Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
x/kernel/git/torvalds/linux.git/commit/?id=0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3e0588c291d6ce225f2b891753ca41d45ba42469 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=81b1d548d00bcd028303c4f3150fa753b9b8aa71 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b2f37aead1b82a770c48b5d583f35ec22aabb61e - https://www.debian.org/security/2022/dsa-5127 - https://www.debian.org/security/2022/dsa-5173
CVE ID: CVE-2022-1196 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:27:54.778Z Vendors: Mozilla Products: Thunderbird, Firefox ESR Problem Types: Use-after-free after VR Process destruction Description: After a VR Process is destroyed, a reference to it may have been retained and used, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8 and Firefox ESR < 91.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-14/ - https://www.mozilla.org/security/advisories/mfsa2022-15/ - https://bugzilla.mozilla.org/show_bug
visories/mfsa2022-14/ - https://www.mozilla.org/security/advisories/mfsa2022-15/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1750679
CVE ID: CVE-2022-1197 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:25:49.637Z Vendors: Mozilla Products: Thunderbird Problem Types: OpenPGP revocation information was ignored Description: When importing a revoked key that specified key compromise as the revocation reason, Thunderbird did not update the existing copy of the key that was not yet revoked, and the existing key was kept as non-revoked. Revocation statements that used another revocation reason, or that didn't specify a revocation reason, were unaffected. This vulnerability affects Thunderbird < 91.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https:
cts Thunderbird < 91.8. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-15/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1754985
CVE ID: CVE-2022-1198 State: PUBLISHED Published: 2022-08-29T14:03:07 Last Updated: 2024-08-02T23:55:24.542Z Vendors: n/a Products: kernel Problem Types: CWE-416 Description: A use-after-free vulnerabilitity was discovered in drivers/net/hamradio/6pack.c of linux that allows an attacker to crash linux kernel by simulating ax25 device using 6pack driver from user space. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2070689 - https://www.openwall.com/lists/oss-security/2022/04/02/3 - https://github.com/torvalds/linux/commit/efe4186e6a1b54bf38b9e05450d43b0da1fd7739 - https://access.redhat.com/security/cve/CVE-2022-1198
CVE ID: CVE-2022-1199 State: PUBLISHED Published: 2022-08-29T00:00:00.000Z Last Updated: 2025-04-23T17:47:49.181Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A flaw was found in the Linux kernel. This flaw allows an attacker to crash the Linux kernel by simulating amateur radio from the user space, resulting in a null-ptr-deref vulnerability and a use-after-free vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2070694 - https://www.openwall.com/lists/oss-security/2022/04/02/5 - https://github.com/torvalds/linux/commit/4e0f718daf97d47cf7dec122da1be970f145c809 - https://git
-security/2022/04/02/5 - https://github.com/torvalds/linux/commit/4e0f718daf97d47cf7dec122da1be970f145c809 - https://github.com/torvalds/linux/commit/71171ac8eb34ce7fe6b3267dce27c313ab3cb3ac - https://github.com/torvalds/linux/commit/7ec02f5ac8a5be5a3f20611731243dc5e1d9ba10 - https://access.redhat.com/security/cve/CVE-2022-1199 - https://security.netapp.com/advisory/ntap-20221228-0006/
CVE ID: CVE-2022-1201 State: PUBLISHED Published: 2022-04-02T07:45:34 Last Updated: 2024-08-02T23:55:24.340Z Severity: HIGH (CVSS 7.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-476 Description: NULL Pointer Dereference in mrb_vm_exec with super in GitHub repository mruby/mruby prior to 3.2. This vulnerability is capable of making the mruby interpreter crash, thus affecting the availability of the system. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/6f930add-c9d8-4870-ae56-d4bd8354703b - https://github.com/mruby/mruby/commit/00acae117da1b45b318dc36531a7b0021b8097ae
CVE ID: CVE-2022-1202 State: PUBLISHED Published: 2022-06-13T12:41:41 Last Updated: 2024-08-02T23:55:24.229Z Vendors: Unknown Products: WP-CRM – Customer Relations Management for WordPress Problem Types: CWE-1236 Description: The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/53c8190c-baef-4807-970b-f01ab440576a
CVE ID: CVE-2022-1203 State: PUBLISHED Published: 2022-05-30T00:00:00 Last Updated: 2024-08-02T23:55:24.348Z Vendors: Unknown Products: Content Mask Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Content Mask WordPress plugin before 1.8.4.1 does not have authorisation and CSRF checks in various AJAX actions, as well as does not validate the option to be updated to ensure it belongs to the plugin. As a result, any authenticated user, such as subscriber could modify arbitrary blog options Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3c9969e5-ca8e-4e5d-a482-c6b5c4257820
CVE ID: CVE-2022-1204 State: PUBLISHED Published: 2022-08-29T14:03:07 Last Updated: 2024-08-02T23:55:24.372Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A use-after-free flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2071051 - https://www.openwall.com/lists/oss-security/2022/04/02/2 - https://security-tracker.debian.org/tracker/CVE-2022-1204 - https://access.redhat.com/security/cve/CVE-2022-1204
CVE ID: CVE-2022-1205 State: PUBLISHED Published: 2022-08-31T15:32:59 Last Updated: 2024-08-02T23:55:24.374Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A NULL pointer dereference flaw was found in the Linux kernel’s Amateur Radio AX.25 protocol functionality in the way a user connects with the protocol. This flaw allows a local user to crash the system. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2071047 - https://www.openwall.com/lists/oss-security/2022/04/02/4 - https://github.com/torvalds/linux/commit/fc6d01ff9ef03b66d4a3a23b46fc3c3d8cf92009 - https://github.com/torvalds/linux/commit/82e31755e55fbcea6a
alds/linux/commit/fc6d01ff9ef03b66d4a3a23b46fc3c3d8cf92009 - https://github.com/torvalds/linux/commit/82e31755e55fbcea6a9dfaae5fe4860ade17cbc0 - https://access.redhat.com/security/cve/CVE-2022-1205
CVE ID: CVE-2022-1206 State: PUBLISHED Published: 2024-08-20T03:21:11.012Z Last Updated: 2024-09-13T12:48:11.308Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: adegans Products: AdRotate Banner Manager – The only ad manager you&#039;ll need Problem Types: CWE-434 Description: The AdRotate Banner Manager – The only ad manager you'll need plugin for WordPress is vulnerable to arbitrary file uploads due to missing file extension sanitization in the adrotate_insert_media() function in all versions up to, and including, 5.13.2. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files with double exte
sible for authenticated attackers, with administrator-level access and above, to upload arbitrary files with double extensions on the affected site's server which may make remote code execution possible. This is only exploitable on select instances where the configuration will execute the first extension present. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/9f92219a-e07e-422d-a9f2-dbe4fbcd5f55?source=cve - https://plugins.trac.wordpress.org/browser/adrotate/trunk/adrotate-admin-manage.php#L418
CVE ID: CVE-2022-1207 State: PUBLISHED Published: 2022-04-01T19:10:10 Last Updated: 2024-08-02T23:55:24.244Z Severity: MEDIUM (CVSS 6.6 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-125 Description: Out-of-bounds read in GitHub repository radareorg/radare2 prior to 5.6.8. This vulnerability allows attackers to read sensitive information from outside the allocated buffer boundary. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/7b979e76-ae54-4132-b455-0833e45195eb - https://github.com/radareorg/radare2/commit/605785b65dd356d46d4487faa41dbf90943b8bc1
CVE ID: CVE-2022-1208 State: PUBLISHED Published: 2022-06-13T12:43:38 Last Updated: 2024-08-02T23:55:24.437Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) Vendors: ultimatemember Products: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Ultimate Member plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Biography field featured on individual user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web
user profile pages due to insufficient input sanitization and output escaping that allows users to encode malicious web scripts with HTML encoding that is reflected back on the page. This affects versions up to, and including, 2.3.2. Please note this issue was only partially fixed in version 2.3.2. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/93cf6dce-892e-4106-bb37-b7952e5ea5a1?source=cve - https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Stored%20Cross-Site%20Scripting.md - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2735896%40ultim
s-Site%20Scripting.md - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2735896%40ultimate-member&new=2735896%40ultimate-member&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1208
CVE ID: CVE-2022-1209 State: PUBLISHED Published: 2022-05-10T19:34:42 Last Updated: 2024-08-02T23:55:24.204Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: ultimatemember Products: Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin Problem Types: CWE-601 URL Redirection to Untrusted Site ('Open Redirect') Description: The Ultimate Member plugin for WordPress is vulnerable to arbitrary redirects due to insufficient validation on supplied URLs in the social fields of the Profile Page, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1. Addit
e, which makes it possible for attackers to redirect unsuspecting victims in versions up to, and including, 2.3.1. Additional Analyst Notes: - CVE Program Container: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/d638120b-5396-408b-8273-d003ff9dd01d?source=cve - https://github.com/H4de5-7/vulnerabilities/blob/main/Ultimate%20Member%20%3C%3D%202.3.1%20-%20Open%20Redirect.md - https://github.com/ultimatemember/ultimatemember/issues/989 - https://github.com/ultimatemember/ultimatemember/pull/990 - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1209
CVE ID: CVE-2022-1210 State: PUBLISHED Published: 2022-04-03T00:00:00.000Z Last Updated: 2025-04-15T14:42:29.186Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L) Vendors: unspecified Products: LibTIFF Problem Types: CWE-400 Description: A vulnerability classified as problematic was found in LibTIFF 4.3.0. Affected by this vulnerability is the TIFF File Handler of tiff2ps. Opening a malicious file leads to a denial of service. The attack can be launched remotely but requires user interaction. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/libtiff
ed. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/libtiff/libtiff/-/issues/402 - https://gitlab.com/libtiff/libtiff/uploads/c3da94e53cf1e1e8e6d4d3780dc8c42f/example.tiff - https://vuldb.com/?id.196363 - https://security.netapp.com/advisory/ntap-20220513-0005/ - https://security.gentoo.org/glsa/202210-10
CVE ID: CVE-2022-1211 State: PUBLISHED Published: 2022-04-03T12:10:11.000Z Last Updated: 2025-04-15T14:42:19.773Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: tildearrow Products: Furnace Problem Types: CWE-121 Description: A vulnerability classified as critical has been found in tildearrow Furnace dev73. This affects the FUR to VGM converter in console mode which causes stack-based overflows and crashes. It is possible to initiate the attack remotely but it requires user-interaction. A POC has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tildearr
d. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/tildearrow/furnace/issues/325 - https://drive.google.com/file/d/1h111beVcWG8F99jRffO7_HKYEhm7Qgvb/view?usp=sharing - https://vuldb.com/?id.196371
CVE ID: CVE-2022-1212 State: PUBLISHED Published: 2022-04-05T03:45:19 Last Updated: 2024-08-02T23:55:24.452Z Severity: CRITICAL (CVSS 9.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-416 Description: Use-After-Free in str_escape in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/9fcc06d0-08e4-49c8-afda-2cae40946abe - https://github.com/mruby/mruby/commit/3cf291f72224715942beaf8553e42ba8891ab3c6
CVE ID: CVE-2022-1213 State: PUBLISHED Published: 2022-04-05T03:45:13 Last Updated: 2024-08-02T23:55:24.329Z Severity: HIGH (CVSS 7.7 CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:L) Vendors: livehelperchat Products: livehelperchat/livehelperchat Problem Types: CWE-918 Description: SSRF filter bypass port 80, 433 in GitHub repository livehelperchat/livehelperchat prior to 3.67v. An attacker could make the application perform arbitrary requests, bypass CVE-2022-1191 Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/084387f6-5b9c-4017-baa2-5fcf65b051e1 - https://github.com/livehelperchat/livehelperchat/commit/abc9599ee7aded466ca216741dcaea533c908111
CVE ID: CVE-2022-1214 State: REJECTED Published: 2022-05-03T06:15:14 Last Updated: 2022-05-04T09:10:08 Description: No description available.
CVE ID: CVE-2022-1215 State: PUBLISHED Published: 2022-05-31T00:00:00 Last Updated: 2024-08-02T23:55:24.456Z Vendors: n/a Products: libinput Problem Types: CWE-134 Description: A format string vulnerability was found in libinput Additional Analyst Notes: - CVE Program Container: References: - https://seclists.org/oss-sec/2022/q2/47 - https://security.gentoo.org/glsa/202310-14
CVE ID: CVE-2022-1216 State: PUBLISHED Published: 2022-05-16T14:30:40 Last Updated: 2024-08-02T23:55:24.531Z Vendors: Unknown Products: Advanced Image Sitemap Problem Types: CWE-79 Description: The Advanced Image Sitemap WordPress plugin through 1.2 does not sanitise and escape the PHP_SELF PHP variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/31a5b138-3d9e-4cd6-b85c-d20406ab51bd
CVE ID: CVE-2022-1217 State: PUBLISHED Published: 2022-05-16T14:30:42 Last Updated: 2024-08-02T23:55:24.580Z Vendors: Unknown Products: Custom TinyMCE Shortcode Button Problem Types: CWE-79 Description: The Custom TinyMCE Shortcode Button WordPress plugin through 1.1 does not sanitise and escape the PHP_SELF variable before outputting it back in an attribute in an admin page, leading to Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/15875f52-7a49-44c7-8a36-b49ddf37c20c
CVE ID: CVE-2022-1218 State: PUBLISHED Published: 2022-05-23T07:15:28 Last Updated: 2024-08-02T23:55:24.442Z Vendors: Unknown Products: Domain Replace Problem Types: CWE-79 Description: The Domain Replace WordPress plugin through 1.3.8 does not sanitise and escape a parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/fc1e8681-9229-4645-bc22-4897522d0c65
CVE ID: CVE-2022-1219 State: PUBLISHED Published: 2022-04-08T08:45:18 Last Updated: 2024-08-02T23:55:24.296Z Severity: HIGH (CVSS 7.2 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-89 Description: SQL injection in RecyclebinController.php in GitHub repository pimcore/pimcore prior to 10.3.5. This vulnerability is capable of steal the data Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f700bd18-1fd3-4a05-867f-07176aebc7f6 - https://github.com/pimcore/pimcore/commit/a697830359df06246acca502ee2455614de68017
CVE ID: CVE-2022-1220 State: PUBLISHED Published: 2022-07-11T12:55:40 Last Updated: 2024-08-02T23:55:24.429Z Vendors: Unknown Products: FoxyShop Problem Types: CWE-79 Description: The FoxyShop WordPress plugin before 4.8.2 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eb58f43e-4304-40e7-9e0f-d0d6fe049724
CVE ID: CVE-2022-1221 State: PUBLISHED Published: 2022-05-23T07:15:29 Last Updated: 2024-08-02T23:55:24.450Z Vendors: Unknown Products: Gwyn's Imagemap Selector Problem Types: CWE-79 Description: The Gwyn's Imagemap Selector WordPress plugin through 0.3.3 does not sanitise and escape some parameters before outputting them back in attributes, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/641be9f6-2f74-4386-b16e-4b9488f0d2a9
CVE ID: CVE-2022-1222 State: PUBLISHED Published: 2022-04-04T00:00:00 Last Updated: 2024-08-02T23:55:24.312Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: gpac Products: gpac/gpac Problem Types: CWE-835 Description: Inf loop in GitHub repository gpac/gpac prior to 2.1.0-DEV. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f8cb85b8-7ff3-47f1-a9a6-7080eb371a3d - https://github.com/gpac/gpac/commit/7f060bbb72966cae80d6fee338d0b07fa3fc06e1 - https://www.debian.org/security/2023/dsa-5411
CVE ID: CVE-2022-1223 State: PUBLISHED Published: 2022-04-04T10:45:20 Last Updated: 2024-08-02T23:55:24.453Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: phpipam Products: phpipam/phpipam Problem Types: CWE-863 Description: Incorrect Authorization in GitHub repository phpipam/phpipam prior to 1.4.6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpipam/phpipam/commit/f6a49fd9f93b7d7e0a4fbf1d35338502eed35953 - https://huntr.dev/bounties/baec4c23-2466-4b13-b3c0-eaf1d000d4ab
CVE ID: CVE-2022-1224 State: PUBLISHED Published: 2022-04-04T10:45:15 Last Updated: 2024-08-02T23:55:24.593Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: phpipam Products: phpipam/phpipam Problem Types: CWE-285 Description: Improper Authorization in GitHub repository phpipam/phpipam prior to 1.4.6. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/cd9e1508-5682-427e-a921-14b4f520b85a - https://github.com/phpipam/phpipam/commit/f6a49fd9f93b7d7e0a4fbf1d35338502eed35953
CVE ID: CVE-2022-1225 State: PUBLISHED Published: 2022-04-04T10:50:11 Last Updated: 2024-08-02T23:55:24.394Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: phpipam Products: phpipam/phpipam Problem Types: CWE-266 Description: Incorrect Privilege Assignment in GitHub repository phpipam/phpipam prior to 1.4.6. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/phpipam/phpipam/commit/f6a49fd9f93b7d7e0a4fbf1d35338502eed35953 - https://huntr.dev/bounties/49b44cfa-d142-4d79-b529-7805507169d2
CVE ID: CVE-2022-1226 State: PUBLISHED Published: 2024-11-15T10:57:20.597Z Last Updated: 2024-11-15T20:59:32.661Z Severity: LOW (CVSS 3.5 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) Vendors: phpipam Products: phpipam/phpipam Problem Types: CWE-79 Description: A Cross-Site Scripting (XSS) vulnerability in phpipam/phpipam versions prior to 1.4.7 allows attackers to execute arbitrary JavaScript code in the browser of a victim. This vulnerability affects the import Data set feature via a spreadsheet file upload. The affected endpoints include import-vlan-preview.php, import-subnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-previe
ubnets-preview.php, import-vrf-preview.php, import-ipaddr-preview.php, import-devtype-preview.php, import-devices-preview.php, and import-l2dom-preview.php. The vulnerability can be exploited by uploading a specially crafted spreadsheet file containing malicious JavaScript payloads, which are then executed in the context of the victim's browser. This can lead to defacement of websites, execution of malicious JavaScript code, stealing of user cookies, and unauthorized access to user accounts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://huntr.com/bounties/3fdcf653-fe26-4592-94a1-98ce664618ec - https://github.com/phpipam/phpipam/commit/50e36b9e4fff5eaa51dc6e42bc6847
bounties/3fdcf653-fe26-4592-94a1-98ce664618ec - https://github.com/phpipam/phpipam/commit/50e36b9e4fff5eaa51dc6e42bc684748da378002
CVE ID: CVE-2022-1227 State: PUBLISHED Published: 2022-04-29T15:45:00 Last Updated: 2024-08-02T23:55:24.597Z Vendors: n/a Products: psgo Problem Types: CWE-281 Description: A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2070368 - https://github.com/containers/pod
Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2070368 - https://github.com/containers/podman/issues/10941 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLUJZV3HBP56ADXU6QH2V7RNYUPMVBXQ/ - https://security.netapp.com/advisory/ntap-20240628-0001/