Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3930 State: PUBLISHED Published: 2022-12-12T17:54:51.323Z Last Updated: 2025-04-22T17:50:22.802Z Vendors: Unknown Products: Directorist Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8728d02a-51db-4447-a843-0264b6ceb413
CVE ID: CVE-2022-3931 State: REJECTED Published: N/A Last Updated: 2022-12-12T00:00:00 Description: No description available.
CVE ID: CVE-2022-3933 State: PUBLISHED Published: 2022-12-12T17:54:37.527Z Last Updated: 2025-04-22T15:11:08.659Z Vendors: Unknown Products: Essential Real Estate Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6395f3f1-5cdf-4c55-920c-accc0201baf4
CVE ID: CVE-2022-3934 State: PUBLISHED Published: 2022-12-12T17:54:40.269Z Last Updated: 2025-04-22T15:06:11.554Z Vendors: Unknown Products: FlatPM Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ab68381f-c4b8-4945-a6a5-1d4d6473b73a
CVE ID: CVE-2022-3935 State: PUBLISHED Published: 2022-12-12T17:54:42.174Z Last Updated: 2025-04-22T15:01:31.606Z Vendors: Unknown Products: Welcart e-Commerce Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/906c5122-dd6d-494b-b66c-4162e234ea05
CVE ID: CVE-2022-3936 State: PUBLISHED Published: 2023-01-02T21:49:22.216Z Last Updated: 2025-04-10T15:13:11.889Z Vendors: Unknown Products: Team Members Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in a multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/921daea1-a06d-4310-8bd9-4db32605e500
CVE ID: CVE-2022-3937 State: PUBLISHED Published: 2022-12-19T13:41:41.660Z Last Updated: 2025-04-17T14:11:00.283Z Vendors: Unknown Products: Easy Video Player Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ac7158c5-3d11-4865-b26f-41ab5a8120af
CVE ID: CVE-2022-3938 State: REJECTED Published: N/A Last Updated: 2023-03-22T00:00:00 Description: No description available.
CVE ID: CVE-2022-3939 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:17:15.576Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: lanyulei Products: ferry Problem Types: CWE-22 Description: A vulnerability, which was classified as critical, has been found in lanyulei ferry. Affected by this issue is some unknown functionality of the file apis/public/file.go of the component API. The manipulation of the argument file leads to path traversal. The attack may be launched remotely. VDB-213446 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - h
igned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.213446
CVE ID: CVE-2022-3940 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:17:07.682Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: lanyulei Products: ferry Problem Types: CWE-22 Description: A vulnerability, which was classified as problematic, was found in lanyulei ferry. This affects an unknown part of the file apis/process/task.go. The manipulation of the argument file_name leads to path traversal. The associated identifier of this vulnerability is VDB-213447. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.213447
CVE ID: CVE-2022-3941 State: PUBLISHED Published: 2022-11-11T00:00:00 Last Updated: 2024-08-03T01:27:53.074Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Activity Log Plugin Problem Types: CWE-707 Description: A vulnerability has been found in Activity Log Plugin and classified as critical. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument X-Forwarded-For leads to improper output neutralization for logs. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213448. Additional Analyst N
s been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213448. Additional Analyst Notes: - CVE Program Container: References: - https://drive.google.com/file/d/1YNOLomPC95rRvtk0topUhStVIa7Y8lcq/view - https://drive.google.com/file/d/1x-pgK3_-uS7NWfkEt_tk4Wc9FhXk-pYX/view - https://vuldb.com/?id.213448
CVE ID: CVE-2022-3942 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:16:59.717Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: SourceCodester Products: Sanitization Management System Problem Types: CWE-707 Description: A vulnerability was found in SourceCodester Sanitization Management System and classified as problematic. This issue affects some unknown processing of the file php-sms/?p=request_quote. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-213449 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: R
213449 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.zerodayinitiative.com/advisories/ZDI-22-532/ - https://vuldb.com/?id.213449
CVE ID: CVE-2022-3943 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:16:53.287Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: ForU Products: CMS Problem Types: CWE-707 Description: A vulnerability was found in ForU CMS. It has been classified as problematic. Affected is an unknown function of the file cms_chip.php. The manipulation of the argument name leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-213450 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Re
dentifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/whiex/c2Rhc2Rhc2Q-/blob/main/MjU1NTI1ODU4ODU%3D.docx - https://vuldb.com/?id.213450
CVE ID: CVE-2022-3944 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:16:47.240Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: jerryhanjj Products: ERP Problem Types: CWE-266 Description: A vulnerability was found in jerryhanjj ERP. It has been declared as critical. Affected by this vulnerability is the function uploadImages of the file application/controllers/basedata/inventory.php of the component Commodity Management. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-21345
e exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-213451. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/jerryhanjj/ERP/issues/3 - https://vuldb.com/?id.213451
CVE ID: CVE-2022-3945 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-30T19:53:39.410Z Severity: CRITICAL (CVSS 9.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L) Vendors: kareadita Products: kareadita/kavita Problem Types: CWE-307 Description: Improper Restriction of Excessive Authentication Attempts in GitHub repository kareadita/kavita prior to 0.6.0.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/55cd91b3-1d94-4d34-8d7f-86660b41fd65 - https://github.com/kareadita/kavita/commit/f8db37d3f9aa42d47e7c4f4ca839e892d3f97afb
CVE ID: CVE-2022-3946 State: PUBLISHED Published: 2022-12-12T17:54:55.841Z Last Updated: 2025-04-22T20:04:08.164Z Vendors: Unknown Products: Welcart e-Commerce Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/b48e4e1d-e682-4b16-81dc-2feee78d7ed0
CVE ID: CVE-2022-3947 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:16:40.895Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: eolinker Products: goku_lite Problem Types: CWE-707 Description: A vulnerability classified as critical has been found in eolinker goku_lite. This affects an unknown part of the file /balance/service/list. The manipulation of the argument route/keyword leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213453 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CI
d. The identifier VDB-213453 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://c2.im5i.com/2022/11/11/26Jg5.png - https://c2.im5i.com/2022/11/11/26c56.png - https://vuldb.com/?id.213453
CVE ID: CVE-2022-3948 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:16:34.116Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: eolinker Products: goku_lite Problem Types: CWE-707 Description: A vulnerability classified as critical was found in eolinker goku_lite. This vulnerability affects unknown code of the file /plugin/getList. The manipulation of the argument route/keyword leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-213454 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vuln
454 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://c2.im5i.com/2022/11/09/XOq61.png - https://c2.im5i.com/2022/11/09/XOvUn.png - https://vuldb.com/?id.213454
CVE ID: CVE-2022-3949 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:16:27.818Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: Sourcecodester Products: Simple Cashiering System Problem Types: CWE-707 Description: A vulnerability, which was classified as problematic, has been found in Sourcecodester Simple Cashiering System. This issue affects some unknown processing of the component User Account Handler. The manipulation of the argument fullname leads to cross site scripting. The attack may be initiated remotely. The associated identifier of this vulnerability is VDB-213455. Additional Analyst Notes: - CVE Program Container: -
ely. The associated identifier of this vulnerability is VDB-213455. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://vuldb.com/?id.213455
CVE ID: CVE-2022-3950 State: PUBLISHED Published: 2022-11-11T00:00:00 Last Updated: 2024-08-03T01:27:54.055Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: sanluan Products: PublicCMS Problem Types: CWE-707 Description: A vulnerability, which was classified as problematic, was found in sanluan PublicCMS. Affected is the function initLink of the file dwz.min.js of the component Tab Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The name of the patch is a972dc9b1c94aea2d84478bf26283904c21e4ca2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213456. Addition
4ca2. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-213456. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/sanluan/PublicCMS/commit/a972dc9b1c94aea2d84478bf26283904c21e4ca2 - https://vuldb.com/?id.213456
CVE ID: CVE-2022-3952 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:16:20.937Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: ManyDesigns Products: Portofino Problem Types: CWE-377 Description: A vulnerability has been found in ManyDesigns Portofino 5.3.2 and classified as problematic. Affected by this vulnerability is the function createTempDir of the file WarFileLauncher.java. The manipulation leads to creation of temporary file in directory with insecure permissions. Upgrading to version 5.3.3 is able to address this issue. The name of the patch is 94653cb357806c9cf24d8d294e6afea33f8f0775. It is recommended to upgrade the
address this issue. The name of the patch is 94653cb357806c9cf24d8d294e6afea33f8f0775. It is recommended to upgrade the affected component. The identifier VDB-213457 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ManyDesigns/Portofino/pull/580 - https://github.com/ManyDesigns/Portofino/releases/tag/v5.3.3 - https://github.com/ManyDesigns/Portofino/commit/94653cb357806c9cf24d8d294e6afea33f8f0775 - https://vuldb.com/?id.213457
CVE ID: CVE-2022-3953 State: REJECTED Published: N/A Last Updated: 2022-11-21T00:00:00 Description: No description available.
CVE ID: CVE-2022-3955 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-14T15:56:18.855Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: tholum Products: crm42 Problem Types: CWE-707 Description: A vulnerability was found in tholum crm42. It has been rated as critical. This issue affects some unknown processing of the file crm42\class\class.user.php of the component Login. The manipulation of the argument user_name leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-213461 was assigned to this vulnerability. Additional Analyst Notes: - CVE Progra
ic and may be used. The identifier VDB-213461 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tholum/crm42/issues/1 - https://vuldb.com/?id.213461
CVE ID: CVE-2022-3956 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:16:13.630Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: tsruban Products: HHIMS Problem Types: CWE-707 Description: A vulnerability classified as critical has been found in tsruban HHIMS 2.1. Affected is an unknown function of the component Patient Portrait Handler. The manipulation of the argument PID leads to sql injection. It is possible to launch the attack remotely. It is recommended to apply a patch to fix this issue. VDB-213462 is the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichm
s the identifier assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tsruban/HHIMS/issues/1 - https://vuldb.com/?id.213462
CVE ID: CVE-2022-3957 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:16:07.327Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: unspecified Products: GPAC Problem Types: CWE-404 Description: A vulnerability classified as problematic was found in GPAC. Affected by this vulnerability is the function svg_parse_preserveaspectratio of the file scenegraph/svg_attributes.c of the component SVG Parser. The manipulation leads to memory leak. The attack can be launched remotely. The name of the patch is 2191e66aa7df750e8ef01781b1930bea87b713bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vul
50e8ef01781b1930bea87b713bb. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-213463. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gpac/gpac/commit/2191e66aa7df750e8ef01781b1930bea87b713bb - https://vuldb.com/?id.213463 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-3958 State: PUBLISHED Published: 2022-11-15T14:24:49.568Z Last Updated: 2025-04-29T20:09:39.611Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Hallo Welt! GmbH Products: BlueSpice Problem Types: CWE-79 Description: Cross-site Scripting (XSS) vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://en.wiki.bluespice.com/wiki/Security:Security_Advisories/BSSA-2022-07
CVE ID: CVE-2022-3959 State: PUBLISHED Published: 2022-11-11T00:00:00.000Z Last Updated: 2025-04-15T13:16:00.717Z Severity: LOW (CVSS 3.1 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: unspecified Products: drogon Problem Types: CWE-330 Description: A vulnerability, which was classified as problematic, has been found in drogon up to 1.8.1. Affected by this issue is some unknown functionality of the component Session Hash Handler. The manipulation leads to small space of random values. The attack may be launched remotely. Upgrading to version 1.8.2 is able to address this issue. The name of the patch is c0d48da99f66aaada17bcd28b07741cac8697647. It is recommended to upgrade the affecte
this issue. The name of the patch is c0d48da99f66aaada17bcd28b07741cac8697647. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213464. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/drogonframework/drogon/pull/1433 - https://github.com/drogonframework/drogon/releases/tag/v1.8.2 - https://github.com/drogonframework/drogon/commit/c0d48da99f66aaada17bcd28b07741cac8697647 - https://vuldb.com/?id.213464
CVE ID: CVE-2022-3960 State: PUBLISHED Published: 2023-04-03T18:48:00.992Z Last Updated: 2025-02-11T14:29:27.641Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: Hitachi Vantara Products: Pentaho Business Analytics Server Problem Types: CWE-96 Description: Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x cannot allow a system administrator to disable scripting capabilities of the Community Dashboard Editor (CDE) plugin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://support.pentaho.com/hc/en-us/articles/14456813547917--Resolved-Pentaho-BA-Server-Imprope
richment: References: - https://support.pentaho.com/hc/en-us/articles/14456813547917--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43940-CVE-2022-3960-
CVE ID: CVE-2022-3961 State: PUBLISHED Published: 2022-12-19T13:41:45.474Z Last Updated: 2025-04-17T13:45:17.509Z Vendors: Unknown Products: Directorist Problem Types: CWE-862 Missing Authorization Description: The Directorist WordPress plugin before 7.4.4 does not prevent users with low privileges (like subscribers) from accessing sensitive system information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6aad6454-de1b-4304-9c14-05e28d08b253
CVE ID: CVE-2022-3962 State: PUBLISHED Published: 2023-09-23T19:00:54.200Z Last Updated: 2024-08-03T01:27:53.126Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Red Hat Products: Red Hat OpenShift Service Mesh 2.3 for RHEL 8, OpenShift Service Mesh 2.1 Problem Types: CWE-74 Description: A content spoofing vulnerability was found in Kiali. It was discovered that Kiali does not implement error handling when the page or endpoint being accessed cannot be found. This issue allows an attacker to perform arbitrary text injection when an error response is retrieved from the URL being accessed. Additional Analyst Notes: - CVE Program Container: References: - https:/
ponse is retrieved from the URL being accessed. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:0542 - https://access.redhat.com/security/cve/CVE-2022-3962 - https://bugzilla.redhat.com/show_bug.cgi?id=2148661
CVE ID: CVE-2022-3963 State: PUBLISHED Published: 2022-11-12T00:00:00.000Z Last Updated: 2025-04-15T13:15:53.149Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: gnuboard5 Problem Types: CWE-707 Description: A vulnerability was found in gnuboard5. It has been classified as problematic. Affected is an unknown function of the file bbs/faq.php of the component FAQ Key ID Handler. The manipulation of the argument fm_id leads to cross site scripting. It is possible to launch the attack remotely. Upgrading to version 5.5.8.2.1 is able to address this issue. The name of the patch is ba062ca5b62809106d5a2f7df942ffcb44ecb5a9. It is recommended to u
is able to address this issue. The name of the patch is ba062ca5b62809106d5a2f7df942ffcb44ecb5a9. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-213540. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/gnuboard/gnuboard5/commit/ba062ca5b62809106d5a2f7df942ffcb44ecb5a9 - https://vuldb.com/?id.213540