Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-45374 State: PUBLISHED Published: 2024-05-17T06:28:46.233Z Last Updated: 2024-08-03T14:09:57.034Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N) Vendors: YARPP Products: YARPP Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in YARPP allows PHP Local File Inclusion.This issue affects YARPP: from n/a through 5.30.4. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/yet-another-related-posts-plugin/wordpress-yet-another-related-posts-plugin-yarpp-plugin-5-30-2-local-file-inclusion?_s_id=cve
CVE ID: CVE-2022-45375 State: PUBLISHED Published: 2022-11-17T22:03:41.305438Z Last Updated: 2024-09-17T01:15:48.590Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: CyberChimps inc. Products: iFeature Slider (WordPress plugin) Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in iFeature Slider plugin <= 1.2 on WordPress. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ifeature-slider/wordpress-ifeature-slider-plugin-1-2-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-45376 State: PUBLISHED Published: 2023-05-22T09:22:45.861Z Last Updated: 2025-01-08T22:07:45.483Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: XootiX Products: Side Cart Woocommerce (Ajax) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in XootiX Side Cart Woocommerce (Ajax) < 2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/side-cart-woocommerce/wordpress-side-cart-woocommerce-ajax-plugin-2-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve
CVE ID: CVE-2022-45377 State: PUBLISHED Published: 2023-12-21T13:06:33.431Z Last Updated: 2024-08-03T14:09:56.992Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: Glen Don L. Mongaya Products: Drag and Drop Multiple File Upload for WooCommerce Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type vulnerability in Glen Don L. Mongaya Drag and Drop Multiple File Upload for WooCommerce.This issue affects Drag and Drop Multiple File Upload for WooCommerce: from n/a through 1.0.8. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/drag-and-drop-multiple-file-upload-for-wooco
gram Container: References: - https://patchstack.com/database/vulnerability/drag-and-drop-multiple-file-upload-for-woocommerce/wordpress-drag-and-drop-multiple-file-upload-for-woocommerce-plugin-1-0-8-multiple-vulnerabilities?_s_id=cve
CVE ID: CVE-2022-45378 State: PUBLISHED Published: 2022-11-14T00:00:00 Last Updated: 2024-08-03T14:09:56.954Z Vendors: Apache Software Foundation Products: Apache SOAP Problem Types: CWE-306 Description: In the default configuration of Apache SOAP, an RPCRouterServlet is available without authentication. This gives an attacker the possibility to invoke methods on the classpath that meet certain criteria. Depending on what classes are available on the classpath this might even lead to arbitrary remote code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: Referen
longer supported by the maintainer. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://lists.apache.org/thread/g4l64s283njhnph2otx7q4gs2j952d31 - http://www.openwall.com/lists/oss-security/2022/11/14/4
CVE ID: CVE-2022-45379 State: PUBLISHED Published: 2022-11-15T00:00:00 Last Updated: 2024-08-03T14:09:57.037Z Vendors: Jenkins project Products: Jenkins Script Security Plugin Description: Jenkins Script Security Plugin 1189.vb_a_b_7c8fd5fde and earlier stores whole-script approvals as the SHA-1 hash of the script, making it vulnerable to collision attacks. Additional Analyst Notes: - CVE Program Container: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2564 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45380 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:12:24.105Z Vendors: Jenkins project Products: Jenkins JUnit Plugin Description: Jenkins JUnit Plugin 1159.v0b_396e1e07dd and earlier converts HTTP(S) URLs in test report output to clickable links in an unsafe manner, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2888 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45381 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:11:11.808Z Vendors: Jenkins project Products: Jenkins Pipeline Utility Steps Plugin Description: Jenkins Pipeline Utility Steps Plugin 2.13.1 and earlier does not restrict the set of enabled prefix interpolators and bundles versions of Apache Commons Configuration library that enable the 'file:' prefix interpolator by default, allowing attackers able to configure Pipelines to read arbitrary files from the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-294
gram Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2949 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45382 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:09:30.595Z Vendors: Jenkins project Products: Jenkins Naginator Plugin Description: Jenkins Naginator Plugin 1.18.1 and earlier does not escape display names of source builds in builds that were triggered via Retry action, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to edit build display names. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2946 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45383 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T14:06:29.683Z Vendors: Jenkins project Products: Jenkins Support Core Plugin Description: An incorrect permission check in Jenkins Support Core Plugin 1206.v14049fa_b_d860 and earlier allows attackers with Support/DownloadBundle permission to download a previously created support bundle containing information limited to users with Overall/Administer permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2804 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45384 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T17:42:25.446Z Vendors: Jenkins project Products: Jenkins Reverse Proxy Auth Plugin Description: Jenkins Reverse Proxy Auth Plugin 1.7.3 and earlier stores the LDAP manager password unencrypted in the global config.xml file on the Jenkins controller where it can be viewed by attackers with access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2094 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45385 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T17:40:56.714Z Vendors: Jenkins project Products: Jenkins CloudBees Docker Hub/Registry Notification Plugin Description: A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2843 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45386 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T17:40:16.211Z Vendors: Jenkins project Products: Jenkins Violations Plugin Description: Jenkins Violations Plugin 0.7.11 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-766 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45387 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T17:38:25.525Z Vendors: Jenkins project Products: Jenkins BART Plugin Description: Jenkins BART Plugin 1.0.3 and earlier does not escape the parsed content of build logs before rendering it on the Jenkins UI, resulting in a stored cross-site scripting (XSS) vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2802 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45388 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T17:37:29.775Z Vendors: Jenkins project Products: Jenkins Config Rotator Plugin Description: Jenkins Config Rotator Plugin 2.0.1 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing unauthenticated attackers to read arbitrary files with '.xml' extension on the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2842 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45389 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T17:36:31.546Z Vendors: Jenkins project Products: Jenkins XP-Dev Plugin Description: A missing permission check in Jenkins XP-Dev Plugin 1.0 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to an attacker-specified repository. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2853 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45390 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T17:35:35.181Z Vendors: Jenkins project Products: Jenkins loader.io Plugin Description: A missing permission check in Jenkins loader.io Plugin 1.0.1 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2857 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45391 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T17:16:34.395Z Vendors: Jenkins project Products: Jenkins NS-ND Integration Performance Publisher Plugin Description: Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier globally and unconditionally disables SSL/TLS certificate and hostname validation for the entire Jenkins controller JVM. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2910%20%281%29 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45392 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T16:23:23.329Z Vendors: Jenkins project Products: Jenkins NS-ND Integration Performance Publisher Plugin Description: Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.143 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by attackers with Extended Read permission, or access to the Jenkins controller file system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2912 - http://www.openwall.com/lists/oss-security/2022/1
- https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2912 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45393 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T16:12:24.591Z Vendors: Jenkins project Products: Jenkins Delete log Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Delete log Plugin 1.0 and earlier allows attackers to delete build logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2920 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45394 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T16:10:31.839Z Vendors: Jenkins project Products: Jenkins Delete log Plugin Description: A missing permission check in Jenkins Delete log Plugin 1.0 and earlier allows attackers with Item/Read permission to delete build logs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2920 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45395 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T16:09:04.009Z Vendors: Jenkins project Products: Jenkins CCCC Plugin Description: Jenkins CCCC Plugin 0.6 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2921 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45396 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T16:05:47.057Z Vendors: Jenkins project Products: Jenkins SourceMonitor Plugin Description: Jenkins SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2927 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45397 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T16:04:59.949Z Vendors: Jenkins project Products: Jenkins OSF Builder Suite : : XML Linter Plugin Description: Jenkins OSF Builder Suite : : XML Linter Plugin 1.0.2 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2937 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45398 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T16:03:32.134Z Vendors: Jenkins project Products: Jenkins Cluster Statistics Plugin Description: A cross-site request forgery (CSRF) vulnerability in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2938 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45399 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T16:02:02.738Z Vendors: Jenkins project Products: Jenkins Cluster Statistics Plugin Description: A missing permission check in Jenkins Cluster Statistics Plugin 0.4.6 and earlier allows attackers to delete recorded Jenkins Cluster Statistics. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2938 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45400 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T15:59:22.464Z Vendors: Jenkins project Products: Jenkins JAPEX Plugin Description: Jenkins JAPEX Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2941 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45401 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T15:57:14.838Z Vendors: Jenkins project Products: Jenkins Associated Files Plugin Description: Jenkins Associated Files Plugin 0.2.1 and earlier does not escape names of associated files, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Item/Configure permission. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.jenkins.io/security/advisory/2022-11-15/#SECURITY-2947 - http://www.openwall.com/lists/oss-security/2022/11/15/4
CVE ID: CVE-2022-45402 State: PUBLISHED Published: 2022-11-15T00:00:00.000Z Last Updated: 2025-04-30T15:55:11.656Z Vendors: Apache Software Foundation Products: Apache Airflow Problem Types: CWE-601 Description: In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/apache/airflow/pull/27576 - https://lists.apache.org/thread/nf4xrkoo6c81g6fdn4vj8k9x2686o9nh - http://www.openwall.com/lists/oss-security/2022/11/15/1
CVE ID: CVE-2022-45403 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:17:44.068Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Service Workers might have learned size of cross-origin media files Description: Service Workers should not be able to infer information about opaque cross-origin responses; but timing information for cross-origin media combined with Range requests might have allowed them to determine the presence or length of a media file. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https
02.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1762078
CVE ID: CVE-2022-45404 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:14:28.271Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Fullscreen notification bypass Description: Through a series of popup and <code>window.print()</code> calls, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https:/
ram Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1790815
CVE ID: CVE-2022-45405 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T15:11:48.903Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Use-after-free in InputStream implementation Description: Freeing arbitrary <code>nsIInputStream</code>'s on a different thread than creation could have led to a use-after-free and potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - h
https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1791314
CVE ID: CVE-2022-45406 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:47:06.561Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Use-after-free of a JavaScript Realm Description: If an out-of-memory condition occurred when creating a JavaScript global, a JavaScript realm may be deleted while references to it lived on in a BaseShape. This could lead to a use-after-free causing a potentially exploitable crash. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa
Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1791975
CVE ID: CVE-2022-45407 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:45:20.867Z Vendors: Mozilla Products: Firefox Problem Types: Loading fonts on workers was not thread-safe Description: If an attacker loaded a font using <code>FontFace()</code> on a background worker, a use-after-free could have occurred, leading to a potentially exploitable crash. This vulnerability affects Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1793314
CVE ID: CVE-2022-45408 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-15T14:41:54.553Z Vendors: Mozilla Products: Firefox ESR, Thunderbird, Firefox Problem Types: Fullscreen notification bypass via windowName Description: Through a series of popups that reuse windowName, an attacker can cause a window to go fullscreen without the user seeing the notification prompt, resulting in potential user confusion or spoofing attacks. This vulnerability affects Firefox ESR < 102.5, Thunderbird < 102.5, and Firefox < 107. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https:/
ram Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-47/ - https://www.mozilla.org/security/advisories/mfsa2022-49/ - https://www.mozilla.org/security/advisories/mfsa2022-48/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1793829