Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-34092 State: PUBLISHED Published: 2022-07-14T21:24:23 Last Updated: 2024-08-03T08:16:16.603Z Vendors: n/a Products: n/a Problem Types: n/a Description: Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via svg2img.php. Additional Analyst Notes: - CVE Program Container: References: - https://owasp.org/www-community/attacks/xss/ - https://github.com/saladesituacao/i3geo/issues/3 - https://github.com/edmarmoretti/i3geo/issues/3 - https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt#L23 - https://softwarepublico.gov.br/social/i3geo
CVE ID: CVE-2022-34093 State: PUBLISHED Published: 2022-07-14T21:24:23 Last Updated: 2024-08-03T08:16:16.831Z Vendors: n/a Products: n/a Problem Types: n/a Description: Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via access_token.php. Additional Analyst Notes: - CVE Program Container: References: - https://owasp.org/www-community/attacks/xss/ - https://softwarepublico.gov.br/social/i3geo - https://github.com/saladesituacao/i3geo/issues/4 - https://github.com/edmarmoretti/i3geo/issues/4 - https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt#L44
CVE ID: CVE-2022-34094 State: PUBLISHED Published: 2022-07-14T21:24:24 Last Updated: 2024-08-03T08:16:16.561Z Vendors: n/a Products: n/a Problem Types: n/a Description: Portal do Software Publico Brasileiro i3geo v7.0.5 was discovered to contain a cross-site scripting (XSS) vulnerability via request_token.php. Additional Analyst Notes: - CVE Program Container: References: - https://owasp.org/www-community/attacks/xss/ - https://softwarepublico.gov.br/social/i3geo - https://github.com/saladesituacao/i3geo/issues/5 - https://github.com/edmarmoretti/i3geo/issues/5 - https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt#L65
CVE ID: CVE-2022-34100 State: PUBLISHED Published: 2022-09-13T18:11:22 Last Updated: 2024-08-03T08:16:16.644Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a low-privileged user can gain a SYSTEM level command prompt by pre-staging a file structure prior to the installation of a trusted service executable and change permissions on that file structure during a repair operation. Additional Analyst Notes: - CVE Program Container: References: - https://www.crestron.com/Security/Security_Advisories - https://www.crestron.com/release_notes/airmedia_windows_installer_release_notes_5.
on.com/Security/Security_Advisories - https://www.crestron.com/release_notes/airmedia_windows_installer_release_notes_5.5.1.84.pdf
CVE ID: CVE-2022-34101 State: PUBLISHED Published: 2022-09-13T21:47:01 Last Updated: 2024-08-03T08:16:16.512Z Vendors: n/a Products: n/a Problem Types: n/a Description: A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can place a malicious DLL in a certain path to execute code and preform a privilege escalation attack. Additional Analyst Notes: - CVE Program Container: References: - https://www.crestron.com/Security/Security_Advisories - https://www.crestron.com/release_notes/airmedia_windows_installer_release_notes_5.5.1.84.pdf
CVE ID: CVE-2022-34102 State: PUBLISHED Published: 2022-09-13T21:42:19 Last Updated: 2024-08-03T08:16:16.877Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insufficient access control vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can pause the uninstallation of an executable to gain a SYSTEM level command prompt. Additional Analyst Notes: - CVE Program Container: References: - https://www.crestron.com/Security/Security_Advisories - https://www.crestron.com/release_notes/airmedia_windows_installer_release_notes_5.5.1.84.pdf
CVE ID: CVE-2022-34108 State: PUBLISHED Published: 2022-09-12T03:57:26 Last Updated: 2024-08-03T08:16:16.566Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator v1.0.1808.0901 allows attackers to cause a Denial of Service (DoS) via a crafted image or video file. Additional Analyst Notes: - CVE Program Container: References: - http://msi.com - http://micro-star.com - https://gainsec.com/2022/08/26/cve-2022-34109-cve-2022-34110-cve-2022-34108/
CVE ID: CVE-2022-34109 State: PUBLISHED Published: 2022-09-12T03:58:54 Last Updated: 2024-08-03T08:16:16.811Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the directory \PromoPhoto\, regardless of file type or size. Additional Analyst Notes: - CVE Program Container: References: - http://msi.com - http://micro-star.com - https://gainsec.com/2022/08/26/cve-2022-34109-cve-2022-34110-cve-2022-34108/
CVE ID: CVE-2022-34110 State: PUBLISHED Published: 2022-09-12T04:00:06 Last Updated: 2024-08-03T08:16:16.781Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to download arbitrary files regardless of file type or size. Additional Analyst Notes: - CVE Program Container: References: - http://msi.com - http://micro-star.com - https://gainsec.com/2022/08/26/cve-2022-34109-cve-2022-34110-cve-2022-34108/
CVE ID: CVE-2022-34112 State: PUBLISHED Published: 2022-07-22T22:17:18 Last Updated: 2024-08-03T08:16:16.891Z Vendors: n/a Products: n/a Problem Types: n/a Description: An access control issue in the component /api/plugin/uninstall Dataease v1.11.1 allows attackers to arbitrarily uninstall the plugin, a right normally reserved for the administrator. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dataease/dataease/issues/2429
CVE ID: CVE-2022-34113 State: PUBLISHED Published: 2022-07-22T22:17:07 Last Updated: 2024-08-03T08:16:16.620Z Vendors: n/a Products: n/a Problem Types: n/a Description: An issue in the component /api/plugin/upload of Dataease v1.11.1 allows attackers to execute arbitrary code via a crafted plugin. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dataease/dataease/issues/2431
CVE ID: CVE-2022-34114 State: PUBLISHED Published: 2022-07-22T22:17:18 Last Updated: 2024-08-03T08:16:16.637Z Vendors: n/a Products: n/a Problem Types: n/a Description: Dataease v1.11.1 was discovered to contain a SQL injection vulnerability via the parameter dataSourceId. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dataease/dataease/issues/2430
CVE ID: CVE-2022-34115 State: PUBLISHED Published: 2022-07-22T22:16:54 Last Updated: 2024-08-03T08:16:16.816Z Vendors: n/a Products: n/a Problem Types: n/a Description: DataEase v1.11.1 was discovered to contain a arbitrary file write vulnerability via the parameter dataSourceId. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/dataease/dataease/issues/2428 - https://github.com/dataease/dataease/releases/tag/v1.11.2
CVE ID: CVE-2022-34120 State: PUBLISHED Published: 2022-07-27T17:12:16 Last Updated: 2024-08-03T08:16:16.859Z Vendors: n/a Products: n/a Problem Types: n/a Description: Barangay Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the module editing function at /pages/activity/activity.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/wangsj37/bug_report/blob/main/vendors/itsourcecode.com/barangay-management-system/RCE-1.md
CVE ID: CVE-2022-34121 State: PUBLISHED Published: 2022-07-27T17:59:54 Last Updated: 2024-08-03T08:16:17.167Z Vendors: n/a Products: n/a Problem Types: n/a Description: Cuppa CMS v1.0 was discovered to contain a local file inclusion (LFI) vulnerability via the component /templates/default/html/windows/right.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/hansmach1ne/MyExploits/tree/main/LFI_in_CuppaCMS_templates - https://github.com/CuppaCMS/CuppaCMS/issues/18
CVE ID: CVE-2022-34125 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-02-06T19:04:08.996Z Vendors: n/a Products: n/a Problem Types: n/a Description: front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathname in the file parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/InfotelGLPI/cmdb/releases/tag/3.0.3 - https://github.com/InfotelGLPI/cmdb/security/advisories/GHSA-wv59-3rv4-vm9f - https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
CVE ID: CVE-2022-34126 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-02-06T19:01:23.625Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/InfotelGLPI/activity/releases/tag/3.1.1 - https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/ - https://github.com/InfotelGLPI/activity/security/advisories/GHSA-jcmw-hpgh-357p
CVE ID: CVE-2022-34127 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-02-06T18:53:16.141Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/InfotelGLPI/manageentities/security/advisories/GHSA-4hpg-m8fv-xv3h - https://github.com/InfotelGLPI/manageentities/releases/tag/4.0.2 - https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/
CVE ID: CVE-2022-34128 State: PUBLISHED Published: 2023-04-16T00:00:00.000Z Last Updated: 2025-02-06T18:52:07.879Z Vendors: n/a Products: n/a Problem Types: n/a Description: The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/InfotelGLPI/positions/releases/tag/6.0.1 - https://pentest.blog/advisory-glpi-service-management-software-sql-injection-remote-code-execution-and-local-file-inclusion/ - https://github.com/InfotelGLPI/positions/security/advisories/GHSA-947x-g9g9-rcmx
CVE ID: CVE-2022-34132 State: PUBLISHED Published: 2022-06-27T23:09:55 Last Updated: 2024-08-03T08:16:17.154Z Vendors: n/a Products: n/a Problem Types: n/a Description: Benjamin BALET Jorani v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at application/controllers/Leaves.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bbalet/jorani/issues/369 - https://github.com/bbalet/jorani/commit/c5c42e29e6a9e59a3c82450bef48b67b8dd48333
CVE ID: CVE-2022-34133 State: PUBLISHED Published: 2022-06-27T23:09:50 Last Updated: 2024-08-03T08:16:17.037Z Vendors: n/a Products: n/a Problem Types: n/a Description: Benjamin BALET Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Comment parameter at application/controllers/Leaves.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bbalet/jorani/issues/369 - https://github.com/bbalet/jorani/commit/3d01cef4ee9cdd70cfe1ac4fd7f5d607dda0d0ca
CVE ID: CVE-2022-34134 State: PUBLISHED Published: 2022-06-27T23:09:50 Last Updated: 2024-08-03T08:16:17.090Z Vendors: n/a Products: n/a Problem Types: n/a Description: Benjamin BALET Jorani v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /application/controllers/Users.php. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/bbalet/jorani/issues/369 - https://github.com/bbalet/jorani/commit/299b5a3a66add4ac643e3ba78ada4d9637c8baff
CVE ID: CVE-2022-34138 State: PUBLISHED Published: 2023-02-03T00:00:00.000Z Last Updated: 2025-03-26T17:28:20.356Z Vendors: n/a Products: n/a Problem Types: n/a Description: Insecure direct object references (IDOR) in the web server of Biltema IP and Baby Camera Software v124 allows attackers to access sensitive information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://docs.biltema.com/v2/documents/file/nb/6a9ff001-a0e0-48c4-a802-83e8b5a5e213 - https://kth.diva-portal.org/smash/get/diva2:1729289/FULLTEXT01.pdf
CVE ID: CVE-2022-34140 State: PUBLISHED Published: 2022-07-27T23:44:01 Last Updated: 2024-08-03T08:16:17.110Z Vendors: n/a Products: n/a Problem Types: n/a Description: A stored cross-site scripting (XSS) vulnerability in /index.php?r=site%2Fsignup of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/liufee/cms - https://github.com/liufee/cms/issues/61 - http://packetstormsecurity.com/files/168012/Feehi-CMS-2.1.1-Cross-Site-Scripting.html - http://packetstormsecurity.com/files/168476/Feehi-CMS-2.1.1-Remote-Code-Execution.html
CVE ID: CVE-2022-34144 State: PUBLISHED Published: 2023-05-02T05:08:49.075Z Last Updated: 2024-08-03T08:16:17.003Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-617 Description: Transient DOS due to reachable assertion in Modem during OSI decode scheduling. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/may-2023-bulletin
CVE ID: CVE-2022-34145 State: PUBLISHED Published: 2023-02-09T06:58:47.544Z Last Updated: 2024-08-03T08:16:17.014Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-126 Description: Transient DOS due to buffer over-read in WLAN Host while parsing frame information. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/february-2023-bulletin
CVE ID: CVE-2022-34146 State: PUBLISHED Published: 2023-02-09T06:58:48.744Z Last Updated: 2024-08-03T08:16:17.149Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Qualcomm, Inc. Products: Snapdragon Problem Types: CWE-20 Description: Transient DOS due to improper input validation in WLAN Host while parsing frame during defragmentation. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://www.qualcomm.com/company/product-security/bulletins/february-2023-bulletin
CVE ID: CVE-2022-34147 State: PUBLISHED Published: 2023-05-10T13:16:45.539Z Last Updated: 2025-01-27T18:09:40.337Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, and Intel(R) NUC Compute Element Problem Types: escalation of privilege, CWE-20 Description: Improper input validation in BIOS firmware for some Intel(R) NUC 9 Extreme Laptop Kits, Intel(R) NUC Performance Kits, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC
C Performance Kits, Intel(R) NUC Performance Mini PC, Intel(R) NUC 8 Compute Element, Intel(R) NUC Pro Kit, Intel(R) NUC Pro Board, and Intel(R) NUC Compute Element may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00777.html
CVE ID: CVE-2022-34148 State: PUBLISHED Published: 2023-03-15T14:59:09.378Z Last Updated: 2025-02-19T21:40:49.609Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: JetBackup Products: JetBackup – WP Backup, Migrate & Restore Problem Types: CWE-79 Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in JetBackup JetBackup – WP Backup, Migrate & Restore plugin <= 1.6.9.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/backup/wordpress-backup-guard-plugin-1-6-8-8-auth-stored-cross-site-scripting-xss-vulnerab
ck.com/database/vulnerability/backup/wordpress-backup-guard-plugin-1-6-8-8-auth-stored-cross-site-scripting-xss-vulnerability?_s_id=cve
CVE ID: CVE-2022-34149 State: PUBLISHED Published: 2022-08-22T14:50:02.430Z Last Updated: 2025-02-20T20:12:48.714Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: miniOrange Products: WP OAuth Server (WordPress plugin) Problem Types: CWE-264 Description: Authentication Bypass vulnerability in miniOrange WP OAuth Server plugin <= 3.0.4 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/miniorange-oauth-20-server/wordpress-wp-oauth-server-plugin-3-0-4-authentication-bypass-vulnerability?_s_id=cve - https://lana.codes/lanavdb/6d794d65-d44b-4099-94c5-3dd2995b218c
in-3-0-4-authentication-bypass-vulnerability?_s_id=cve - https://lana.codes/lanavdb/6d794d65-d44b-4099-94c5-3dd2995b218c?_s_id=cve
CVE ID: CVE-2022-34150 State: PUBLISHED Published: 2022-07-20T15:24:09.830Z Last Updated: 2025-04-16T16:15:14.689Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N) Vendors: MiCODUS Products: MV720 Problem Types: CWE-639 Description: The main MiCODUS MV720 GPS tracker web server has an authenticated insecure direct object reference vulnerability on endpoint and parameter device IDs, which accept arbitrary device IDs without further verification. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-200-01
CVE ID: CVE-2022-34151 State: PUBLISHED Published: 2022-07-04T01:51:00 Last Updated: 2024-08-03T08:16:17.136Z Vendors: OMRON Corporation Products: Machine automation controller NJ series, Machine automation controller NX series, Automation software 'Sysmac Studio', and Programmable Terminal (PT) NA series Problem Types: Use of Hard-coded Credentials Description: Use of hard-coded credentials vulnerability exists in Machine automation controller NJ series all models V 1.48 and earlier, Machine automation controller NX7 series all models V1.28 and earlier, Machine automation controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, an
controller NX1 series all models V1.48 and earlier, Automation software 'Sysmac Studio' all models V1.49 and earlier, and Programmable Terminal (PT) NA series NA5-15W/NA5-12W/NA5-9W/NA5-7W models Runtime V1.15 and earlier, which may allow a remote attacker who successfully obtained the user credentials by analyzing the affected product to access the controller. Additional Analyst Notes: - CVE Program Container: References: - https://www.ia.omron.com/product/vulnerability/OMSR-2022-001_en.pdf - https://jvn.jp/en/vu/JVNVU97050784/index.html
CVE ID: CVE-2022-34152 State: PUBLISHED Published: 2022-11-11T15:48:51.318Z Last Updated: 2025-02-05T20:24:48.008Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC Boards, Intel(R) NUC Kits Problem Types: escalation of privilege Description: Improper input validation in BIOS firmware for some Intel(R) NUC Boards, Intel(R) NUC Kits before version TY0070 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE ID: CVE-2022-34153 State: PUBLISHED Published: 2023-02-16T20:00:06.564Z Last Updated: 2025-01-27T18:20:04.439Z Severity: HIGH (CVSS 8.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Battery Life Diagnostic Tool software Problem Types: escalation of privilege Description: Improper initialization in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00726.html
CVE ID: CVE-2022-34154 State: PUBLISHED Published: 2022-08-01T13:55:12.387Z Last Updated: 2025-02-20T20:14:18.910Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: ideasToCode Products: Enable SVG, WebP & ICO Upload (WordPress plugin) Problem Types: Arbitrary File Upload Description: Authenticated (author or higher user role) Arbitrary File Upload vulnerability in ideasToCode Enable SVG, WebP & ICO Upload plugin <= 1.0.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/enable-svg-webp-ico-upload/#developers - https://patchstack.com/database/vulnerability/enable-svg-webp-ico-upl
g/plugins/enable-svg-webp-ico-upload/#developers - https://patchstack.com/database/vulnerability/enable-svg-webp-ico-upload/wordpress-enable-svg-webp-ico-upload-plugin-1-0-1-authenticated-arbitrary-file-upload-vulnerability
CVE ID: CVE-2022-34155 State: PUBLISHED Published: 2023-07-18T13:41:59.369Z Last Updated: 2024-09-25T16:32:41.889Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: miniOrange Products: OAuth Single Sign On – SSO (OAuth Client) Problem Types: CWE-287 Description: Improper Authentication vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client) plugin allows Authentication Bypass.This issue affects OAuth Single Sign On – SSO (OAuth Client): from n/a through 6.23.3. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/miniorange-login-with-eve-online-google-facebook/word
hment: References: - https://patchstack.com/database/vulnerability/miniorange-login-with-eve-online-google-facebook/wordpress-oauth-single-sign-on-sso-oauth-client-plugin-6-23-3-broken-authentication-vulnerability?_s_id=cve - https://lana.codes/lanavdb/071fa6eb-2e54-43a1-b37f-1e562988b7d4?_s_id=cve
CVE ID: CVE-2022-34156 State: PUBLISHED Published: 2022-08-16T07:01:18 Last Updated: 2024-08-03T08:16:17.132Z Vendors: HJ Holdings, Inc. Products: 'Hulu / フールー' App for iOS Problem Types: Improper Certificate Validation Description: 'Hulu / フールー' App for iOS versions prior to 3.0.81 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack. Additional Analyst Notes: - CVE Program Container: References: - https://jvn.jp/en/jp/JVN81563390/index.html