Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0988 State: PUBLISHED Published: 2022-03-25T18:02:30.522Z Last Updated: 2025-04-16T16:38:11.591Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: Delta Electronics Products: DIAEnergie Problem Types: CWE-319 Description: Delta Electronics DIAEnergie (Version 1.7.5 and prior) is vulnerable to cleartext transmission as the web application runs by default on HTTP. This could allow an attacker to remotely read transmitted information between the client and product. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-21-238-03
CVE ID: CVE-2022-0989 State: PUBLISHED Published: 2022-04-11T14:41:03 Last Updated: 2024-08-02T23:47:42.879Z Vendors: Unknown Products: NS WooCommerce Watermark Problem Types: CWE-80 Description: An unprivileged user could use the functionality of the NS WooCommerce Watermark WordPress plugin through 2.11.3 to load images that hide malware for example from passing malicious domains to hide their trace, by making them pass through the vulnerable domain. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a6bfc150-8e3f-4b2d-a6e1-09406af41dd4
CVE ID: CVE-2022-0990 State: PUBLISHED Published: 2022-04-04T17:50:17 Last Updated: 2024-08-02T23:47:43.258Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: janeczku Products: janeczku/calibre-web Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) in GitHub repository janeczku/calibre-web prior to 0.6.18. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/janeczku/calibre-web/commit/4545f4a20d9ff90b99bbd4e3e34b6de4441d6367 - https://huntr.dev/bounties/31649903-c19c-4dae-aee0-a04b095855c5
CVE ID: CVE-2022-0991 State: PUBLISHED Published: 2022-03-19T07:35:09 Last Updated: 2024-08-02T23:47:42.882Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:L) Vendors: admidio Products: admidio/admidio Problem Types: CWE-613 Description: Insufficient Session Expiration in GitHub repository admidio/admidio prior to 4.1.9. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1c406a4e-15d0-4920-8495-731c48473ba4 - https://github.com/admidio/admidio/commit/e84e472ebe517e2ff5795c46dc10b5f49dc4d46a
CVE ID: CVE-2022-0992 State: PUBLISHED Published: 2022-04-19T20:26:33.000Z Last Updated: 2025-05-05T16:43:36.718Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: siteground Products: Security Optimizer – The All-In-One WordPress Protection Plugin Problem Types: CWE-288 Authentication Bypass Using an Alternate Path or Channel Description: The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configu
set-up that allows unauthenticated and unauthorized users to configure 2FA for pending accounts. Upon successful configuration, the attacker is logged in as that user without access to a username/password pair which is the expected first form of authentication. This affects versions up to, and including, 1.2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6e5c6bf7-a653-4571-9566-574d2bb35c4f?source=cve - https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin/ - https://plugins.trac.wordpress.org/changeset/2706302
CVE ID: CVE-2022-0993 State: PUBLISHED Published: 2022-04-19T20:26:36 Last Updated: 2024-10-15T15:25:06.942Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: siteground Products: Security Optimizer – The All-In-One WordPress Protection Plugin Problem Types: CWE-285 Improper Authorization Description: The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success. This affects versions up to, and including, 1.2.5. Additional Analyst Notes: - CVE Program Container: - CI
upon success. This affects versions up to, and including, 1.2.5. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8e3a5566-eee5-4f71-9c93-e59abf913d04?source=cve - https://www.wordfence.com/blog/2022/04/critical-authentication-bypass-vulnerability-patched-in-siteground-security-plugin/ - https://plugins.trac.wordpress.org/changeset/2706302
CVE ID: CVE-2022-0994 State: PUBLISHED Published: 2022-04-18T17:10:41 Last Updated: 2024-08-02T23:47:43.234Z Vendors: Unknown Products: Hummingbird – Optimize Speed, Enable Cache, Minify CSS & Defer Critical JS Problem Types: CWE-79 Description: The Hummingbird WordPress plugin before 3.3.2 does not sanitise and escape the Config Name, which could allow high privilege users, such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e9dd62fc-bb79-4a6b-b99c-60e40f010d7a
CVE ID: CVE-2022-0995 State: PUBLISHED Published: 2022-03-25T18:03:08 Last Updated: 2024-08-02T23:47:42.878Z Vendors: n/a Products: kernel Problem Types: CWE-787 Description: An out-of-bounds (OOB) memory write flaw was found in the Linux kernel’s watch_queue event notification subsystem. This flaw can overwrite parts of the kernel state, potentially allowing a local user to gain privileged access or cause a denial of service on the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2063786 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb - http://packetst
el.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=93ce93587d36493f2f86921fa79921b3cba63fbb - http://packetstormsecurity.com/files/166770/Linux-watch_queue-Filter-Out-Of-Bounds-Write.html - http://packetstormsecurity.com/files/166815/Watch-Queue-Out-Of-Bounds-Write.html - https://security.netapp.com/advisory/ntap-20220429-0001/
CVE ID: CVE-2022-0996 State: PUBLISHED Published: 2022-03-23T19:46:16.000Z Last Updated: 2025-11-03T20:34:34.393Z Vendors: n/a Products: 389-ds-base Problem Types: Impoper Authentication Description: A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2064769 - https://github.com/ByteHackr/389-ds-base - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PYT2IQJFHQWZENJJRY6EJB3XIFZGNT7F/ - https://lists.fedoraproject.org/archives/list/package-announce%4
project.org/message/PYT2IQJFHQWZENJJRY6EJB3XIFZGNT7F/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4QFD7CBBX3IZOSHEWL2EYKRLOEQSXCZ6/ - https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
CVE ID: CVE-2022-0997 State: PUBLISHED Published: 2022-05-17T19:31:43.358303Z Last Updated: 2024-09-17T01:51:19.514Z Severity: LOW (CVSS 3.9 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N) Vendors: Fidelis Cybersecurity Products: Fidelis Network, Fidelis Deception Problem Types: CWE-276 Description: Improper file permissions in the CommandPost, Collector, and Sensor components of Fidelis Network and Deception enables an attacker with local, administrative access to the CLI to modify affected script files, which could result in arbitrary commands being run as root upon subsequent logon by a root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches
ent logon by a root user. The vulnerability is present in Fidelis Network and Deception versions prior to 9.4.5. Patches and updates are available to address this vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://fidelissecurity.zendesk.com/hc/en-us/articles/6211730139411
CVE ID: CVE-2022-0998 State: PUBLISHED Published: 2022-03-30T16:03:05 Last Updated: 2024-08-02T23:47:42.904Z Vendors: n/a Products: Kernel Problem Types: CWE-190 Description: An integer overflow flaw was found in the Linux kernel’s virtio device driver code in the way a user triggers the vhost_vdpa_config_validate function. This flaw allows a local user to crash or potentially escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/netdev/20220123001216.2460383-13-sashal%40kernel.org/ - http://www.openwall.com/lists/oss-security/2022/04/02/1 - https://security.netapp.com/advisory/ntap-20220513-0003/
CVE ID: CVE-2022-0999 State: PUBLISHED Published: 2022-04-11T19:38:30.000Z Last Updated: 2025-04-16T17:56:13.569Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: mySCADA Products: myPRO Problem Types: CWE-77 Description: An authenticated user may be able to misuse parameters to inject arbitrary operating system commands into mySCADA myPRO versions 8.25.0 and prior. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-083-02
CVE ID: CVE-2022-1000 State: PUBLISHED Published: 2022-03-17T10:30:14 Last Updated: 2024-08-02T23:47:42.649Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: prasathmani Products: prasathmani/tinyfilemanager Problem Types: CWE-22 Description: Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5995a93f-0c4b-4f7d-aa59-a64424219424 - https://github.com/prasathmani/tinyfilemanager/commit/154947ef83efeb68fc2b921065392b6a7fc9c965
CVE ID: CVE-2022-1001 State: PUBLISHED Published: 2022-04-18T17:10:42 Last Updated: 2024-08-02T23:47:43.232Z Vendors: Unknown Products: WP Downgrade | Specific Core Version Problem Types: CWE-79 Description: The WP Downgrade WordPress plugin before 1.2.3 only perform client side validation of its "WordPress Target Version" settings, but does not sanitise and escape it server side, allowing high privilege users such as admin to perform Cross-Site attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/34a7b3cd-e2b5-4891-ab33-af6a2a0eeceb - https://plugins.trac.wordpress.org/changeset/26960
tps://wpscan.com/vulnerability/34a7b3cd-e2b5-4891-ab33-af6a2a0eeceb - https://plugins.trac.wordpress.org/changeset/2696091
CVE ID: CVE-2022-1002 State: PUBLISHED Published: 2022-03-18T18:00:22 Last Updated: 2024-12-06T23:10:17.690Z Severity: LOW (CVSS 2 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-80 Description: Mattermost 6.3.0 and earlier fails to properly sanitize the HTML content in the email invitation sent to guest users, which allows registered users with special permissions to invite guest users to inject unescaped HTML content in the email invitations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/ - https://hackerone.com/reports/1443567
CVE ID: CVE-2022-1003 State: PUBLISHED Published: 2022-03-18T18:00:21 Last Updated: 2024-12-06T23:10:28.943Z Severity: LOW (CVSS 3.3 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-268 Description: One of the API in Mattermost version 6.3.0 and earlier fails to properly protect the permissions, which allows the system administrators to combine the two distinct privileges/capabilities in a way that allows them to override certain restricted configurations like EnableUploads. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2022-1004 State: PUBLISHED Published: 2022-03-21T09:15:52.322368Z Last Updated: 2024-09-17T02:32:38.359Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: OTRS AG Products: OTRS Problem Types: CWE-200 Description: Accounted time is shown in the Ticket Detail View (External Interface), even if ExternalFrontend::TicketDetailView###AccountedTimeDisplay is disabled. Additional Analyst Notes: - CVE Program Container: References: - https://otrs.com/release-notes/otrs-security-advisory-2022-06/
CVE ID: CVE-2022-1005 State: PUBLISHED Published: 2022-06-06T08:50:53 Last Updated: 2024-08-02T23:47:42.970Z Vendors: Unknown Products: WP Statistics Problem Types: CWE-79 Description: The WP Statistics WordPress plugin before 13.2.2 does not sanitise the REQUEST_URI parameter before outputting it back in the rendered page, leading to Cross-Site Scripting (XSS) in web browsers which do not encode characters Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f37d1d55-10cc-4202-8d16-9ec2128f54f9
CVE ID: CVE-2022-1006 State: PUBLISHED Published: 2022-04-11T14:41:04 Last Updated: 2024-08-02T23:47:42.797Z Vendors: Unknown Products: Advanced Booking Calendar Problem Types: CWE-89 Description: The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the id parameter when editing Calendars, which could allow high privilege users such as admin to perform SQL injection attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c5569317-b8c8-4524-8375-3e2369bdcc68 - https://plugins.trac.wordpress.org/changeset/2695427
CVE ID: CVE-2022-1007 State: PUBLISHED Published: 2022-04-11T14:41:06 Last Updated: 2024-08-02T23:47:42.810Z Vendors: Unknown Products: Advanced Booking Calendar Problem Types: CWE-79 Description: The Advanced Booking Calendar WordPress plugin before 1.7.1 does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2695427 - https://wpscan.com/vulnerability/6f5b764b-d13b-4371-9cc5-91204d9d6358
CVE ID: CVE-2022-1008 State: PUBLISHED Published: 2022-04-11T14:41:07 Last Updated: 2024-08-02T23:47:43.121Z Vendors: Unknown Products: One Click Demo Import Problem Types: CWE-434 Description: The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files (such as PHP) even when FILE_MODS and FILE_EDIT are disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0c2e2b4d-49eb-4fd9-b9f0-3feae80c1082 - https://plugins.trac.wordpress.org/changeset/2695999
CVE ID: CVE-2022-1009 State: PUBLISHED Published: 2022-05-30T08:35:37 Last Updated: 2024-08-02T23:47:42.943Z Vendors: Unknown Products: Smush – Lazy Load Images, Optimize & Compress Images Problem Types: CWE-79 Description: The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bb5af08f-bb19-46a1-a7ac-8381f428c11e
CVE ID: CVE-2022-1010 State: PUBLISHED Published: 2022-06-27T08:55:59 Last Updated: 2024-08-02T23:47:42.931Z Vendors: Unknown Products: Login using WordPress Users ( WP as SAML IDP ) Problem Types: CWE-79 Description: The Login using WordPress Users ( WP as SAML IDP ) WordPress plugin before 1.13.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/e9e4dfbe-01b2-4003-80ed-db1e45f38b2b
CVE ID: CVE-2022-1011 State: PUBLISHED Published: 2022-03-18T00:00:00 Last Updated: 2024-08-02T23:47:43.229Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized access to data from the FUSE filesystem, resulting in privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse.git/commit/?h=for-next - https://bugzilla.redhat.com/show_bug.cgi?id=2064855 - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - https://www.debia
hat.com/show_bug.cgi?id=2064855 - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - https://www.debian.org/security/2022/dsa-5173 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-1012 State: PUBLISHED Published: 2022-08-05T00:00:00 Last Updated: 2024-08-02T23:47:42.922Z Vendors: n/a Products: Kernel Problem Types: CWE-401 Description: A memory leak problem was found in the TCP source port generation algorithm in net/ipv4/tcp.c due to the small table perturb size. This flaw may allow an attacker to information leak and may cause a denial of service problem. Additional Analyst Notes: - CVE Program Container: References: - https://lore.kernel.org/lkml/20220427065233.2075-1-w%401wt.eu/T/ - https://bugzilla.redhat.com/show_bug.cgi?id=2064604 - https://security.netapp.com/advisory/ntap-20221020-0006/
CVE ID: CVE-2022-1013 State: PUBLISHED Published: 2022-05-09T16:50:43 Last Updated: 2024-08-02T23:47:42.954Z Vendors: Unknown Products: Personal Dictionary Problem Types: CWE-89 Description: The Personal Dictionary WordPress plugin before 1.3.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to a blind SQL injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eed70659-9e3e-42a2-b427-56c52e0fbc0d
CVE ID: CVE-2022-1014 State: PUBLISHED Published: 2022-05-23T07:15:23 Last Updated: 2024-08-02T23:47:42.666Z Vendors: Unknown Products: WP Contacts Manager Problem Types: CWE-89 Description: The WP Contacts Manager WordPress plugin through 2.2.4 fails to properly sanitize user supplied POST data before it is being interpolated in an SQL statement and then executed, leading to an SQL injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eb9e202d-04aa-4343-86a2-4aa2edaa7f6b
CVE ID: CVE-2022-1015 State: PUBLISHED Published: 2022-04-29T00:00:00 Last Updated: 2024-08-02T23:47:43.279Z Vendors: n/a Products: kernel Problem Types: CWE-787 Description: A flaw was found in the Linux kernel in linux/net/netfilter/nf_tables_api.c of the netfilter subsystem. This flaw allows a local user to cause an out-of-bounds write issue. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2065323 - http://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/ - https://seclists.org/oss-sec/2022/q1/205 - http://www.openwall.com/lists/oss-security/2022/08/25/2 - http://packetstormsecurity.com/files/169951/Kerne
022/q1/205 - http://www.openwall.com/lists/oss-security/2022/08/25/2 - http://packetstormsecurity.com/files/169951/Kernel-Live-Patch-Security-Notice-LSN-0090-1.html - http://www.openwall.com/lists/oss-security/2023/01/13/2 - http://www.openwall.com/lists/oss-security/2023/02/23/1
CVE ID: CVE-2022-1016 State: PUBLISHED Published: 2022-08-29T14:03:06 Last Updated: 2024-08-02T23:47:42.700Z Vendors: n/a Products: Kernel Problem Types: CWE-824 Description: A flaw was found in the Linux kernel in net/netfilter/nf_tables_core.c:nft_do_chain, which can cause a use-after-free. This issue needs to handle 'return' with proper preconditions, as it can lead to a kernel information leak problem caused by a local, unprivileged attacker. Additional Analyst Notes: - CVE Program Container: References: - http://blog.dbouman.nl/2022/04/02/How-The-Tables-Have-Turned-CVE-2022-1015-1016/ - https://seclists.org/oss-sec/2022/q1/205 - https://bugzilla.redhat.com/show_bug.cgi?id=2066614 - http
-2022-1015-1016/ - https://seclists.org/oss-sec/2022/q1/205 - https://bugzilla.redhat.com/show_bug.cgi?id=2066614 - https://access.redhat.com/security/cve/CVE-2022-1016
CVE ID: CVE-2022-1018 State: PUBLISHED Published: 2022-04-01T22:17:24.599Z Last Updated: 2025-04-16T16:32:28.157Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: Rockwell Automation Products: Connected Component Workbench, ISaGRAF, Safety Instrumented Systems Workstation Problem Types: CWE-611 Description: When opening a malicious solution file provided by an attacker, the application suffers from an XML external entity vulnerability due to an unsafe call within a dynamic link library file. An attacker could exploit this to pass data from local files to a remote web server, leading to a loss of confidentiality. Additional Analyst Notes: - CVE Program Contain
ocal files to a remote web server, leading to a loss of confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-088-01
CVE ID: CVE-2022-1019 State: PUBLISHED Published: 2022-04-19T20:38:25.000Z Last Updated: 2025-04-16T16:29:16.024Z Severity: MEDIUM (CVSS 5.2 CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: Automated Logic Products: WebCtrl Server Problem Types: CWE-601 Description: Automated Logic's WebCtrl Server Version 6.1 'Help' index pages are vulnerable to open redirection. The vulnerability allows an attacker to send a maliciously crafted URL which could result in redirecting the user to a malicious webpage or downloading a malicious file. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.corporate.carrier.com/Images/CARR-PSA-ALC-WebCTRL-001-1
am Container: - CISA ADP Vulnrichment: References: - https://www.corporate.carrier.com/Images/CARR-PSA-ALC-WebCTRL-001-1121_tcm558-149395.pdf
CVE ID: CVE-2022-1020 State: PUBLISHED Published: 2022-04-18T17:10:44 Last Updated: 2024-08-02T23:47:43.248Z Vendors: Unknown Products: Product Table for WooCommerce (wooproducttable) Problem Types: CWE-862, CWE-352 Description: The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does not validate the callback parameter, allowing unauthenticated attackers to call arbitrary functions with either none or one user controlled argument Additional Analyst Notes: - CVE Program Container: References: - http
s with either none or one user controlled argument Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/04fe89b3-8ad1-482f-a96d-759d1d3a0dd5