Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.0.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.4:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:itt600_sa_explorer:2.1.0.5:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.2.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.3.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microsca
10.3.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:microscada_x_sys600:10.4.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:mms:2.2.3:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:pwc600:1.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:pwc600:1.1:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:pwc600:1.2:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:reb500:7:*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:reb500:8:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:1.2.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:2.0.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:1.1.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:1.3.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachie
hitachienergy:relion650:1.1.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:1.3.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:2.1.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:2.1.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.1:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relionSAM600-IO:2.2.5:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion670:2.2.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:relion650:2.2.*:*:*:*:*:*:*:* * cpe:2.3:o:hitachienergy:rtu500cmu:12.*.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:rtu500cmu:13.*.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:2.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:3.0:*:*:*:*:*:*:* * cpe:2.
ienergy:txpert_hub_coretec_4:2.*:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_4:3.0:*:*:*:*:*:*:* * cpe:2.3:a:hitachienergy:txpert_hub_coretec_5:3.0:*:*:*:*:*:*:* Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000125&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000126&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000128&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000133&LanguageCode=en&Docum
DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000133&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000129&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000130&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000131&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000127&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000132&LanguageCode=en&DocumentPa
entPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000132&LanguageCode=en&DocumentPartId=&Action=Launch - https://search.abb.com/library/Download.aspx?DocumentID=8DBD000124&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-3354 State: PUBLISHED Published: 2022-09-28T15:15:13.000Z Last Updated: 2025-04-15T13:46:31.237Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: unspecified Products: Open5GS Problem Types: CWE-404 Description: A vulnerability has been found in Open5GS up to 2.4.10 and classified as problematic. This vulnerability affects unknown code in the library lib/core/ogs-tlv-msg.c of the component UDP Packet Handler. The manipulation leads to denial of service. The exploit has been disclosed to the public and may be used. It is recommended to apply a patch to fix this issue. VDB-209686 is the identifier assigned to this vulnerability. Additional Analyst
nded to apply a patch to fix this issue. VDB-209686 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/open5gs/open5gs/issues/1767 - https://vuldb.com/?id.209686
CVE ID: CVE-2022-3355 State: PUBLISHED Published: 2022-09-29T09:25:11.000Z Last Updated: 2025-05-20T19:36:18.543Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N) Vendors: inventree Products: inventree/inventree Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository inventree/inventree prior to 0.8.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/4b7fb92c-f06b-4bbf-82dc-9f013b30b6a6 - https://github.com/inventree/inventree/commit/5a08ef908dd5344b4433436a4679d122f7f99e41
CVE ID: CVE-2022-3357 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T20:42:09.071Z Vendors: Unknown Products: Smart Slider 3 Problem Types: CWE-502 Description: The Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PHP object injection issues when a user import (intentionally or not) a malicious file, and a suitable gadget chain is present on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2e28a4e7-e7d3-485c-949c-e300e5b66cbd
CVE ID: CVE-2022-3358 State: PUBLISHED Published: 2022-10-11T15:00:14.123507Z Last Updated: 2024-09-16T16:33:30.640Z Vendors: OpenSSL Products: OpenSSL Problem Types: NULL encryption Description: OpenSSL supports creating a custom cipher via the legacy EVP_CIPHER_meth_new() function and associated function calls. This function was deprecated in OpenSSL 3.0 and application authors are instead encouraged to use the new provider mechanism in order to implement custom ciphers. OpenSSL versions 3.0.0 to 3.0.5 incorrectly handle legacy custom ciphers passed to the EVP_EncryptInit_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryp
_ex2(), EVP_DecryptInit_ex2() and EVP_CipherInit_ex2() functions (as well as other similarly named encryption and decryption initialisation functions). Instead of using the custom cipher directly it incorrectly tries to fetch an equivalent cipher from the available providers. An equivalent cipher is found based on the NID passed to EVP_CIPHER_meth_new(). This NID is supposed to represent the unique NID for a given cipher. However it is possible for an application to incorrectly pass NID_undef as this value in the call to EVP_CIPHER_meth_new(). When NID_undef is used in this way the OpenSSL encryption/decryption initialisation function will match the NULL cipher as being equivalent and will f
way the OpenSSL encryption/decryption initialisation function will match the NULL cipher as being equivalent and will fetch this from the available providers. This will succeed if the default provider has been loaded (or if a third party provider has been loaded that offers this cipher). Using the NULL cipher means that the plaintext is emitted as the ciphertext. Applications are only affected by this issue if they call EVP_CIPHER_meth_new() using NID_undef and subsequently use it in a call to an encryption/decryption initialisation function. Applications that only use SSL/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5). Additional Analyst Notes: - CVE Prog
/TLS are not impacted by this issue. Fixed in OpenSSL 3.0.6 (Affected 3.0.0-3.0.5). Additional Analyst Notes: - CVE Program Container: References: - https://www.openssl.org/news/secadv/20221011.txt - https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=5485c56679d7c49b96e8fc8ca708b0b7e7c03c4b - https://security.netapp.com/advisory/ntap-20221028-0014/ - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0023 - https://security.gentoo.org/glsa/202402-08
CVE ID: CVE-2022-3359 State: PUBLISHED Published: 2022-12-12T17:54:32.235Z Last Updated: 2025-04-22T15:41:06.131Z Vendors: Unknown Products: Shortcodes and extra features for Phlox theme Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentionally or not) a malicious file and a suitable gadget chain is present on the blog. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/08f3ce22-94a0-496a-aaf9-d35b6b0f5bb6
CVE ID: CVE-2022-3360 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T20:39:30.456Z Vendors: Unknown Products: LearnPress – WordPress LMS Plugin Problem Types: CWE-502 Description: The LearnPress WordPress plugin before 4.1.7.2 unserialises user input in a REST API endpoint available to unauthenticated users, which could lead to PHP Object Injection when a suitable gadget is present, leadint to remote code execution (RCE). To successfully exploit this vulnerability attackers must have knowledge of the site secrets, allowing them to generate a valid hash via the wp_hash() function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refere
alid hash via the wp_hash() function. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/acea7a54-a964-4127-a93f-f38f883074e3
CVE ID: CVE-2022-3361 State: PUBLISHED Published: 2022-11-29T20:39:43.596Z Last Updated: 2025-01-31T18:24:13.177Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/A:N/I:N/C:L/S:U/UI:N/PR:L/AC:L/AV:N) Vendors: ultimatemember Products: Ultimate Member – User Profile, User Registration, Login & Membership Plugin Problem Types: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Description: The Ultimate Member plugin for WordPress is vulnerable to directory traversal in versions up to, and including 2.5.0 due to insufficient input validation on the 'template' attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrar
te' attribute used in shortcodes. This makes it possible for attackers with administrative privileges to supply arbitrary paths using traversal (../../) to access and include files outside of the intended directory. If an attacker can successfully upload a php file then remote code execution via inclusion may also be possible. Note: for users with less than administrative capabilities, /wp-admin access needs to be enabled for that user in order for this to be exploitable by those users. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.yuque.com/docs/share/23f988ad-1402-42f2-b8d2-c7a87a4022bd - https://github.com/H4de5-7/vulnerabilities/blo
- https://www.yuque.com/docs/share/23f988ad-1402-42f2-b8d2-c7a87a4022bd - https://github.com/H4de5-7/vulnerabilities/blob/main/CVE-2022-3361.md - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3361 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2805393%40ultimate-member&new=2805393%40ultimate-member&sfp_email=&sfph_mail=
CVE ID: CVE-2022-3362 State: PUBLISHED Published: 2022-11-14T00:00:00.000Z Last Updated: 2025-04-30T17:48:44.188Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-613 Description: Insufficient Session Expiration in GitHub repository ikus060/rdiffweb prior to 2.5.0. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/ca428c31-858d-47fa-adc9-2a59f8e8b2b1 - https://github.com/ikus060/rdiffweb/commit/6efb995bc32c8a8e9ad755eb813dec991dffb2b8
CVE ID: CVE-2022-3363 State: PUBLISHED Published: 2022-10-26T00:00:00.000Z Last Updated: 2025-05-07T18:29:04.465Z Severity: LOW (CVSS 2.8 CVSS:3.0/AV:P/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-840 Description: Business Logic Errors in GitHub repository ikus060/rdiffweb prior to 2.5.0a7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/b8a40ba6-2452-4abe-a80a-2d065ee8891e - https://github.com/ikus060/rdiffweb/commit/c27c46bac656b1da74f28eac1b52dfa5df76e6f2
CVE ID: CVE-2022-3364 State: PUBLISHED Published: 2022-09-29T20:45:12.000Z Last Updated: 2025-05-20T16:04:35.669Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/e70ad507-1424-463b-bdf1-c4a6fbe6e720 - https://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7
CVE ID: CVE-2022-3365 State: PUBLISHED Published: 2025-01-28T00:13:45.409Z Last Updated: 2025-01-28T15:18:05.386Z Vendors: Emote Interactive Products: Remote Mouse Server Problem Types: CWE-327 Description: Due to reliance on a trivial substitution cipher, sent in cleartext, and the reliance on a default password when the user does not set a password, the Remote Mouse Server by Emote Interactive can be abused by attackers to inject OS commands over theproduct's custom control protocol. A Metasploit module was written and tested against version 4.110, the current version when this CVE was reserved. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rapid7/meta
n this CVE was reserved. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/rapid7/metasploit-framework/pull/17067
CVE ID: CVE-2022-3366 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T20:27:05.468Z Vendors: Unknown Products: PublishPress Capabilities – User Role Access, Editor Permissions, Admin Menus, PublishPress Capabilities Pro Problem Types: CWE-502 Description: The PublishPress Capabilities WordPress plugin before 2.5.2, PublishPress Capabilities Pro WordPress plugin before 2.5.2 unserializes the content of imported files, which could lead to PHP object injection attacks by administrators, on multisite WordPress configurations. Successful exploitation in this case requires other plugins with a suitable gadget chain to be present on the site. Additional Analyst Notes:
n in this case requires other plugins with a suitable gadget chain to be present on the site. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/72639924-e7a7-4f7d-bd50-015d05ffd4fb
CVE ID: CVE-2022-3368 State: PUBLISHED Published: 2022-10-17T20:52:01.381Z Last Updated: 2025-05-10T02:51:08.765Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Nortonlifelock Products: "Avira Security" – for Windows Problem Types: Privilege Escalation Description: A vulnerability within the Software Updater functionality of Avira Security for Windows allowed an attacker with write access to the filesystem, to escalate his privileges in certain scenarios. The issue was fixed with Avira Security version 1.1.72.30556. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/sec
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.norton.com/sp/static/external/tools/security-advisories.html
CVE ID: CVE-2022-3369 State: PUBLISHED Published: 2022-11-01T07:45:19.436Z Last Updated: 2025-05-02T16:06:44.011Z Severity: HIGH (CVSS 8.6 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) Vendors: Bitdefender Products: Engines Problem Types: CWE-269 Description: An Improper Access Control vulnerability in the bdservicehost.exe component, as used in Bitdefender Engines for Windows, allows an attacker to delete privileged registry keys by pointing a Registry symlink to a privileged key. This issue affects: Bitdefender Engines versions prior to 7.92659. It also affects Bitdefender Antivirus Free, Bitdefender Antivirus Plus, Bitdefender Internet Security, Bitdefender Total Security, as well as Bitd
r Antivirus Free, Bitdefender Antivirus Plus, Bitdefender Internet Security, Bitdefender Total Security, as well as Bitdefender Endpoint Security Tools for Windows with engine versions prior to 7.92659. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.bitdefender.com/support/security-advisories/improper-handling-of-registry-symbolic-links-in-bitdefender-engines-va-10562
CVE ID: CVE-2022-3370 State: PUBLISHED Published: 2022-11-01T00:00:00 Last Updated: 2024-08-03T01:07:06.553Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Custom Elements in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: References: - https://crbug.com/1366813 - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_30.html
CVE ID: CVE-2022-3371 State: PUBLISHED Published: 2022-09-30T13:15:12.000Z Last Updated: 2025-05-20T16:02:37.767Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-770 Description: Allocation of Resources Without Limits or Throttling in GitHub repository ikus060/rdiffweb prior to 2.5.0a3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ikus060/rdiffweb/commit/b62c479ff6979563c7c23e7182942bc4f460a2c7 - https://huntr.dev/bounties/4e8f6136-50c7-4fa1-ac98-699bcb7b35ce
CVE ID: CVE-2022-3372 State: PUBLISHED Published: 2023-06-21T12:47:01.693Z Last Updated: 2024-12-06T21:18:40.398Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Riello UPS Products: Netman-204 Problem Types: CWE-352 Description: There is a CSRF vulnerability on Netman-204 version 02.05. An attacker could manage to change administrator passwords through a Cross Site Request Forgery due to the lack of proper validation on the CRSF token. This vulnerability could allow a remote attacker to access the administrator panel, being able to modify different parameters that are critical for industrial operations. Additional Analyst Notes: - CVE Program Container: - CIS
fferent parameters that are critical for industrial operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.incibe.es/en/incibe-cert/notices/aviso-sci/cross-site-request-forgery-csrf-riello-ups-netman-204
CVE ID: CVE-2022-3373 State: PUBLISHED Published: 2022-11-01T00:00:00.000Z Last Updated: 2025-05-05T15:12:05.047Z Vendors: Google Products: Chrome Problem Types: Out of bounds write Description: Out of bounds write in V8 in Google Chrome prior to 106.0.5249.91 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/09/stable-channel-update-for-desktop_30.html - https://crbug.com/1366399
CVE ID: CVE-2022-3374 State: PUBLISHED Published: 2022-10-31T00:00:00.000Z Last Updated: 2025-05-06T20:17:11.614Z Vendors: Unknown Products: Ocean Extra Problem Types: CWE-502 Description: The Ocean Extra WordPress plugin before 2.0.5 unserialises the content of an imported file, which could lead to PHP object injections issues when a high privilege user import (intentionally or not) a malicious Customizer Styling file and a suitable gadget chain is present on the blog. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/22fd3f28-9036-4bd5-ad98-ff78bd1b51bc
CVE ID: CVE-2022-3375 State: PUBLISHED Published: 2023-04-05T00:00:00.000Z Last Updated: 2025-02-10T21:11:02.636Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Information exposure through an error message in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5, all versions starting from 15.9 before 15.9.4, all versions starting from 15.10 before 15.10.1. It was possible to disclose the branch names when attacker has a fork of a project that was switched to private. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
t was switched to private. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/376041 - https://hackerone.com/reports/1710533 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3375.json
CVE ID: CVE-2022-3376 State: PUBLISHED Published: 2022-10-06T00:00:00 Last Updated: 2024-08-03T01:07:06.524Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: ikus060 Products: ikus060/rdiffweb Problem Types: CWE-521 Description: Weak Password Requirements in GitHub repository ikus060/rdiffweb prior to 2.5.0a4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/a9021e93-6d18-4ac1-98ce-550c4697a4ed - https://github.com/ikus060/rdiffweb/commit/2ffc2af65c8f8113b06e0b89929c604bcdf844b9
CVE ID: CVE-2022-3377 State: PUBLISHED Published: 2022-10-27T22:17:49.252Z Last Updated: 2025-04-16T17:44:02.711Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape Problem Types: CWE-824 Description: Horner Automation's Cscape version 9.90 SP 6 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer, leading to an out-of-bounds memory read. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/
alyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-03
CVE ID: CVE-2022-3378 State: PUBLISHED Published: 2022-10-27T22:13:41.375Z Last Updated: 2025-04-16T17:44:14.140Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: Horner Automation Products: Cscape Problem Types: CWE-824 Description: Horner Automation's Cscape version 9.90 SP 7 and prior does not properly validate user-supplied data. If a user opens a maliciously formed FNT file, then an attacker could execute arbitrary code within the current process by accessing an uninitialized pointer, leading to an out-of-bounds memory write. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories
nalyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-277-03