Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0181 State: PUBLISHED Published: 2022-01-17T09:10:27 Last Updated: 2024-08-02T23:18:42.041Z Vendors: ExpressTech Products: Quiz And Survey Master Problem Types: Cross-site scripting Description: Reflected cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote attacker to inject an arbitrary script via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://quizandsurveymaster.com/ - https://wordpress.org/plugins/quiz-master-next/ - https://jvn.jp/en/jp/JVN72788165/index.html
CVE ID: CVE-2022-0182 State: PUBLISHED Published: 2022-01-17T09:10:29 Last Updated: 2024-08-02T23:18:42.473Z Vendors: ExpressTech Products: Quiz And Survey Master Problem Types: Cross-site scripting Description: Stored cross-site scripting vulnerability in Quiz And Survey Master versions prior to 7.3.7 allows a remote authenticated attacker to inject an arbitrary script via an website that uses Quiz And Survey Master. Additional Analyst Notes: - CVE Program Container: References: - https://quizandsurveymaster.com/ - https://wordpress.org/plugins/quiz-master-next/ - https://jvn.jp/en/jp/JVN72788165/index.html
CVE ID: CVE-2022-0183 State: PUBLISHED Published: 2022-01-17T09:10:31 Last Updated: 2024-08-02T23:18:42.528Z Vendors: KING JIM CO.,LTD. Products: MIRUPASS Problem Types: Missing encryption of sensitive data Description: Missing encryption of sensitive data vulnerability in 'MIRUPASS' PW10 firmware all versions and 'MIRUPASS' PW20 firmware all versions allows an attacker who can physically access the device to obtain the stored passwords. Additional Analyst Notes: - CVE Program Container: References: - https://www.kingjim.co.jp/download/security/#mirupass - https://jvn.jp/en/jp/JVN19826500/index.html
CVE ID: CVE-2022-0184 State: PUBLISHED Published: 2022-01-17T09:10:32 Last Updated: 2024-08-02T23:18:42.544Z Vendors: KING JIM CO.,LTD. Products: TEPRA PRO Problem Types: Insufficiently protected credentials Description: Insufficiently protected credentials vulnerability in 'TEPRA' PRO SR5900P Ver.1.080 and earlier and 'TEPRA' PRO SR-R7900P Ver.1.030 and earlier allows an attacker on the adjacent network to obtain credentials for connecting to the Wi-Fi access point with the infrastructure mode. Additional Analyst Notes: - CVE Program Container: References: - https://www.kingjim.co.jp/download/security/#sr01 - https://jvn.jp/en/jp/JVN81479705/index.html
CVE ID: CVE-2022-0185 State: PUBLISHED Published: 2022-02-11T17:40:57.000Z Last Updated: 2025-10-21T23:15:46.536Z Vendors: n/a Products: kernel Problem Types: CWE-190 Description: A heap-based buffer overflow flaw was found in the way the legacy_parse_param function in the Filesystem Context functionality of the Linux kernel verified the supplied parameters length. An unprivileged (in case of unprivileged user namespaces enabled, otherwise needs namespaced CAP_SYS_ADMIN privilege) local user able to open a filesystem that does not support the Filesystem Context API (and thus fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. Additional Analyst Notes
s fallbacks to legacy handling) could use this flaw to escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=722d94847de2 - https://github.com/Crusaders-of-Rust/CVE-2022-0185 - https://www.openwall.com/lists/oss-security/2022/01/18/7 - https://www.willsroot.io/2022/01/cve-2022-0185.html - https://security.netapp.com/advisory/ntap-20220225-0003/
CVE ID: CVE-2022-0186 State: PUBLISHED Published: 2022-02-21T10:46:02 Last Updated: 2024-08-02T23:18:42.519Z Vendors: Unknown Products: Image Photo Gallery Final Tiles Grid Problem Types: CWE-79 Description: The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.5.3 does not sanitise and escape the Description field when editing a gallery, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks against other users having access to the gallery dashboard Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3a9c44c0-866e-4fdf-b53d-666db2e11720
CVE ID: CVE-2022-0188 State: PUBLISHED Published: 2022-02-14T09:20:58 Last Updated: 2024-08-02T23:18:42.518Z Vendors: Unknown Products: CMP Problem Types: CWE-306 Missing Authentication for Critical Function Description: The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/50b6f770-6f53-41ef-b2f3-2a58e9afd332 - https://plugins.trac.wordpress.org/changeset/2657597/cmp-coming-soon-maintenance
CVE ID: CVE-2022-0189 State: PUBLISHED Published: 2022-02-28T09:06:43 Last Updated: 2024-08-02T23:18:42.528Z Vendors: Unknown Products: WP RSS Aggregator – News Feeds, Autoblogging, Youtube Video Feeds and More Problem Types: CWE-79 Description: The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/52a71bf1-b8bc-479e-b741-eb8fb9685014 - https://plugins.trac.wordpress.org/changeset/2659298
CVE ID: CVE-2022-0190 State: PUBLISHED Published: 2022-02-14T09:20:59 Last Updated: 2024-08-02T23:18:42.514Z Vendors: Unknown Products: Ad Invalid Click Protector (AICP) Problem Types: CWE-89 Description: The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ae322f11-d8b4-4b69-9efa-0fb87475fa44
CVE ID: CVE-2022-0191 State: PUBLISHED Published: 2022-05-02T16:05:34 Last Updated: 2024-08-02T23:18:42.512Z Vendors: Unknown Products: Ad Invalid Click Protector (AICP) Problem Types: CWE-352 Description: The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.7 does not have CSRF check deleting banned users, which could allow attackers to make a logged in admin remove arbitrary bans Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d4c32a02-810f-43d8-946a-b7e18ac54f55 - https://plugins.trac.wordpress.org/changeset/2705068
CVE ID: CVE-2022-0192 State: PUBLISHED Published: 2022-04-22T20:30:46 Last Updated: 2024-08-02T23:18:42.545Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: PCManager Problem Types: CWE-427 Description: A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_201470.html
CVE ID: CVE-2022-0193 State: PUBLISHED Published: 2022-02-14T09:21:01 Last Updated: 2024-08-02T23:18:42.545Z Vendors: Unknown Products: Complianz – GDPR/CCPA Cookie Consent Problem Types: CWE-79 Description: The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/30d1d328-9f19-4c4c-b90a-04937d617864 - https://plugins.trac.wordpress.org/changeset/2654225
CVE ID: CVE-2022-0194 State: PUBLISHED Published: 2023-03-28T00:00:00.000Z Last Updated: 2025-11-04T19:12:50.718Z Severity: CRITICAL (CVSS 9.8 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Netatalk Products: Netatalk Problem Types: CWE-121 Description: This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the ad_addcomment function. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code i
prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-15876. Additional Analyst Notes: - CVE Program Container: References: - https://netatalk.sourceforge.io/3.1/ReleaseNotes3.1.13.html - https://www.zerodayinitiative.com/advisories/ZDI-22-530/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00018.html - https://www.debian.org/security/2023/dsa-5503 - https://security.gentoo.org/glsa/202311-02
CVE ID: CVE-2022-0196 State: PUBLISHED Published: 2022-01-13T00:50:15 Last Updated: 2024-08-02T23:18:42.546Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: phoronix-test-suite Products: phoronix-test-suite/phoronix-test-suite Problem Types: CWE-352 Description: phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phoronix-test-suite/phoronix-test-suite/commit/4f18296a1862fe54a4c58701a1f5ec6bd62a4d94 - https://huntr.dev/bounties/3675eec7-bbce-4dfd-a2d3-d6862dce9ea6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
ce-4dfd-a2d3-d6862dce9ea6 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57V2CSFU5MKWKL6RJUKMXSD4PCRFTMMQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BU7E6OOZCXS3ZWHOQ2AR7MKM56IN2R6R/
CVE ID: CVE-2022-0197 State: PUBLISHED Published: 2022-01-13T00:50:10 Last Updated: 2024-08-02T23:18:42.530Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) Vendors: phoronix-test-suite Products: phoronix-test-suite/phoronix-test-suite Problem Types: CWE-352 Description: phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF) Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/5abb7915-32f4-4fb1-afa7-bb6d8c4c5ad2 - https://github.com/phoronix-test-suite/phoronix-test-suite/commit/4f18296a1862fe54a4c58701a1f5ec6bd62a4d94 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/mes
4a4c58701a1f5ec6bd62a4d94 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/57V2CSFU5MKWKL6RJUKMXSD4PCRFTMMQ/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BU7E6OOZCXS3ZWHOQ2AR7MKM56IN2R6R/
CVE ID: CVE-2022-0198 State: PUBLISHED Published: 2022-01-13T06:45:10 Last Updated: 2024-08-02T23:18:42.562Z Severity: MEDIUM (CVSS 6.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) Vendors: stanfordnlp Products: stanfordnlp/corenlp Problem Types: CWE-611 Description: corenlp is vulnerable to Improper Restriction of XML External Entity Reference Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/3d7e70fe-dddd-4b79-af62-8e058c4d5763 - https://github.com/stanfordnlp/corenlp/commit/1f52136321cfca68b991bd7870563d06cf96624d
CVE ID: CVE-2022-0199 State: PUBLISHED Published: 2022-02-21T10:46:04 Last Updated: 2024-08-02T23:18:42.523Z Vendors: Unknown Products: Coming soon and Maintenance mode Problem Types: CWE-352 Description: The Coming soon and Maintenance mode WordPress plugin before 3.6.8 does not have CSRF check in its coming_soon_send_mail AJAX action, allowing attackers to make logged in admin to send arbitrary emails to all subscribed users via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/1ab1748f-c939-4953-83fc-9df878da7714 - https://plugins.trac.wordpress.org/changeset/2659455
CVE ID: CVE-2022-0200 State: PUBLISHED Published: 2022-02-14T09:21:03 Last Updated: 2024-08-02T23:18:42.544Z Vendors: Unknown Products: Themify Portfolio Post Problem Types: CWE-79 Description: Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bbc0b812-7b30-4ab4-bac8-27c706b3f146
CVE ID: CVE-2022-0201 State: PUBLISHED Published: 2022-02-14T09:21:04 Last Updated: 2024-08-02T23:18:42.547Z Vendors: Maciej Bis Products: Permalink Manager Lite, Permalink Manager Pro Problem Types: CWE-79 Description: The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f274b0d8-74bf-43de-9051-29ce36d78ad4 - https://plugins.trac.wordpress.org/changeset/2656512
CVE ID: CVE-2022-0203 State: PUBLISHED Published: 2022-01-26T12:20:10 Last Updated: 2024-08-02T23:18:42.544Z Severity: HIGH (CVSS 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: crater-invoice Products: crater-invoice/crater Problem Types: CWE-284 Description: Improper Access Control in GitHub repository crater-invoice/crater prior to 6.0.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/395fc553-2b90-4e69-ba07-a316e1c06406 - https://github.com/crater-invoice/crater/commit/dd324c8bb6b17009f82afe8bc830caec7241e992
CVE ID: CVE-2022-0204 State: PUBLISHED Published: 2022-03-09T00:00:00.000Z Last Updated: 2025-11-04T16:09:28.899Z Vendors: n/a Products: bluez Problem Types: CWE-119 Description: A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash, leading to a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2039807 - https://github.com/bluez/bluez/security/advisories/GHSA-479m-xcq5-9g2q - https://github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0 - https://security.gentoo.or
-xcq5-9g2q - https://github.com/bluez/bluez/commit/591c546c536b42bef696d027f64aa22434f8c3f0 - https://security.gentoo.org/glsa/202209-16 - https://lists.debian.org/debian-lts-announce/2022/10/msg00026.html
CVE ID: CVE-2022-0205 State: PUBLISHED Published: 2022-03-07T08:16:23 Last Updated: 2024-08-02T23:18:42.555Z Vendors: Unknown Products: YOP Poll Problem Types: CWE-79 Description: The YOP Poll WordPress plugin before 6.3.5 does not sanitise and escape some of the settings (available to users with a role as low as author) before outputting them, leading to a Stored Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/446de364-720e-41ec-b80e-7678c8f4ad80
CVE ID: CVE-2022-0206 State: PUBLISHED Published: 2022-02-14T09:21:05 Last Updated: 2024-08-02T23:18:42.522Z Vendors: Unknown Products: NewStatPress Problem Types: CWE-79 Description: The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ce12437a-d440-4c4a-9247-95a8f39d00b9
CVE ID: CVE-2022-0207 State: PUBLISHED Published: 2022-08-26T17:25:47 Last Updated: 2024-08-02T23:18:42.543Z Vendors: n/a Products: vdsm Problem Types: CWE-362 Description: A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear text. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2033697 - https://bugzilla.redhat.com/show_bug.cgi?id=2039248 - https://gerrit.ovirt.org/c/vdsm/+/118025 - https://gerrit.ovirt.org/gitweb?p=vdsm.git%3Ba=commit%3Bh=53b0036fc72d3b8877d4e7f047d705e5a4c722e8 - https://access.redhat.com/security/cve/CVE-2022-0207
CVE ID: CVE-2022-0208 State: PUBLISHED Published: 2022-02-14T09:21:07 Last Updated: 2024-08-02T23:18:42.553Z Vendors: Unknown Products: MapPress Maps for WordPress Problem Types: CWE-79 Description: The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/59a2abd0-4aee-47aa-ad3a-865f624fa0fc
CVE ID: CVE-2022-0209 State: PUBLISHED Published: 2022-06-13T13:10:42.000Z Last Updated: 2025-01-31T18:54:29.016Z Vendors: Unknown Products: Mitsol Social Post Feed Problem Types: CWE-79 Description: The Mitsol Social Post Feed WordPress plugin before 1.11 does not escape some of its settings before outputting them back in attributes, which could allow high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/1e4af9be-5c88-4a3e-89ff-dd2b1bc131fe
CVE ID: CVE-2022-0210 State: PUBLISHED Published: 2022-01-18T16:52:30.000Z Last Updated: 2025-02-13T20:41:55.537Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: Random Banner Products: Random Banner Problem Types: CWE-79 Description: The Random Banner WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the category parameter found in the ~/include/models/model.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 4.1.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_htm
is affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-0210 - https://github.com/BigTiger2020/2022/blob/main/Random%20Banner%20Xss.md - https://plugins.trac.wordpress.org/browser/random-banner/tags/4.1.4/include/models/model.php#L132
CVE ID: CVE-2022-0211 State: PUBLISHED Published: 2022-02-21T10:46:05 Last Updated: 2024-08-02T23:18:42.529Z Vendors: Unknown Products: Shield Security – Scanners, Security Hardening, Brute Force Protection & Firewall Problem Types: CWE-79 Description: The Shield Security WordPress plugin before 13.0.6 does not sanitise and escape admin notes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0d276cca-d6eb-4f4c-83dd-fbc03254c679
CVE ID: CVE-2022-0212 State: PUBLISHED Published: 2022-02-14T09:21:08 Last Updated: 2024-08-02T23:18:42.830Z Vendors: Unknown Products: SpiderCalendar Problem Types: CWE-79 Description: The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/15be2d2b-baa3-4845-82cf-3c351c695b47
CVE ID: CVE-2022-0213 State: PUBLISHED Published: 2022-01-14T00:00:00 Last Updated: 2024-08-02T23:18:42.888Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: vim is vulnerable to Heap-based Buffer Overflow Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f3afe1a5-e6f8-4579-b68a-6e5c7e39afed - https://github.com/vim/vim/commit/de05bb25733c3319e18dca44e9b59c6ee389eb26 - http://www.openwall.com/lists/oss-security/2022/01/15/1 - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.or
ian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0214 State: PUBLISHED Published: 2022-02-14T09:21:10 Last Updated: 2024-08-02T23:18:42.546Z Vendors: Unknown Products: Popup | Custom Popup Builder Problem Types: CWE-1284 Improper Validation of Specified Quantity in Input Description: The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ca2e8feb-15d6-4965-ad9c-8da1bc01e0f4
CVE ID: CVE-2022-0215 State: PUBLISHED Published: 2022-01-18T16:52:32.000Z Last Updated: 2025-02-13T20:41:32.669Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: XootiX Products: Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), Side Cart Woocommerce (Ajax) Problem Types: CWE-352 Description: The Login/Signup Popup, Waitlist Woocommerce ( Back in stock notifier ), and Side Cart Woocommerce (Ajax) WordPress plugins by XootiX are vulnerable to Cross-Site Request Forgery via the save_settings function found in the ~/includes/xoo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options o
oo-framework/admin/class-xoo-admin-settings.php file which makes it possible for attackers to update arbitrary options on a site that can be used to create an administrative user account and grant full privileged access to a compromised site. This affects versions <= 2.2 in Login/Signup Popup, versions <= 2.5.1 in Waitlist Woocommerce ( Back in stock notifier ), and versions <= 2.0 in Side Cart Woocommerce (Ajax). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/01/84000-wordpress-sites-affected-by-three-plugins-with-the-same-vulnerability/ - https://wordfence.com/vulnerability-advisories/#CVE-2022-0215 - https://pl
-three-plugins-with-the-same-vulnerability/ - https://wordfence.com/vulnerability-advisories/#CVE-2022-0215 - https://plugins.trac.wordpress.org/browser/easy-login-woocommerce/tags/2.2/includes/xoo-framework/admin/class-xoo-admin-settings.php#L122 - https://plugins.trac.wordpress.org/browser/waitlist-woocommerce/tags/2.5.1/includes/xoo-framework/admin/class-xoo-admin-settings.php#L122 - https://plugins.trac.wordpress.org/browser/side-cart-woocommerce/tags/2.1/includes/xoo-framework/admin/class-xoo-admin-settings.php?rev=2538194#L128
CVE ID: CVE-2022-0216 State: PUBLISHED Published: 2022-08-26T00:00:00 Last Updated: 2024-08-02T23:18:42.831Z Vendors: n/a Products: QEMU Problem Types: CWE-416 Description: A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://starlabs.sg/advisories/22/22-0216/ - https://bugzilla.redhat.com/show_bug.cgi?id=2036953 - https://gi