoo.org/glsa/202210-16 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4NMJURTG5RO3TGD7ZMIQ6Z4ZZ3SAVYE/ - https://security.gentoo.org/glsa/202311-11
CVE ID: CVE-2022-3202 State: PUBLISHED Published: 2022-09-14T00:00:00 Last Updated: 2024-08-03T01:00:10.590Z Vendors: n/a Products: Kernel Problem Types: CWE-476 Description: A NULL pointer dereference flaw in diFree in fs/jfs/inode.c in Journaled File System (JFS)in the Linux kernel. This could allow a local attacker to crash the system or leak kernel internal information. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/torvalds/linux/commit/a53046291020ec41e09181396c1e829287b48d47 - https://security.netapp.com/advisory/ntap-20221228-0007/
CVE ID: CVE-2022-3203 State: PUBLISHED Published: 2022-10-21T12:30:12.353Z Last Updated: 2025-05-07T14:06:37.577Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ORing Products: IAP-420(+) Problem Types: CWE-912 Description: On ORing net IAP-420(+) with FW version 2.0m a telnet server is enabled by default and cannot permanently be disabled. You can connect to the device via LAN or WiFi with hardcoded credentials and get an administrative shell. These credentials are reset to defaults with every reboot. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mads.uniud.it/2022/09/lord-of-the-orings/
CVE ID: CVE-2022-3204 State: PUBLISHED Published: 2022-09-26T13:41:46.275Z Last Updated: 2025-05-05T16:13:06.842Z Vendors: NLnet Labs Products: Unbound Problem Types: n/a Description: A vulnerability named 'Non-Responsive Delegation Attack' (NRDelegation Attack) has been discovered in various DNS resolving software. The NRDelegation Attack works by having a malicious delegation with a considerable number of non responsive nameservers. The attack starts by querying a resolver for a record that relies on those unresponsive nameservers. The attack can cause a resolver to spend a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsiv
a lot of time/resources resolving records under a malicious delegation point where a considerable number of unresponsive NS records reside. It can trigger high CPU usage in some resolver implementations that continually look in the cache for resolved NS records in that delegation. This can lead to degraded performance and eventually denial of service in orchestrated attacks. Unbound does not suffer from high CPU usage, but resources are still needed for resolving the malicious delegation. Unbound will keep trying to resolve the record until hard limits are reached. Based on the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduce
n the nature of the attack and the replies, different limits could be reached. From version 1.16.3 on, Unbound introduces fixes for better performance when under load, by cutting opportunistic queries for nameserver discovery and DNSKEY prefetching and limiting the number of times a delegation point can issue a cache lookup for missing records. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.nlnetlabs.nl/downloads/unbound/CVE-2022-3204.txt - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B/ - https://lists.fedoraproject.org/archives/list/package-announce%40li
ject.org/message/3G2HS6CYPSIGAKO6QLEZPG3RD6AMPB7B/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/35QGS5FBQTG3DBSK7QV67PA64P24ABHY/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S4EU6DMJXQFMAIE6SLAH4H5RNRU6VQL/ - https://security.gentoo.org/glsa/202212-02 - https://lists.debian.org/debian-lts-announce/2023/03/msg00024.html
CVE ID: CVE-2022-3205 State: PUBLISHED Published: 2022-09-13T19:19:46 Last Updated: 2024-08-03T01:00:10.844Z Severity: MEDIUM (CVSS 4.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Red Hat Products: Red Hat Ansible Automation Platform 1.2, Red Hat Ansible Automation Platform 2 Problem Types: CWE-79 Description: Cross site scripting in automation controller UI in Red Hat Ansible Automation Platform 1.2 and 2.0 where the project name is susceptible to XSS injection Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/CVE-2022-3205 - https://bugzilla.redhat.com/show_bug.cgi?id=2120597
CVE ID: CVE-2022-3206 State: PUBLISHED Published: 2022-10-17T00:00:00.000Z Last Updated: 2025-05-14T20:15:49.826Z Vendors: Unknown Products: Passster Problem Types: CWE-522 Insufficiently Protected Credentials, CWE-319 Cleartext Transmission of Sensitive Information Description: The Passster WordPress plugin before 3.5.5.5.2 stores the password inside a cookie named "passster" using base64 encoding method which is easy to decode. This puts the password at risk in case the cookies get leaked. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/a8963750-62bf-403e-a906-94f371ed2a7a
CVE ID: CVE-2022-3207 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T01:00:10.617Z Vendors: Unknown Products: Simple File List Problem Types: CWE-79 Description: The Simple File List WordPress plugin before 4.4.12 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b57272ea-9a8a-482a-bbaa-5f202ca5b9aa
CVE ID: CVE-2022-3208 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T01:00:10.619Z Vendors: Unknown Products: Simple File List Problem Types: CWE-352 Description: The Simple File List WordPress plugin before 4.4.12 does not implement nonce checks, which could allow attackers to make a logged in admin create new page and change it's content via a CSRF attack. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/80d475ca-b475-4789-8eef-9c4d880853b7
CVE ID: CVE-2022-3209 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T01:00:10.808Z Vendors: Unknown Products: soledad Problem Types: CWE-79 Description: The soledad WordPress theme before 8.2.5 does not sanitise the {id,datafilter[type],...} parameters in its penci_more_slist_post_ajax AJAX action, leading to a Reflected Cross-Site Scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7a244fb1-fa0b-4294-9b51-588bf5d673a2
CVE ID: CVE-2022-3210 State: PUBLISHED Published: 2023-03-29T00:00:00.000Z Last Updated: 2025-02-14T16:34:21.096Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: D-Link Products: DIR-2150 Problem Types: CWE-78 Description: This vulnerability allows network-adjacent attackers to execute arbitrary commands on affected installations of D-Link DIR-2150 4.0.1 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the xupnpd service, which listens on TCP port 4044 by default. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage
e lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-15905. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://supportannouncement.us.dlink.com/announcement/publication.aspx?name=SAP10304 - https://www.zerodayinitiative.com/advisories/ZDI-22-1222/
CVE ID: CVE-2022-3211 State: PUBLISHED Published: 2022-09-15T13:35:10 Last Updated: 2024-08-03T01:00:10.590Z Severity: MEDIUM (CVSS 5.8 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.6. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/31ac0506-ae38-4128-a46d-71d5d079f8b7 - https://github.com/pimcore/pimcore/commit/0508c491c6a4f3d119ec8dcf444e52ff25028c36
CVE ID: CVE-2022-3212 State: PUBLISHED Published: 2022-09-14T16:05:09 Last Updated: 2024-08-03T01:00:10.862Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: tokio-rs Products: axum-core Problem Types: CWE-770 Description: <bytes::Bytes as axum_core::extract::FromRequest>::from_request would not, by default, set a limit for the size of the request body. That meant if a malicious peer would send a very large (or infinite) body your server might run out of memory and crash. This also applies to these extractors which used Bytes::from_request internally: axum::extract::Form axum::extract::Json String Additional Analyst Notes: - CVE Program Container: References: -
ernally: axum::extract::Form axum::extract::Json String Additional Analyst Notes: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/axum-core-dos/ - https://rustsec.org/advisories/RUSTSEC-2022-0055.html
CVE ID: CVE-2022-3213 State: PUBLISHED Published: 2022-09-19T17:31:48 Last Updated: 2024-08-03T01:00:10.859Z Vendors: n/a Products: ImageMagick Problem Types: CWE-119 Description: A heap buffer overflow issue was found in ImageMagick. When an application processes a malformed TIFF file, it could lead to undefined behavior or a crash causing a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2126824 - https://access.redhat.com/security/cve/CVE-2022-3213 - https://github.com/ImageMagick/ImageMagick6/commit/1aea203eb36409ce6903b9e41fe7cb70030e8750 - https://github.com/ImageMagick/ImageMagick/commit/30ccf9a0da1f47161b
6/commit/1aea203eb36409ce6903b9e41fe7cb70030e8750 - https://github.com/ImageMagick/ImageMagick/commit/30ccf9a0da1f47161b5935a95be854fe84e6c2a2
CVE ID: CVE-2022-3214 State: PUBLISHED Published: 2022-09-16T18:05:41 Last Updated: 2024-08-03T01:00:10.813Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Delta Electronics Products: DIAEnergy Problem Types: CWE-798 Description: Delta Industrial Automation's DIAEnergy, an industrial energy management system, is vulnerable to CWE-798, Use of Hard-coded Credentials. Versions prior to 1.9.03.009 have this vulnerability. Executable files could be uploaded to certain directories using hard-coded bearer authorization, allowing remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa
cution. Additional Analyst Notes: - CVE Program Container: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-256-03
CVE ID: CVE-2022-3215 State: PUBLISHED Published: 2022-09-28T19:32:30.000Z Last Updated: 2025-05-20T20:02:25.500Z Vendors: Swift Project Products: SwiftNIO Problem Types: CWE-113 Description: NIOHTTP1 and projects using it for generating HTTP responses can be subject to a HTTP Response Injection attack. This occurs when a HTTP/1.1 server accepts user generated input from an incoming request and reflects it into a HTTP/1.1 response header in some form. A malicious user can add newlines to their input (usually in encoded form) and "inject" those newlines into the returned HTTP response. This capability allows users to work around security headers and HTTP/1.1 framing headers by injecting entir
P response. This capability allows users to work around security headers and HTTP/1.1 framing headers by injecting entirely false responses or other new headers. The injected false responses may also be treated as the response to subsequent requests, which can lead to XSS, cache poisoning, and a number of other flaws. This issue was resolved by adding validation to the HTTPHeaders type, ensuring that there's no whitespace incorrectly present in the HTTP headers provided by users. As the existing API surface is non-failable, all invalid characters are replaced by linear whitespace. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/app
espace. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apple/swift-nio/security/advisories/GHSA-7fj7-39wj-c64f
CVE ID: CVE-2022-3216 State: PUBLISHED Published: 2022-09-14T20:10:09.000Z Last Updated: 2025-04-15T13:47:11.938Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Nintendo Products: Game Boy Color Problem Types: CWE-119 Description: A vulnerability has been found in Nintendo Game Boy Color and classified as problematic. This vulnerability affects unknown code of the component Mobile Adapter GB. The manipulation leads to memory corruption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-208606 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vul
8606 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://xcellerator.github.io/posts/tetsuji/ - https://vuldb.com/?id.208606
CVE ID: CVE-2022-3217 State: PUBLISHED Published: 2022-09-16T20:15:34 Last Updated: 2024-08-03T01:00:10.565Z Vendors: n/a Products: VISAM VBASE Problem Types: Insufficiently Protected Credentials Description: When logging in to a VBASE runtime project via Web-Remote, the product uses XOR with a static initial key to obfuscate login messages. An unauthenticated remote attacker with the ability to capture a login session can obtain the login credentials. Additional Analyst Notes: - CVE Program Container: References: - https://www.tenable.com/security/research/tra-2022-31
CVE ID: CVE-2022-3218 State: PUBLISHED Published: 2022-09-19T16:50:10.805835Z Last Updated: 2024-09-16T19:05:35.972Z Vendors: Necta LLC Products: WiFi Mouse (Mouse Server) Problem Types: CWE-603 Description: Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/rapid7/metasploit-framework/pull/16985 - https://www.exploit-db.com/exploits/50972 - https://www.exploit-db.com/exploits/49601 - https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/wifi%20mouse/wifi-mouse-server-rce
oit-db.com/exploits/49601 - https://github.com/H4rk3nz0/PenTesting/blob/main/Exploits/wifi%20mouse/wifi-mouse-server-rce.py - http://packetstormsecurity.com/files/168509/WiFi-Mouse-1.8.3.4-Remote-Code-Execution.html
CVE ID: CVE-2022-3219 State: PUBLISHED Published: 2023-02-23T00:00:00.000Z Last Updated: 2025-03-12T20:45:46.104Z Vendors: n/a Products: gnupg Problem Types: denial of service Description: GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://dev.gnupg.org/D556 - https://marc.info/?l=oss-security&m=165696590211434&w=4 - https://access.redhat.com/security/cve/CVE-2022-3219 - https://bugzilla.redhat.com/show_bug.cgi?id=2127010 - https://dev.gnupg.org/T5993 - https://security.netapp.com/a
3219 - https://bugzilla.redhat.com/show_bug.cgi?id=2127010 - https://dev.gnupg.org/T5993 - https://security.netapp.com/advisory/ntap-20230324-0001/
CVE ID: CVE-2022-3220 State: PUBLISHED Published: 2022-10-10T00:00:00 Last Updated: 2024-08-03T01:00:10.606Z Vendors: Unknown Products: Advanced Comment Form Problem Types: CWE-79 Description: The Advanced Comment Form WordPress plugin before 1.2.1 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/cb6f4953-e68b-48f3-a821-a1d77e5476ef
CVE ID: CVE-2022-3221 State: PUBLISHED Published: 2022-09-15T08:45:19 Last Updated: 2024-08-03T01:00:10.668Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in GitHub repository ikus060/rdiffweb prior to 2.4.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1fa1aac9-b16a-4a70-a7da-960b3908ae1d - https://github.com/ikus060/rdiffweb/commit/9125f5a2d918fed0f3fc1c86fa94cd1779ed9f73
CVE ID: CVE-2022-3222 State: PUBLISHED Published: 2022-09-15T00:00:00 Last Updated: 2024-08-03T01:00:10.585Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-674 Description: Uncontrolled Recursion in GitHub repository gpac/gpac prior to 2.1.0-DEV. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b29c69fa-3eac-41e4-9d4f-d861aba18235 - https://github.com/gpac/gpac/commit/4e7736d7ec7bf64026daa611da951993bb42fdaf - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-3223 State: PUBLISHED Published: 2022-09-16T10:50:12 Last Updated: 2024-08-03T01:00:10.759Z Severity: MEDIUM (CVSS 4.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository jgraph/drawio prior to 20.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/125791b6-3a68-4235-8866-6bc3a52332ba - https://github.com/jgraph/drawio/commit/ea012baba6fb2e903797fa6306833ca4f31ab361
CVE ID: CVE-2022-3224 State: PUBLISHED Published: 2022-09-15T11:30:12 Last Updated: 2024-08-03T01:00:10.594Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H) Vendors: ionicabizau Products: ionicabizau/parse-url Problem Types: CWE-115 Description: Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3587a567-7fcd-4702-b7c9-d9ca565e3c62 - https://github.com/ionicabizau/parse-url/commit/9cacf38de02db0fb1358bd6ec04543e523cd6a8e
CVE ID: CVE-2022-3225 State: PUBLISHED Published: 2022-09-16T16:20:11 Last Updated: 2024-08-03T01:00:10.842Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: budibase Products: budibase/budibase Problem Types: CWE-913 Description: Improper Control of Dynamically-Managed Code Resources in GitHub repository budibase/budibase prior to 1.3.20. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a13a56b7-04da-4560-b8ec-0d637d12a245 - https://github.com/budibase/budibase/commit/d35864be0854216693a01307f81ffcabf6d549df