Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1930 State: PUBLISHED Published: 2022-08-22T18:15:56 Last Updated: 2024-08-03T00:17:01.026Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: eth-account Products: eth-account Problem Types: CWE-1333 Description: An exponential ReDoS (Regular Expression Denial of Service) can be triggered in the eth-account PyPI package, when an attacker is able to supply arbitrary input to the encode_structured_data method Additional Analyst Notes: - CVE Program Container: References: - https://research.jfrog.com/vulnerabilities/eth-account-redos-xray-248681/
CVE ID: CVE-2022-1931 State: PUBLISHED Published: 2022-05-31T01:25:11 Last Updated: 2024-08-03T00:17:00.934Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: polonel Products: polonel/trudesk Problem Types: CWE-821 Description: Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/50c4cb63-65db-41c5-a16d-0560d7131fde - https://github.com/polonel/trudesk/commit/314540864dbf2c0eaa99aa42c3d317de9501eb67
CVE ID: CVE-2022-1932 State: PUBLISHED Published: 2022-08-22T14:58:08 Last Updated: 2024-08-03T00:17:00.977Z Vendors: Unknown Products: Rezgo Online Booking Problem Types: CWE-79 Description: The Rezgo Online Booking WordPress plugin before 4.1.8 does not sanitise and escape some parameters before outputting them back in a page, leading to a Reflected Cross-Site Scripting, which can be exploited either via a LFI in an AJAX action, or direct call to the affected file Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/005c2300-f6bd-416e-97a6-d42284bbb093
CVE ID: CVE-2022-1933 State: PUBLISHED Published: 2022-07-17T10:35:39 Last Updated: 2024-08-03T00:17:01.043Z Vendors: Unknown Products: CDI – Collect and Deliver Interface for Woocommerce Problem Types: CWE-79 Description: The CDI WordPress plugin before 5.1.9 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/6cedb27f-6140-4cba-836f-63de98e521bf
CVE ID: CVE-2022-1934 State: PUBLISHED Published: 2022-05-31T02:20:12 Last Updated: 2024-08-03T00:24:42.561Z Severity: MEDIUM (CVSS 5.1 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L) Vendors: mruby Products: mruby/mruby Problem Types: CWE-416 Description: Use After Free in GitHub repository mruby/mruby prior to 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/99e6df06-b9f7-4c53-a722-6bb89fbfb51f - https://github.com/mruby/mruby/commit/aa7f98dedb68d735a1665d3a289036c88b0c47ce
CVE ID: CVE-2022-1935 State: PUBLISHED Published: 2022-06-06T16:50:27 Last Updated: 2024-08-03T00:24:42.627Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Incorrect authorization in GitLab Description: Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Trigger Token to misuse it from any location even when IP address restrictions were configured Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/git
ess restrictions were configured Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/363650 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1935.json
CVE ID: CVE-2022-1936 State: PUBLISHED Published: 2022-06-06T16:54:22 Last Updated: 2024-08-03T00:24:42.557Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Incorrect authorization in GitLab Description: Incorrect authorization in GitLab EE affecting all versions from 12.0 before 14.9.5, all versions starting from 14.10 before 14.10.4, all versions starting from 15.0 before 15.0.1 allowed an attacker already in possession of a valid Project Deploy Token to misuse it from any location even when IP address restrictions were configured Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitl
ss restrictions were configured Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/363638 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1936.json
CVE ID: CVE-2022-1937 State: PUBLISHED Published: 2022-07-11T12:56:35 Last Updated: 2024-08-03T00:24:42.589Z Vendors: Unknown Products: Awin Data Feed Problem Types: CWE-79 Description: The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a parameter before outputting it back via an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/eb40ea5d-a463-4947-9a40-d55911ff50e9
CVE ID: CVE-2022-1938 State: PUBLISHED Published: 2022-07-11T12:56:40 Last Updated: 2024-08-03T00:24:42.640Z Vendors: Unknown Products: Awin Data Feed Problem Types: CWE-79 Description: The Awin Data Feed WordPress plugin before 1.8 does not sanitise and escape a header when processing request to generate analytics data, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against a logged in admin viewing the plugin's settings Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/70aed824-c53e-4672-84c9-039dc34ed5fa
CVE ID: CVE-2022-1939 State: PUBLISHED Published: 2022-06-20T10:26:20 Last Updated: 2024-08-03T00:24:42.623Z Vendors: Unknown Products: Allow svg files Problem Types: CWE-434 Description: The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4d7b62e1-558b-4504-a6e2-78246a8b554f
CVE ID: CVE-2022-1940 State: PUBLISHED Published: 2022-06-06T16:52:22 Last Updated: 2024-08-03T00:24:42.587Z Severity: HIGH (CVSS 7.7 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: A Stored Cross-Site Scripting vulnerability in Jira integration in GitLab EE affecting all versions from 13.11 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf via specially crafted Jira Issues Additional Analyst Notes: - CVE Program Container: References: - h
n a victim's behalf via specially crafted Jira Issues Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/359142 - https://hackerone.com/reports/1533976 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1940.json
CVE ID: CVE-2022-1941 State: PUBLISHED Published: 2022-09-22T00:00:00 Last Updated: 2024-08-03T00:24:42.594Z Vendors: Google LLC Products: protobuf-cpp, protobuf-python Problem Types: CWE-1286 Description: A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recomme
nts creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://cloud.google.com/support/bulletins#GCP-2022-019 - https://github.com/protocolbuffers/protobuf/security/advisories/GHSA-8gq9-2x98-w8hf - http://www.openwall.com/lists/oss-security/2022/09/27/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBAUKJQL6O4T
/09/27/1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CBAUKJQL6O4TIWYBENORSY5P43TVB4M3/ - https://lists.debian.org/debian-lts-announce/2023/04/msg00019.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MPCGUT3T5L6C3IDWUPSUO22QDCGQKTOP/ - https://security.netapp.com/advisory/ntap-20240705-0001/
CVE ID: CVE-2022-1942 State: PUBLISHED Published: 2022-05-31T00:00:00.000Z Last Updated: 2025-11-03T20:34:40.231Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/67ca4d3b-9175-43c1-925c-72a7091bc071 - https://github.com/vim/vim/commit/71223e2db87c2bf3b09aecb46266b56cda26191d - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TYNK6SDCMOLQJOI3B4AOE66P2G2IH4ZM/ - https://security.gentoo.org/glsa/2022
age-announce%40lists.fedoraproject.org/message/TYNK6SDCMOLQJOI3B4AOE66P2G2IH4ZM/ - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://lists.debian.org/debian-lts-announce/2022/11/msg00032.html - https://security.gentoo.org/glsa/202305-16
CVE ID: CVE-2022-1943 State: PUBLISHED Published: 2022-06-01T00:00:00 Last Updated: 2024-08-03T00:24:43.781Z Vendors: n/a Products: Kernel Problem Types: CWE-787 Description: A flaw out of bounds memory write in the Linux kernel UDF file system functionality was found in the way user triggers some file operation which triggers udf_write_fi(). A local user could use this flaw to crash the system or potentially Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c1ad35dd0548ce947d97aaf92f7f2f9a202951cf
CVE ID: CVE-2022-1944 State: PUBLISHED Published: 2022-06-06T16:58:35 Last Updated: 2024-08-03T00:24:42.991Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper authorization in GitLab Description: When the feature is configured, improper authorization in the Interactive Web Terminal in GitLab CE/EE affecting all versions from 11.3 prior to 14.9.5, 14.10 prior to 14.10.4, and 15.0 prior to 15.0.1 allows users with the Developer role to open terminals on other Developers' running jobs Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/349750 - https://gitla
alyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/349750 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1944.json
CVE ID: CVE-2022-1945 State: PUBLISHED Published: 2022-06-20T10:26:21 Last Updated: 2024-08-03T00:24:42.604Z Vendors: Unknown Products: Coming Soon & Maintenance Mode by Colorlib Problem Types: CWE-79 Description: The Coming Soon & Maintenance Mode by Colorlib WordPress plugin before 1.0.99 does not sanitize and escape some settings, allowing high privilege users such as admin to perform Stored Cross-Site Scripting when unfiltered_html is disallowed (for example in multisite setup) Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4ad297e5-c92d-403c-abf4-9decf7e8378b
CVE ID: CVE-2022-1946 State: PUBLISHED Published: 2022-07-04T13:05:50 Last Updated: 2024-08-03T00:24:43.005Z Vendors: Unknown Products: Gallery – Image and Video Gallery with Thumbnails Problem Types: CWE-79 Description: The Gallery WordPress plugin before 2.0.0 does not sanitise and escape a parameter before outputting it back in the response of an AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0903920c-be2e-4515-901f-87253eb30940
CVE ID: CVE-2022-1947 State: PUBLISHED Published: 2022-05-31T22:20:11 Last Updated: 2024-08-03T00:24:42.637Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: polonel Products: polonel/trudesk Problem Types: CWE-480 Description: Use of Incorrect Operator in GitHub repository polonel/trudesk prior to 1.2.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/cb4d0ab3-51ba-4a42-9e38-ac0e544266f1 - https://github.com/polonel/trudesk/commit/a9e38f25c2af2722dee4fdafb2fb70d30d5106c5
CVE ID: CVE-2022-1948 State: PUBLISHED Published: 2022-07-28T14:46:01 Last Updated: 2024-08-03T00:24:42.604Z Severity: HIGH (CVSS 8.7 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Improper neutralization of input during web page generation ('cross-site scripting') in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 15.0 before 15.0.1. Missing validation of input used in quick actions allowed an attacker to exploit XSS by injecting HTML in contact details. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/security/gitlab/-/issues/673 - https://hackerone.c
- CVE Program Container: References: - https://gitlab.com/gitlab-org/security/gitlab/-/issues/673 - https://hackerone.com/reports/1578400 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1948.json
CVE ID: CVE-2022-1949 State: PUBLISHED Published: 2022-06-01T15:08:52 Last Updated: 2024-08-03T00:24:42.623Z Vendors: n/a Products: 389-ds-base Problem Types: Improper Access Control Description: An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data. Additional Analyst Notes: - CVE Program Container: References:
otentially userPassword hashes and other sensitive data. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2091781
CVE ID: CVE-2022-1950 State: PUBLISHED Published: 2022-08-01T12:49:04 Last Updated: 2024-08-03T00:24:43.422Z Vendors: Unknown Products: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress Problem Types: CWE-89 Description: The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/4352283f-dd43-4827-b417-0c55d0f4637d
CVE ID: CVE-2022-1951 State: PUBLISHED Published: 2022-07-11T12:56:45 Last Updated: 2024-08-03T00:24:43.611Z Vendors: Unknown Products: core plugin for kitestudio themes Problem Types: CWE-79 Description: The core plugin for kitestudio WordPress plugin before 2.3.1 does not sanitise and escape some parameters before outputting them back in a response of an AJAX action, available to both unauthenticated and authenticated users when a premium theme from the vendor is active, leading to a Reflected Cross-Site Scripting. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/f56f7244-e8ec-4a87-9419-643bc13b45a0
CVE ID: CVE-2022-1952 State: PUBLISHED Published: 2022-07-11T12:56:52 Last Updated: 2024-08-03T00:24:43.675Z Vendors: Unknown Products: Free Booking Plugin for Hotels, Restaurant and Car Rental – eaSYNC Problem Types: CWE-434 Description: The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps. Additional Analyst Notes: - CVE Program Container: References: - https://
d but is not used during the validation steps. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ecf61d17-8b07-4cb6-93a8-64c2c4fbbe04
CVE ID: CVE-2022-1953 State: PUBLISHED Published: 2022-06-27T08:58:44 Last Updated: 2024-08-03T00:24:42.631Z Vendors: Unknown Products: Product Configurator for WooCommerce Problem Types: CWE-22 Description: The Product Configurator for WooCommerce WordPress plugin before 1.2.32 suffers from an arbitrary file deletion vulnerability via an AJAX action, accessible to unauthenticated users, which accepts user input that is being used in a path and passed to unlink() without validation first Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/b66d6682-edbc-435f-a73a-dced32a32770
CVE ID: CVE-2022-1954 State: PUBLISHED Published: 2022-07-01T17:01:14 Last Updated: 2024-08-03T00:24:43.630Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Vulnerability in GitLab Description: A Regular Expression Denial of Service vulnerability in GitLab CE/EE affecting all versions from 1.0.2 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 allows an attacker to make a GitLab instance inaccessible via specially crafted web server response headers Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/358160 - https://hackerone.com/reports/1531958
am Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/358160 - https://hackerone.com/reports/1531958 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1954.json
CVE ID: CVE-2022-1955 State: PUBLISHED Published: 2022-06-30T15:17:25 Last Updated: 2024-08-03T00:24:43.755Z Vendors: n/a Products: Session Problem Types: Improper Access Control Description: Session 1.13.0 allows an attacker with physical access to the victim's device to bypass the application's password/pin lock to access user data. This is possible due to lack of adequate security controls to prevent dynamic code manipulation. Additional Analyst Notes: - CVE Program Container: References: - https://fluidattacks.com/advisories/tempest/ - https://github.com/oxen-io/session-android/pull/897 - https://github.com/oxen-io/session-android
CVE ID: CVE-2022-1956 State: PUBLISHED Published: 2022-07-11T12:56:58 Last Updated: 2024-08-03T00:24:43.993Z Vendors: Unknown Products: Shortcut Macros Problem Types: CWE-352 Description: The Shortcut Macros WordPress plugin through 1.3 does not have authorisation and CSRF checks in place when updating its settings, which could allow any authenticated users, such as subscriber, to update them. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ef6d0393-0ce3-465c-84c8-53bf8c58958a
CVE ID: CVE-2022-1957 State: PUBLISHED Published: 2022-07-11T12:57:04 Last Updated: 2024-08-03T00:24:44.237Z Vendors: Unknown Products: Comment License Problem Types: CWE-352 Description: The Comment License WordPress plugin before 1.4.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ad3f6f3d-e12c-4867-906c-73aa001c7351
CVE ID: CVE-2022-1958 State: PUBLISHED Published: 2022-06-15T09:45:16 Last Updated: 2024-08-03T00:24:44.030Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: n/a Products: FileCloud Problem Types: CWE-284 Description: A vulnerability classified as critical has been found in FileCloud. Affected is an unknown function of the component NTFS Handler. The manipulation leads to improper access controls. It is possible to launch the attack remotely. Upgrading to version 21.3.5.18513 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-201960. Additional Analyst Notes: - CVE Program Container:
fected component. The identifier of this vulnerability is VDB-201960. Additional Analyst Notes: - CVE Program Container: References: - https://vuldb.com/?id.201960 - https://vuldb.com/?ctiid.201960 - https://www.filecloud.com/supportdocs/fcdoc/2v/server/security-advisories/2022-security-advisories/advisory-2022-06-01-potential-unauthorized-data-access-when-using-network-folders-with-ntfs-permissions - https://www.scip.ch/?news.20220615
CVE ID: CVE-2022-1959 State: PUBLISHED Published: 2022-09-30T16:22:14.000Z Last Updated: 2025-05-20T18:31:08.693Z Vendors: n/a Products: AppLock - Fingerprint Problem Types: Improper Access Control - Fingerprint Description: AppLock version 7.9.29 allows an attacker with physical access to the device to bypass biometric authentication. This is possible because the application did not correctly implement fingerprint validations. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://fluidattacks.com/advisories/walker/ - https://www.spsoftmobile.com/
CVE ID: CVE-2022-1960 State: PUBLISHED Published: 2022-06-27T08:58:51 Last Updated: 2024-08-03T00:24:43.987Z Vendors: Unknown Products: MyCSS Problem Types: CWE-352 Description: The MyCSS WordPress plugin through 1.1 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/bc97dd57-e9f6-4bc3-a4c2-40303786ae4a
CVE ID: CVE-2022-1961 State: PUBLISHED Published: 2022-06-13T13:11:47.000Z Last Updated: 2025-05-05T16:40:29.109Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N) Vendors: duracelltomi Products: GTM4WP Problem Types: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Description: The Google Tag Manager for WordPress (GTM4WP) plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping via the `gtm4wp-options[scroller-contentid]` parameter found in the `~/public/frontend.php` file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.1. T
wed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 1.15.1. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/202c14d0-9207-47cb-9410-ca4c70d7b6d2?source=cve - https://gist.github.com/Xib3rR4dAr/02a21cd0ea0b7bf586131c5eebb69f1d - https://wordpress.org/plugins/duracelltomi-google-tag-manager/#developers - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2732977%40duracellt