Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
7/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IBUOQTNTQ4ZCXHOCNKYIL2ZUIAZ675RD/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KCEAPIVPRTJHKPF2A2HVF5XHD5XJT3MN/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6JP355XFVAB33X4BNO3ERVTURFYEDB7/ - https://www.debian.org/security/2022/dsa-5161
CVE ID: CVE-2022-1790 State: PUBLISHED Published: 2022-06-13T12:42:57 Last Updated: 2024-08-03T00:16:59.968Z Vendors: Unknown Products: New User Email Set Up Problem Types: CWE-352 Description: The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/176d5761-4f01-4173-a70c-6052a6a9963e
CVE ID: CVE-2022-1791 State: PUBLISHED Published: 2022-06-13T12:42:58 Last Updated: 2024-08-03T00:17:00.794Z Vendors: Unknown Products: One Click Plugin Updater Problem Types: CWE-352 Description: The One Click Plugin Updater WordPress plugin through 2.4.14 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and disable / hide the badge of the available updates and the related check. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/5c185269-cb3a-4463-8d73-b190813d4431
CVE ID: CVE-2022-1792 State: PUBLISHED Published: 2022-06-13T12:43:00 Last Updated: 2024-08-03T00:16:59.933Z Vendors: Unknown Products: Quick Subscribe Problem Types: CWE-352 Description: The Quick Subscribe WordPress plugin through 1.7.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and leading to Stored XSS due to the lack of sanitisation and escaping in some of them Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/44555c79-480d-4b6a-9fda-988183c06909
CVE ID: CVE-2022-1793 State: PUBLISHED Published: 2022-06-13T12:43:02 Last Updated: 2024-08-03T00:16:59.915Z Vendors: Unknown Products: Private Files Problem Types: CWE-352 Description: The Private Files WordPress plugin through 0.40 is missing CSRF check when disabling the protection, which could allow attackers to make a logged in admin perform such action via a CSRF attack and make the blog public Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fd8b84b4-6944-4638-bdc1-1cb6aaabd42c
CVE ID: CVE-2022-1794 State: PUBLISHED Published: 2022-07-11T10:40:27.897940Z Last Updated: 2024-09-16T20:38:06.332Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: CODESYS Products: CODESYS OPC DA Server Problem Types: CWE-256 Description: The CODESYS OPC DA Server prior V3.5.18.20 stores PLC passwords as plain text in its configuration file so that it is visible to all authorized Microsoft Windows users of the system. Additional Analyst Notes: - CVE Program Container: References: - https://customers.codesys.com/index.php?eID=dumpFile&t=f&f=17129&token=1c1485c4a700c04f2069699f5be7558d276ca117&download=
CVE ID: CVE-2022-1795 State: PUBLISHED Published: 2022-05-18T00:00:00 Last Updated: 2024-08-03T00:16:59.885Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:H) Vendors: gpac Products: gpac/gpac Problem Types: CWE-416 Description: Use After Free in GitHub repository gpac/gpac prior to v2.1.0-DEV. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9c312763-41a6-4fc7-827b-269eb86efcbc - https://github.com/gpac/gpac/commit/c535bad50d5812d27ee5b22b54371bddec411514 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-1796 State: PUBLISHED Published: 2022-05-19T00:00:00 Last Updated: 2024-08-03T00:16:59.889Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-416 Description: Use After Free in GitHub repository vim/vim prior to 8.2.4979. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f6739b58-49f9-4056-a843-bf76bbc1253e - https://github.com/vim/vim/commit/28d032cc688ccfda18c5bbcab8b50aba6e18cde5 - https://security.gentoo.org/glsa/202208-32 - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1797 State: PUBLISHED Published: 2022-05-31T19:04:44.000Z Last Updated: 2025-04-16T16:17:49.601Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: Rockwell Automation Products: CompactLogix 5380 controllers, Compact GuardLogix 5380 controllers, CompactLogix 5480 controllers, ControlLogix 5580 controllers, GuardLogix 5580 controllers, CompactLogix 5370 controllers, Compact GuardLogix 5370 controllers, ControlLogix 5570 controllers, GuardLogix 5570 controllers Problem Types: CWE-400 Description: A malformed Class 3 common industrial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Con
trial protocol message with a cached connection can cause a denial-of-service condition in Rockwell Automation Logix Controllers, resulting in a major nonrecoverable fault. If the target device becomes unavailable, a user would have to clear the fault and redownload the user project file to bring the device back online. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-144-01 - https://rockwellautomation.custhelp.com/app/answers/answer_view/a_id/1135559
CVE ID: CVE-2022-1798 State: PUBLISHED Published: 2022-09-15T15:45:12.000Z Last Updated: 2025-04-21T13:49:58.573Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:H) Vendors: Google LLC Products: Kubevirt Problem Types: CWE-20 Description: A path traversal vulnerability in KubeVirt versions up to 0.56 (and 0.55.1) on all platforms allows a user able to configure the kubevirt to read arbitrary files on the host filesystem which are publicly readable or which are readable for UID 107 or GID 107. /proc/self/<> is not accessible. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubevirt/kubevirt/security/advisories/GH
VE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/kubevirt/kubevirt/security/advisories/GHSA-qv98-3369-g364
CVE ID: CVE-2022-1799 State: PUBLISHED Published: 2022-07-29T09:15:12.000Z Last Updated: 2025-04-21T13:51:11.410Z Severity: MEDIUM (CVSS 5.7 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:N) Vendors: Google LLC Products: Google Play Services SDK Problem Types: CWE-501 Description: Incorrect signature trust exists within Google Play services SDK play-services-basement. A debug version of Google Play services is trusted by the SDK for devices that are non-GMS. We recommend upgrading the SDK past the 2022-05-03 release. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://developers.google.com/android/guides/releases#may_03_2022
CVE ID: CVE-2022-1800 State: PUBLISHED Published: 2022-06-13T12:43:04 Last Updated: 2024-08-03T00:17:00.638Z Vendors: Unknown Products: Export any WordPress data to XML/CSV Problem Types: CWE-89 Description: The Export any WordPress data to XML/CSV WordPress plugin before 1.3.5 does not sanitize the cpt POST parameter when exporting post data before using it in a database query, leading to an SQL injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4267109c-0ca2-441d-889d-fb39c235f128
CVE ID: CVE-2022-1801 State: PUBLISHED Published: 2022-06-20T10:25:59 Last Updated: 2024-08-03T00:16:59.881Z Vendors: Unknown Products: Very Simple Contact Form Problem Types: CWE-804 Description: The Very Simple Contact Form WordPress plugin before 11.6 exposes the solution to the captcha in the rendered contact form, both as hidden input fields and as plain text in the page, making it very easy for bots to bypass the captcha check, rendering the page a likely target for spam bots. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a5c97809-2ffc-4efb-8c80-1b734361cd06
CVE ID: CVE-2022-1802 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:17:14.207Z Vendors: Mozilla Products: Firefox ESR, Firefox, Firefox for Android, Thunderbird Problem Types: Prototype pollution in Top-Level Await implementation Description: If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - htt
and Thunderbird < 91.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-19/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1770137
CVE ID: CVE-2022-1803 State: PUBLISHED Published: 2022-05-20T21:40:18 Last Updated: 2024-08-03T00:16:59.970Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: polonel Products: polonel/trudesk Problem Types: CWE-1021 Description: Improper Restriction of Rendered UI Layers or Frames in GitHub repository polonel/trudesk prior to 1.2.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/47cc6621-2474-40f9-ab68-3cf62389a124 - https://github.com/polonel/trudesk/commit/6ea9db7a5cf300e3cbf0eab7e1d6da1155a2f7f8
CVE ID: CVE-2022-1804 State: PUBLISHED Published: 2025-03-25T12:28:08.041Z Last Updated: 2025-03-25T12:58:47.368Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: Ubuntu Products: Linux Problem Types: CWE-269 Description: accountsservice no longer drops permissions when writting .pam_environment Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://bugs.launchpad.net/ubuntu/+source/accountsservice/+bug/1974250 - https://ubuntu.com/security/notices/USN-5439-1
CVE ID: CVE-2022-1805 State: PUBLISHED Published: 2022-07-28T14:21:09 Last Updated: 2024-08-03T00:16:59.963Z Vendors: n/a Products: Tera2 Zero Client Problem Types: Man in the Middle Attack Description: When connecting to Amazon Workspaces, the SHA256 presented by AWS connection provisioner is not fully verified by Zero Clients. The issue could be exploited by an adversary that places a MITM (Man in the Middle) between a zero client and AWS session provisioner in the network. This issue is only applicable when connecting to an Amazon Workspace from a PCoIP Zero Client. Additional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_6545906-6545930-1
tional Analyst Notes: - CVE Program Container: References: - https://support.hp.com/us-en/document/ish_6545906-6545930-16/hpsbhf03794
CVE ID: CVE-2022-1806 State: PUBLISHED Published: 2022-05-20T09:10:12 Last Updated: 2024-08-03T00:17:00.938Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: rtxteam Products: rtxteam/rtx Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/101a2a31-0b27-433a-ad3a-a216238ca4d1 - https://github.com/rtxteam/rtx/commit/9bb109b0014f952f315c7b89e0f29a9ba84ee04c
CVE ID: CVE-2022-1807 State: PUBLISHED Published: 2022-09-07T18:00:14.000Z Last Updated: 2025-06-17T19:36:39.421Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Sophos Products: Sophos Firewall Problem Types: n/a Description: Multiple SQLi vulnerabilities in Webadmin allow for privilege escalation from admin to super-admin in Sophos Firewall older than version 18.5 MR4 and version 19.0 MR1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220907-sfos-18-5-4 - https://www.sophos.com/en-us/security-advisories/sophos-sa-20220907-sfos-19-0-1
CVE ID: CVE-2022-1808 State: PUBLISHED Published: 2022-05-31T22:00:13 Last Updated: 2024-08-03T00:16:59.940Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: polonel Products: polonel/trudesk Problem Types: CWE-250 Description: Execution with Unnecessary Privileges in GitHub repository polonel/trudesk prior to 1.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9-polonel/trudesk - https://github.com/polonel/trudesk/commit/f739eac6fc52adc0cba83a49034100e5b99ac7c8
CVE ID: CVE-2022-1809 State: PUBLISHED Published: 2022-05-21T22:25:09 Last Updated: 2024-08-03T00:17:00.598Z Severity: HIGH (CVSS 7.4 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-824 Description: Access of Uninitialized Pointer in GitHub repository radareorg/radare2 prior to 5.7.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0730a95e-c485-4ff2-9a5d-bb3abfda0b17 - https://github.com/radareorg/radare2/commit/919e3ac1a13f753c73e7a8e8d8bb4a143218732d
CVE ID: CVE-2022-1810 State: PUBLISHED Published: 2022-05-23T00:00:00 Last Updated: 2024-08-03T00:16:59.904Z Severity: CRITICAL (CVSS 9.9 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H) Vendors: publify Products: publify/publify Problem Types: CWE-639 Description: Authorization Bypass Through User-Controlled Key in GitHub repository publify/publify prior to 9.2.9. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9b2d7579-032e-42da-b736-4b10a868eacb - https://github.com/publify/publify/commit/c0aba87844d1e47da50c0d99a3465164a4d244ce
CVE ID: CVE-2022-1811 State: PUBLISHED Published: 2022-05-23T13:30:12 Last Updated: 2024-08-03T00:16:59.877Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:L) Vendors: publify Products: publify/publify Problem Types: CWE-434 Description: Unrestricted Upload of File with Dangerous Type in GitHub repository publify/publify prior to 9.2.9. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4d97f665-c9f1-4c38-b774-692255a7c44c - https://github.com/publify/publify/commit/0fb6b027fbaf17f6a6551f2148482a03eac12927
CVE ID: CVE-2022-1812 State: PUBLISHED Published: 2023-01-14T00:00:00.000Z Last Updated: 2025-04-07T18:31:13.781Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: publify Products: publify/publify Problem Types: CWE-190 Description: Integer Overflow or Wraparound in GitHub repository publify/publify prior to 9.2.10. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/17d86a50-265c-4ec8-9592-0bd909ddc8f3 - https://github.com/publify/publify/commit/29a5837c29620e33857d7a5afce01384e3f8e41a
CVE ID: CVE-2022-1813 State: PUBLISHED Published: 2022-05-22T16:10:09 Last Updated: 2024-08-03T00:16:59.892Z Severity: HIGH (CVSS 8.3 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H) Vendors: yogeshojha Products: yogeshojha/rengine Problem Types: CWE-78 Description: OS Command Injection in GitHub repository yogeshojha/rengine prior to 1.2.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b255cf59-9ecd-4255-b9a2-b40b5ec6c572 - https://github.com/yogeshojha/rengine/commit/8277cec0f008a0451371a92e7e0bf082ab3f0c34
CVE ID: CVE-2022-1814 State: PUBLISHED Published: 2022-06-13T12:43:06 Last Updated: 2024-08-03T00:17:00.389Z Vendors: Unknown Products: WP Admin Style Problem Types: CWE-79 Description: The WP Admin Style WordPress plugin through 0.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b5624fb3-b110-4b36-a00f-20bbc3a8fdb9
CVE ID: CVE-2022-1815 State: PUBLISHED Published: 2022-05-25T08:15:15 Last Updated: 2024-08-03T00:16:59.916Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository jgraph/drawio prior to 18.1.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6e856a25-9117-47c6-9375-52f78876902f - https://github.com/jgraph/drawio/commit/c287bef9101d024b1fd59d55ecd530f25000f9d8
CVE ID: CVE-2022-1816 State: PUBLISHED Published: 2022-05-23T11:30:14 Last Updated: 2024-10-15T17:13:17.850Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Zoo Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in Zoo Management System 1.0. Affected by this issue is /zoo/admin/public_html/view_accounts?type=zookeeper of the content module. The manipulation of the argument admin_name with the input <script>alert(1)</script> leads to an authenticated cross site scripting. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container
oss site scripting. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Zoo-Management-System/Zoo-Management-System%28XSS%29.md - https://vuldb.com/?id.200558
CVE ID: CVE-2022-1817 State: PUBLISHED Published: 2022-05-23T11:30:16.000Z Last Updated: 2025-04-15T14:40:12.836Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Badminton Center Management System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in Badminton Center Management System. This affects the userlist module at /bcms/admin/?page=user/list. The manipulation of the argument username with the input </td><img src="" onerror="alert(1)"><td>1 leads to an authenticated cross site scripting. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container
oss site scripting. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/ch0ing/vul/blob/main/WebRay.com.cn/Badminton%20Center%20Management%20System%28XSS%29.md - https://vuldb.com/?id.200559
CVE ID: CVE-2022-1818 State: PUBLISHED Published: 2022-06-20T10:26:00 Last Updated: 2024-08-03T00:17:00.207Z Vendors: Unknown Products: Multi-page Toolkit Problem Types: CWE-352 Description: The Multi-page Toolkit WordPress plugin through 2.6 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping as well Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/9d6c628f-cdea-481c-a2e5-101dc167718d
CVE ID: CVE-2022-1819 State: PUBLISHED Published: 2022-05-24T05:25:19.000Z Last Updated: 2025-04-15T14:40:02.863Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Student Information System Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in Student Information System 1.0. Affected is admin/?page=students of the Student Roll module. The manipulation with the input <script>alert(1)</script> leads to authenticated cross site scripting. Exploit details have been disclosed to the public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/
he public. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Student%20Information%20System/SIS_Stored_Cross_Site_Scripting%28XSS%29.md - https://vuldb.com/?id.200586
CVE ID: CVE-2022-1820 State: PUBLISHED Published: 2022-06-13T13:09:38 Last Updated: 2024-08-03T00:16:59.902Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: fahadmahmood Products: Keep Backup Daily Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Keep Backup Daily plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘t’ parameter in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully tri
ossible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/8693a8b1-15e1-4c9c-90fb-51fcaf5ff451?source=cve - https://wordpress.org/plugins/keep-backup-daily/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2727789%40keep-backup-daily&new=2727789%40keep-backup-daily&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1820
CVE ID: CVE-2022-1821 State: PUBLISHED Published: 2022-06-06T16:56:35 Last Updated: 2024-08-03T00:17:00.595Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1. It may be possible for a subgroup member to access the members list of their parent group. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353730 - http
tional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353730 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1821.json
CVE ID: CVE-2022-1822 State: PUBLISHED Published: 2022-06-13T12:25:29.000Z Last Updated: 2025-05-05T16:41:00.363Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: dylanjkotze Products: Zephyr Project Manager Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Zephyr Project Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘project’ parameter in versions up to, and including, 3.2.40 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they
ping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/22d50526-e21f-412d-9eed-b9b1f48c3358?source=cve - https://wordpress.org/plugins/zephyr-project-manager/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2727947%40zephyr-project-manager&new=2727947%40zephyr-project-manager&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE