Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-23948 State: PUBLISHED Published: 2022-09-21T18:23:36.000Z Last Updated: 2025-05-29T18:27:02.982Z Vendors: n/a Products: keylime Problem Types: CWE-200 Description: A flaw was found in Keylime before 6.3.0. The logic in the Keylime agent for checking for a secure mount can be fooled by previously created unprivileged mounts allowing secrets to be leaked to other processes on the host. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/oss-sec/2022/q1/101 - https://github.com/keylime/keylime/security/advisories/GHSA-wj36-qcfg-5j52 - https://github.com/keylime/keylime/commit/1a4f31a6368d651222683c9debe7d6832db6f607 -
y/advisories/GHSA-wj36-qcfg-5j52 - https://github.com/keylime/keylime/commit/1a4f31a6368d651222683c9debe7d6832db6f607 - https://github.com/keylime/keylime/commit/d37c406e69cb6689baa2fb7964bad75209703724
CVE ID: CVE-2022-23949 State: PUBLISHED Published: 2022-09-21T18:23:47.000Z Last Updated: 2025-05-27T20:34:51.145Z Vendors: n/a Products: keylime Problem Types: CWE-290 Description: In Keylime before 6.3.0, unsanitized UUIDs can be passed by a rogue agent and can lead to log spoofing on the verifier and registrar. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/oss-sec/2022/q1/101 - https://github.com/keylime/keylime/security/advisories/GHSA-87gh-qc28-j9mm - https://github.com/keylime/keylime/commit/387e320dc22c89f4f47c68cb37eb9eec2137f34b - https://github.com/keylime/keylime/commit/e429e95329fc60608713ddfb82f4a92ee3b3d2d9 - http
89f4f47c68cb37eb9eec2137f34b - https://github.com/keylime/keylime/commit/e429e95329fc60608713ddfb82f4a92ee3b3d2d9 - https://github.com/keylime/keylime/commit/65c2b737129b5837f4a03660aeb1191ced275a57
CVE ID: CVE-2022-23950 State: PUBLISHED Published: 2022-09-21T18:25:02.000Z Last Updated: 2025-05-27T20:34:06.188Z Vendors: n/a Products: keylime Problem Types: CWE-379 Description: In Keylime before 6.3.0, Revocation Notifier uses a fixed /tmp path for UNIX domain socket which can allow unprivileged users a method to prohibit keylime operations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/oss-sec/2022/q1/101 - https://github.com/keylime/keylime/security/advisories/GHSA-9r9r-f8xc-m875 - https://github.com/keylime/keylime/commit/ea5d0373fa2c050d5d95404eb779be7e8327b911
CVE ID: CVE-2022-23951 State: PUBLISHED Published: 2022-09-21T18:25:07.000Z Last Updated: 2025-05-27T20:16:04.351Z Vendors: n/a Products: keylime Problem Types: CWE-400 Description: In Keylime before 6.3.0, quote responses from the agent can contain possibly untrusted ZIP data which can lead to zip bombs. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/oss-sec/2022/q1/101 - https://github.com/keylime/keylime/security/advisories/GHSA-6xx7-m45w-76m2 - https://github.com/keylime/keylime/commit/6e44758b64b0ee13564fc46e807f4ba98091c355
CVE ID: CVE-2022-23952 State: PUBLISHED Published: 2022-09-21T18:25:13.000Z Last Updated: 2025-05-22T18:31:00.234Z Vendors: n/a Products: keylime Problem Types: CWE-200 Description: In Keylime before 6.3.0, current keylime installer installs the keylime.conf file, which can contain sensitive data, as world-readable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://seclists.org/oss-sec/2022/q1/101 - https://github.com/keylime/keylime/security/advisories/GHSA-fchm-5w2v-qfm8 - https://github.com/keylime/keylime/commit/883085d6a4bcea3012729014d5b8e15ecd65fc7c
CVE ID: CVE-2022-23953 State: PUBLISHED Published: 2022-03-02T20:58:08 Last Updated: 2024-08-03T03:59:23.397Z Vendors: n/a Products: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC Problem Types: Denial of Service Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5818692-5818718-16
CVE ID: CVE-2022-23954 State: PUBLISHED Published: 2022-03-02T21:33:04 Last Updated: 2024-08-03T03:59:23.358Z Vendors: n/a Products: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC Problem Types: Denial of Service Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5818692-5818718-16
CVE ID: CVE-2022-23955 State: PUBLISHED Published: 2022-03-02T21:34:26 Last Updated: 2024-08-03T03:59:23.315Z Vendors: n/a Products: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC Problem Types: Denial of Service Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5818692-5818718-16
CVE ID: CVE-2022-23956 State: PUBLISHED Published: 2022-03-02T20:56:33 Last Updated: 2024-08-03T03:59:23.440Z Vendors: n/a Products: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC Problem Types: Denial of Service Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5818692-5818718-16
CVE ID: CVE-2022-23957 State: PUBLISHED Published: 2022-03-02T21:36:42 Last Updated: 2024-08-03T03:59:23.179Z Vendors: n/a Products: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC Problem Types: Denial of Service Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5818692-5818718-16
CVE ID: CVE-2022-23958 State: PUBLISHED Published: 2022-03-02T21:35:37 Last Updated: 2024-08-03T03:59:23.332Z Vendors: n/a Products: HP ProBook 440 G8 Notebook PC; HP ProDesk 405 G6 Small Form Factor PC Problem Types: Denial of Service Description: Potential vulnerabilities have been identified in the BIOS for some HP PC products which may allow denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_5818692-5818718-16
CVE ID: CVE-2022-23959 State: PUBLISHED Published: 2022-01-26T00:38:55 Last Updated: 2024-08-03T03:59:23.263Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Varnish Cache before 6.6.2 and 7.x before 7.0.2, Varnish Cache 6.0 LTS before 6.0.10, and and Varnish Enterprise (Cache Plus) 4.1.x before 4.1.11r6 and 6.0.x before 6.0.9r4, request smuggling can occur for HTTP/1 connections. Additional Analyst Notes: - CVE Program Container: References: - https://varnish-cache.org/security/VSV00008.html - https://docs.varnish-software.com/security/VSV00008/ - https://lists.debian.org/debian-lts-announce/2022/02/msg00014.html - https://lists.fedoraproject.org/archives/list/package-announce
ts.debian.org/debian-lts-announce/2022/02/msg00014.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UMMDMQWNAE3BTSZUHXQHVAMZC5TLHLYT/ - https://www.debian.org/security/2022/dsa-5088
CVE ID: CVE-2022-23960 State: PUBLISHED Published: 2022-03-12T23:57:21 Last Updated: 2024-08-03T03:59:23.170Z Vendors: n/a Products: n/a Problem Types: n/a Description: Certain Arm Cortex and Neoverse processors through 2022-03-08 do not properly restrict cache speculation, aka Spectre-BHB. An attacker can leverage the shared branch history in the Branch History Buffer (BHB) to influence mispredicted branches. Then, cache allocation can allow the attacker to obtain sensitive information. Additional Analyst Notes: - CVE Program Container: References: - https://developer.arm.com/support/arm-security-updates/speculative-processor-vulnerability - https://developer.arm.com/support/arm-security-up
com/support/arm-security-updates/speculative-processor-vulnerability - https://developer.arm.com/support/arm-security-updates - http://www.openwall.com/lists/oss-security/2022/03/18/2 - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - https://www.debian.org/security/2022/dsa-5173
CVE ID: CVE-2022-23967 State: REJECTED Published: N/A Last Updated: 2022-12-28T00:00:00 Description: No description available.
CVE ID: CVE-2022-23968 State: PUBLISHED Published: 2022-01-26T05:01:51 Last Updated: 2024-08-03T03:59:23.128Z Vendors: n/a Products: n/a Problem Types: n/a Description: Xerox VersaLink devices on specific versions of firmware before 2022-01-26 allow remote attackers to brick the device via a crafted TIFF file in an unauthenticated HTTP POST request. There is a permanent denial of service because image parsing causes a reboot, but image parsing is restarted as soon as the boot process finishes. However, this boot loop can be resolved by a field technician. The TIFF file must have an incomplete Image Directory. Affected firmware versions include xx.42.01 and xx.50.61. NOTE: the 2022-01-24 NeoS
have an incomplete Image Directory. Affected firmware versions include xx.42.01 and xx.50.61. NOTE: the 2022-01-24 NeoSmart article included "believed to affect all previous and later versions as of the date of this posting" but a 2022-01-26 vendor statement reports "the latest versions of firmware are not vulnerable to this issue." Additional Analyst Notes: - CVE Program Container: References: - https://neosmart.net/blog/2022/xerox-vulnerability-allows-unauthenticated-network-users-to-remotely-brick-printers/ - https://twitter.com/mqudsi/status/1485756915187695618
CVE ID: CVE-2022-23970 State: PUBLISHED Published: 2022-04-07T18:22:24.706889Z Last Updated: 2024-09-17T01:55:53.709Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: ASUS Products: RT-AX56U Problem Types: CWE-22 Description: ASUS RT-AX56U’s update_json function has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another file with the same file name, which results in service disruption. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5784-68aa3-1.html
CVE ID: CVE-2022-23971 State: PUBLISHED Published: 2022-04-07T18:22:26.279026Z Last Updated: 2024-09-17T04:04:05.439Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H) Vendors: ASUS Products: RT-AX56U Problem Types: CWE-22 Description: ASUS RT-AX56U’s update_PLC/PORT file has a path traversal vulnerability due to insufficient filtering for special characters in the URL parameter. An unauthenticated LAN attacker can overwrite a system file by uploading another PLC/PORT file with the same file name, which results in service disruption. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5785-cf8db-1.html
CVE ID: CVE-2022-23972 State: PUBLISHED Published: 2022-04-07T18:22:27.892823Z Last Updated: 2024-09-16T19:30:39.747Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AX56U Problem Types: CWE-89 Description: ASUS RT-AX56U’s SQL handling function has an SQL injection vulnerability due to insufficient user input validation. An unauthenticated LAN attacker to inject arbitrary SQL code to read, modify and delete database. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5786-d2e86-1.html
CVE ID: CVE-2022-23973 State: PUBLISHED Published: 2022-04-07T18:22:29.853519Z Last Updated: 2024-09-17T01:35:51.997Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: ASUS Products: RT-AX56U Problem Types: CWE-787 Description: ASUS RT-AX56U’s user profile configuration function is vulnerable to stack-based buffer overflow due to insufficient validation for parameter length. An unauthenticated LAN attacker can execute arbitrary code to perform arbitrary operations or disrupt service. Additional Analyst Notes: - CVE Program Container: References: - https://www.twcert.org.tw/tw/cp-132-5787-b0e64-1.html
CVE ID: CVE-2022-23974 State: PUBLISHED Published: 2022-04-05T19:55:08 Last Updated: 2024-08-03T03:59:23.228Z Vendors: Apache Software Foundation Products: Apache Pinot Problem Types: CWE-674 Description: In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release 0.10.0 fixes this. See https://docs.pinot.apache.org/basics/releases/0.10.0 Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/3dk8pf1n02p8oj2j3czbtchy
dditional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/3dk8pf1n02p8oj2j3czbtchyjsf8khwr
CVE ID: CVE-2022-23975 State: PUBLISHED Published: 2022-04-18T16:20:30.943Z Last Updated: 2025-02-20T20:26:24.958Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) Vendors: AccessPress Themes Products: Access Demo Importer (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to activate any installed plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/access-demo-importer/#developers - https://patchstack.com/database/vulnerability/access-demo-importer/wordpress-access-demo-importer-plugin-1-0-7
elopers - https://patchstack.com/database/vulnerability/access-demo-importer/wordpress-access-demo-importer-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability-leading-to-arbitrary-plugin-activation
CVE ID: CVE-2022-23976 State: PUBLISHED Published: 2022-04-18T16:20:30.233Z Last Updated: 2025-02-20T20:26:33.800Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H) Vendors: AccessPress Themes Products: Access Demo Importer (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) in Access Demo Importer <= 1.0.7 on WordPress allows an attacker to reset all data (posts / pages / media). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/access-demo-importer/#developers - https://patchstack.com/database/vulnerability/access-demo-importer/wordpress-access-demo-importer-plugi
er/#developers - https://patchstack.com/database/vulnerability/access-demo-importer/wordpress-access-demo-importer-plugin-1-0-7-cross-site-request-forgery-csrf-vulnerability-leading-to-data-reset-posts-pages-media
CVE ID: CVE-2022-23979 State: PUBLISHED Published: 2022-01-28T19:09:55.137Z Last Updated: 2025-02-20T20:32:00.667Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: n/a Products: n/a Problem Types: n/a Description: Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability discovered in Ultimate Reviews WordPress plugin (versions <= 3.0.15). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/ultimate-reviews/#developers - https://patchstack.com/database/vulnerability/ultimate-reviews/wordpress-ultimate-reviews-plugin-3-0-15-authenticated-stored-cross-site-scripting-xss-vulnerabili
lity/ultimate-reviews/wordpress-ultimate-reviews-plugin-3-0-15-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-23980 State: PUBLISHED Published: 2022-02-04T22:29:26.313Z Last Updated: 2025-02-20T20:31:44.142Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N) Vendors: Dario Curvino Products: Yasr – Yet Another Stars Rating (WordPress plugin) Problem Types: CWE-79 Description: Cross-Site Scripting (XSS) vulnerability discovered in Yasr – Yet Another Stars Rating WordPress plugin (versions <= 2.9.9), vulnerable at parameter 'source'. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/yet-another-stars-rating/#developers - https://patchstack.com/database/vulnerability/yet-another-stars-rating/word
ugins/yet-another-stars-rating/#developers - https://patchstack.com/database/vulnerability/yet-another-stars-rating/wordpress-yasr-yet-another-stars-rating-plugin-2-9-9-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-23981 State: PUBLISHED Published: 2022-02-18T17:50:14.146Z Last Updated: 2025-02-20T20:31:37.130Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) Vendors: QuadLayers Products: Perfect Brands for WooCommerce (WordPress plugin) Problem Types: CWE-284 Description: The vulnerability allows Subscriber+ level users to create brands in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/perfect-woocommerce-brands/#developers - https://patchstack.com/database/vulnerability/perfect-woocommerce-brands/wordpress-perfect-brands
e-brands/#developers - https://patchstack.com/database/vulnerability/perfect-woocommerce-brands/wordpress-perfect-brands-for-woocommerce-plugin-2-0-4-subscriber-set-featured-brand-vulnerability
CVE ID: CVE-2022-23982 State: PUBLISHED Published: 2022-02-18T17:50:15.195Z Last Updated: 2025-02-20T20:31:30.158Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: QuadLayers Products: Perfect Brands for WooCommerce (WordPress plugin) Problem Types: CWE-200 Description: The vulnerability discovered in WordPress Perfect Brands for WooCommerce plugin (versions <= 2.0.4) allows server information exposure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/perfect-woocommerce-brands/#developers - https://patchstack.com/database/vulnerability/perfect-woocommerce-brands/wordpress-perfect-brands-f
brands/#developers - https://patchstack.com/database/vulnerability/perfect-woocommerce-brands/wordpress-perfect-brands-for-woocommerce-plugin-2-0-4-server-information-exposure-vulnerability
CVE ID: CVE-2022-23983 State: PUBLISHED Published: 2022-02-21T17:49:30.524Z Last Updated: 2025-02-20T20:31:23.282Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WP-buy Products: WP Content Copy Protection & No Right Click (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability leading to plugin Settings Update discovered in WP Content Copy Protection & No Right Click WordPress plugin (versions <= 3.4.4). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wp-content-copy-protector/#developers - https://patchstack.com/database/vulnerability/wp-
https://wordpress.org/plugins/wp-content-copy-protector/#developers - https://patchstack.com/database/vulnerability/wp-content-copy-protector/wordpress-wp-content-copy-protection-no-right-click-plugin-3-4-4-cross-site-request-forgery-csrf-leads-to-settings-update-vulnerability
CVE ID: CVE-2022-23984 State: PUBLISHED Published: 2022-02-21T17:49:31.251Z Last Updated: 2025-02-20T20:31:16.207Z Severity: LOW (CVSS 3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: gVectors Team Products: Comments – wpDiscuz (WordPress plugin) Problem Types: CWE-200 Description: Sensitive information disclosure discovered in wpDiscuz WordPress plugin (versions <= 7.3.11). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wpdiscuz/#developers - https://patchstack.com/database/vulnerability/wpdiscuz/wordpress-wpdiscuz-plugin-7-3-11-sensitive-information-disclosure
CVE ID: CVE-2022-23985 State: PUBLISHED Published: 2022-02-25T18:10:53.522Z Last Updated: 2025-04-16T18:01:04.565Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: FATEK Automation Products: FvDesigner Problem Types: CWE-787 Description: The affected product is vulnerable to an out-of-bounds write while processing project files, which allows an attacker to craft a project file that would allow arbitrary code execution. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-055-01 - https://www.zerodayinitiative.com/advisories/ZDI-22-432/ - https://www.zerodayinitiative.com/adv
sories/icsa-22-055-01 - https://www.zerodayinitiative.com/advisories/ZDI-22-432/ - https://www.zerodayinitiative.com/advisories/ZDI-22-434/ - https://www.zerodayinitiative.com/advisories/ZDI-22-437/ - https://www.zerodayinitiative.com/advisories/ZDI-22-440/ - https://www.zerodayinitiative.com/advisories/ZDI-22-433/ - https://www.zerodayinitiative.com/advisories/ZDI-22-438/
CVE ID: CVE-2022-23986 State: PUBLISHED Published: 2022-02-24T09:50:31 Last Updated: 2024-08-03T03:59:23.186Z Vendors: Dojin Club MICMNIS Products: phpUploader Problem Types: SQL Injection Description: SQL injection vulnerability in the phpUploader v1.2 and earlier allows a remote unauthenticated attacker to obtain the information in the database via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/shimosyan/phpUploader/releases/tag/v1.2.1 - https://jvn.jp/en/jp/JVN00095004/index.html
CVE ID: CVE-2022-23987 State: PUBLISHED Published: 2022-02-28T09:07:01 Last Updated: 2024-08-03T03:59:23.262Z Vendors: WS Form Products: WS Form LITE – Drag & Drop Contact Form Builder for WordPress, WS Form Pro Problem Types: CWE-79 Description: The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1697351b-c201-4e85-891e-94fdccbdfb55
CVE ID: CVE-2022-23988 State: PUBLISHED Published: 2022-02-28T09:07:03 Last Updated: 2024-08-03T03:59:23.357Z Vendors: WS Form Products: WS Form LITE – Drag & Drop Contact Form Builder for WordPress, WS Form Pro Problem Types: CWE-79 Description: The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privileged user will view the related submission Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9d5738f9-9a2e-4878-8a03-745894420bf6
CVE ID: CVE-2022-23989 State: PUBLISHED Published: 2022-03-15T20:26:36 Last Updated: 2024-08-03T03:59:23.305Z Vendors: n/a Products: n/a Problem Types: n/a Description: In Stormshield Network Security (SNS) before 3.7.25, 3.8.x through 3.11.x before 3.11.13, 4.x before 4.2.10, and 4.3.x before 4.3.5, a flood of connections to the SSLVPN service might lead to saturation of the loopback interface. This could result in the blocking of almost all network traffic, making the firewall unreachable. An attacker could exploit this via forged and properly timed traffic to cause a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu/2022-
ial of service. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.stormshield.eu/2022-003