Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-1499 State: PUBLISHED Published: 2022-07-26T21:35:33 Last Updated: 2024-08-03T00:03:06.436Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in WebAuthentication in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html - https://crbug.com/1000408 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1500 State: PUBLISHED Published: 2022-07-26T21:35:46 Last Updated: 2024-08-03T00:03:06.435Z Vendors: Google Products: Chrome Problem Types: Insufficient data validation Description: Insufficient data validation in Dev Tools in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to bypass content security policy via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html - https://crbug.com/1223475 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1501 State: PUBLISHED Published: 2022-07-26T21:35:57 Last Updated: 2024-08-03T00:03:06.415Z Vendors: Google Products: Chrome Problem Types: Inappropriate implementation Description: Inappropriate implementation in iframe in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Additional Analyst Notes: - CVE Program Container: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_26.html - https://crbug.com/1293191 - https://security.gentoo.org/glsa/202208-25
CVE ID: CVE-2022-1502 State: PUBLISHED Published: 2022-05-04T06:15:11 Last Updated: 2024-08-03T00:03:06.436Z Vendors: Octopus Deploy Products: Octopus Server Problem Types: Broken access control in API for projects using Git VCS in Octopus Server Description: Permissions were not properly verified in the API on projects using version control in Git. This allowed projects to be modified by users with only ProjectView permissions. Additional Analyst Notes: - CVE Program Container: References: - https://advisories.octopus.com/post/2022/sa2022-03/
CVE ID: CVE-2022-1503 State: PUBLISHED Published: 2022-04-27T07:50:10.000Z Last Updated: 2025-04-15T14:41:14.964Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: GetSimple Products: CMS Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like <script>alert(1)</script> leads to cross site scripting. The attack may be launched remotely but requires authentication. Expoit details have been disclosed within the advisory. Additional Analyst Notes: - CVE Program Cont
res authentication. Expoit details have been disclosed within the advisory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/joinia/project/blob/main/GetSimple/GetSimplereadme.md - https://vuldb.com/?id.198542
CVE ID: CVE-2022-1504 State: PUBLISHED Published: 2022-04-27T10:35:09 Last Updated: 2024-08-03T00:03:06.300Z Severity: MEDIUM (CVSS 6.3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/b8e5c324-3dfe-46b4-8095-1697c6b0a6d6 - https://github.com/microweber/microweber/commit/1f6a4de416a85e626dc643bb5ceb916e4802223e
CVE ID: CVE-2022-1505 State: PUBLISHED Published: 2022-05-10T19:35:59.000Z Last Updated: 2025-05-05T16:41:54.756Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: davidfcarr Products: RSVPMaker Problem Types: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Description: The RSVPMaker plugin for WordPress is vulnerable to unauthenticated SQL Injection due to missing SQL escaping and parameterization on user supplied data passed to a SQL query in the rsvpmaker-api-endpoints.php file. This makes it possible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9
ossible for unauthenticated attackers to steal sensitive information from the database in versions up to and including 9.2.6. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/threat-intel/vulnerabilities/id/6837b91d-b3ba-435a-965b-fa18d9b9b9c8?source=cve - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2715095%40rsvpmaker&new=2715095%40rsvpmaker&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories/#CVE-2022-1505
CVE ID: CVE-2022-1506 State: PUBLISHED Published: 2022-06-06T08:51:03 Last Updated: 2024-08-03T00:03:06.301Z Vendors: Unknown Products: WP BORN BABIES PLUGIN Problem Types: CWE-79 Description: The WP Born Babies WordPress plugin through 1.0 does not sanitise and escape some of its fields, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/ee4f6786-27e4-474c-85e0-715b0c0f2776
CVE ID: CVE-2022-1507 State: PUBLISHED Published: 2022-04-27T16:55:10 Last Updated: 2024-08-03T00:03:06.379Z Severity: MEDIUM (CVSS 5.5 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: hpjansson Products: hpjansson/chafa Problem Types: CWE-476 Description: chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. in GitHub repository hpjansson/chafa prior to 1.10.2. chafa: NULL Pointer Dereference in function gif_internal_decode_frame at libnsgif.c:599 allows attackers to cause a denial of service (crash) via a crafted input file. Additional Analyst Notes: - CVE Program Contain
attackers to cause a denial of service (crash) via a crafted input file. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/104d8c5d-cac5-4baa-9ac9-291ea0bcab95 - https://github.com/hpjansson/chafa/commit/e4b777c7b7c144cd16a0ea96108267b1004fe6c9 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L54UEP5S254VP5FZWGFPHLTPMFJVOGYT/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DIOAZPITFL2Y7Y6KHCZ4OIK7P7KWFN22/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PLHKTQYK6AO3M5NAVM3CDVQTZZS6MCO/
CVE ID: CVE-2022-1508 State: PUBLISHED Published: 2022-08-31T15:33:01 Last Updated: 2024-08-03T00:03:06.383Z Vendors: n/a Products: Kernel Problem Types: CWE-125 Description: An out-of-bounds read flaw was found in the Linux kernel’s io_uring module in the way a user triggers the io_read() function with some special parameters. This flaw allows a local user to read some memory out of bounds. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2075533 - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=89c2b3b74918200e46699338d7bcc19b1ea12110 - https://access.redhat.com/security/cve/CVE-2022-1508 - https://ub
/commit/?id=89c2b3b74918200e46699338d7bcc19b1ea12110 - https://access.redhat.com/security/cve/CVE-2022-1508 - https://ubuntu.com/security/CVE-2022-1508
CVE ID: CVE-2022-1509 State: PUBLISHED Published: 2022-04-28T10:05:09 Last Updated: 2024-08-30T15:20:56.856Z Severity: CRITICAL (CVSS 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: hestiacp Products: hestiacp/hestiacp Problem Types: CWE-77 Description: Command Injection Vulnerability in GitHub repository hestiacp/hestiacp prior to 1.5.12. An authenticated remote attacker with low privileges can execute arbitrary code under root context. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/09e69dff-f281-4e51-8312-ed7ab7606338 - https://github.com/hestiacp/hestiacp/commit/d50f95cf208049dfb6ac67a8020802121745bd60
CVE ID: CVE-2022-1510 State: PUBLISHED Published: 2022-05-11T14:48:22 Last Updated: 2024-08-03T00:03:06.350Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 13.9 before 14.8.6, all versions starting from 14.9 before 14.9.4, all versions starting from 14.10 before 14.10.1. GitLab was not correctly handling malicious text in the CI Editor and CI Pipeline details page allowing the attacker to cause uncontrolled resource consumption. Additional Analyst Notes: - CVE Program Container: Reference
ng the attacker to cause uncontrolled resource consumption. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/343276 - https://hackerone.com/reports/1353058 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-1510.json
CVE ID: CVE-2022-1511 State: PUBLISHED Published: 2022-04-28T00:00:00 Last Updated: 2024-08-03T00:03:06.383Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) Vendors: snipe Products: snipe/snipe-it Problem Types: CWE-862 Description: Missing Authorization in GitHub repository snipe/snipe-it prior to 5.4.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4a1723e9-5bc4-4c4b-bceb-1c45964cc71d - https://github.com/snipe/snipe-it/commit/2e9cf8fa87a025c0eac9f79f4864b3fdd33a950c
CVE ID: CVE-2022-1512 State: PUBLISHED Published: 2022-05-16T14:31:10 Last Updated: 2024-08-03T00:03:06.378Z Vendors: Unknown Products: ScrollReveal.js Effects Problem Types: CWE-79 Description: The ScrollReveal.js Effects WordPress plugin through 1.2 does not sanitise and escape its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a754a516-07fc-44f1-9c34-31e963460301 - https://packetstormsecurity.com/files/166820/
CVE ID: CVE-2022-1513 State: PUBLISHED Published: 2022-08-23T17:25:10 Last Updated: 2024-08-03T00:03:06.446Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: Lenovo Products: PCManager Problem Types: CWE-78 Description: A potential vulnerability was reported in Lenovo PCManager prior to version 5.0.10.4191 that may allow code execution when visiting a specially crafted website. Additional Analyst Notes: - CVE Program Container: References: - https://iknow.lenovo.com.cn/detail/dc_203545.html
CVE ID: CVE-2022-1514 State: PUBLISHED Published: 2022-04-28T15:50:11 Last Updated: 2024-08-03T00:03:06.352Z Severity: CRITICAL (CVSS 9 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: neorazorx Products: neorazorx/facturascripts Problem Types: CWE-79 Description: Stored XSS via upload plugin functionality in zip format in GitHub repository neorazorx/facturascripts prior to 2022.06. Cross-site scripting attacks can have devastating consequences. Code injected into a vulnerable application can exfiltrate data or install malware on the user's machine. Attackers can masquerade as authorized users via session cookies, allowing them to perform any action allowed by the user account. Additio
uerade as authorized users via session cookies, allowing them to perform any action allowed by the user account. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/4ae2a917-843a-4ae4-8197-8425a596761c - https://github.com/neorazorx/facturascripts/commit/aa9f28cb86467468f43486b77ddef7ff4d3c687e
CVE ID: CVE-2022-1515 State: PUBLISHED Published: 2022-05-02T18:58:37 Last Updated: 2024-08-03T00:03:06.380Z Vendors: n/a Products: matio Problem Types: CWE-401 Description: A memory leak was discovered in matio 1.5.21 and earlier in Mat_VarReadNextInfo5() in mat5.c via a crafted file. This issue can potentially result in DoS. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/tbeu/matio/issues/186 - https://bugzilla.redhat.com/show_bug.cgi?id=2079986
CVE ID: CVE-2022-1516 State: PUBLISHED Published: 2022-05-05T14:57:42 Last Updated: 2024-08-03T00:10:02.787Z Vendors: n/a Products: Kernel Problem Types: CWE-416 Description: A NULL pointer dereference flaw was found in the Linux kernel’s X.25 set of standardized network protocols functionality in the way a user terminates their session using a simulated Ethernet card and continued usage of this connection. This flaw allows a local user to crash the system. Additional Analyst Notes: - CVE Program Container: References: - https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=7781607938c8 - http://www.openwall.com/lists/oss-security/2022/06/19/1 - https://lists.debian.org/d
v/net.git/commit/?id=7781607938c8 - http://www.openwall.com/lists/oss-security/2022/06/19/1 - https://lists.debian.org/debian-lts-announce/2022/07/msg00000.html - https://www.debian.org/security/2022/dsa-5173
CVE ID: CVE-2022-1517 State: PUBLISHED Published: 2022-06-24T15:00:12.934Z Last Updated: 2025-04-16T16:17:11.157Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Illumina Products: NextSeq 550Dx, MiSeq Dx, NextSeq 500 Instrument, NextSeq 550 Instrument, MiSeq Instrument, iSeq 100 Instrument, MiniSeq Instrument Problem Types: CWE-250 Description: LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to acce
ns, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02
CVE ID: CVE-2022-1518 State: PUBLISHED Published: 2022-06-24T15:00:14.741Z Last Updated: 2025-04-16T16:16:54.839Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Illumina Products: NextSeq 550Dx, MiSeq Dx, NextSeq 500 Instrument, NextSeq 550 Instrument, MiSeq Instrument, iSeq 100 Instrument, MiniSeq Instrument Problem Types: CWE-22 Description: LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02
CVE ID: CVE-2022-1519 State: PUBLISHED Published: 2022-06-24T15:00:13.721Z Last Updated: 2025-04-16T16:17:02.637Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: Illumina Products: NextSeq 550Dx, MiSeq Dx, NextSeq 500 Instrument, NextSeq 550 Instrument, MiSeq Instrument, iSeq 100 Instrument, MiniSeq Instrument Problem Types: CWE-434 Description: LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics
dditional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02
CVE ID: CVE-2022-1520 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:20:58.943Z Vendors: Mozilla Products: Thunderbird Problem Types: Incorrect security status shown after viewing an attached email Description: When viewing an email message A, which contains an attached message B, where B is encrypted or digitally signed or both, Thunderbird may show an incorrect encryption or signature status. After opening and viewing the attached message B, when returning to the display of message A, the message A might be shown with the security status of message B. This vulnerability affects Thunderbird < 91.9. Additional Analyst Notes: - CVE Program Container: - CISA A
of message B. This vulnerability affects Thunderbird < 91.9. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-18/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1745019
CVE ID: CVE-2022-1521 State: PUBLISHED Published: 2022-06-24T15:00:15.565Z Last Updated: 2025-04-16T16:16:46.654Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Illumina Products: NextSeq 550Dx, MiSeq Dx, NextSeq 500 Instrumen, NextSeq 550 Instrument, MiSeq Instrument, iSeq 100 Instrument, MiniSeq Instrument Problem Types: CWE-284 Description: LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02
CVE ID: CVE-2022-1522 State: PUBLISHED Published: 2022-09-06T22:19:13.000Z Last Updated: 2025-04-16T16:10:35.734Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) Vendors: Cognex Products: 3D-A1000 Dimensioning System Problem Types: CWE-117 Description: The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization for Logs, which allows an attacker to create false logs that show the password as having been changed when it is not, complicating forensics. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22
otes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03
CVE ID: CVE-2022-1523 State: PUBLISHED Published: 2022-10-19T17:24:35.098Z Last Updated: 2025-04-16T16:08:46.789Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) Vendors: Fuji Electric Products: D300win Problem Types: CWE-123 Description: Fuji Electric D300win prior to version 3.7.1.17 is vulnerable to a write-what-where condition, which could allow an attacker to overwrite program memory to manipulate the flow of information. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-242-05
CVE ID: CVE-2022-1524 State: PUBLISHED Published: 2022-06-24T15:00:16.330Z Last Updated: 2025-04-16T17:52:17.725Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Illumina Products: NextSeq 550Dx, MiSeq Dx, NextSeq 500 Instrument, NextSeq 550 Instrument, MiSeq Instrument, iSeq 100 Instrument, MiniSeq Instrument Problem Types: CWE-319 Description: LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02
CVE ID: CVE-2022-1525 State: PUBLISHED Published: 2022-09-06T22:19:13.000Z Last Updated: 2025-04-16T16:10:27.445Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N) Vendors: Cognex Products: 3D-A1000 Dimensioning System Problem Types: CWE-602 Description: The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Server-Side Security, which could allow attackers to bypass web access controls by inspecting and modifying the source code of password protected web elements. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/ad
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsa-22-249-03
CVE ID: CVE-2022-1526 State: PUBLISHED Published: 2022-04-29T07:40:10.000Z Last Updated: 2025-04-15T14:41:04.618Z Severity: LOW (CVSS 3.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: Emlog Pro Problem Types: CWE-79 Description: A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articles. The manipulation with the input <script>alert(1);</script> leads to cross site scripting. It is possible to initiate the attack remotely but it requires a signup and login by the attacker. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Conta
he attacker. The exploit has been disclosed to the public and may be used. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/xiahao90/CVEproject/blob/main/xiahao.webray.com.cn/emlog%3C=pro-1.2.2%20Stored%20Cross-Site%20Scripting%28XSS%29.md - https://vuldb.com/?id.198705
CVE ID: CVE-2022-1527 State: PUBLISHED Published: 2022-05-30T08:35:48 Last Updated: 2024-08-03T00:10:02.821Z Vendors: Unknown Products: WP 2FA – Two-factor authentication for WordPress Problem Types: CWE-79 Description: The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/0260d5c0-52a9-44ce-b7be-aff642056d16
CVE ID: CVE-2022-1528 State: PUBLISHED Published: 2022-05-30T08:35:50 Last Updated: 2024-08-03T00:10:03.230Z Vendors: Unknown Products: VikBooking Hotel Booking Engine & PMS Problem Types: CWE-79 Description: The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScript context, leading to a Reflected Cross-Site Scripting Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/d1e59894-382f-4151-8c4c-5608f3d8ac1f
CVE ID: CVE-2022-1529 State: PUBLISHED Published: 2022-12-22T00:00:00.000Z Last Updated: 2025-04-16T15:19:47.119Z Vendors: Mozilla Products: Firefox ESR, Firefox, Firefox for Android, Thunderbird Problem Types: Untrusted input used in JavaScript object indexing, leading to prototype pollution Description: An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. This vulnerability affects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. Additional Analy
fects Firefox ESR < 91.9.1, Firefox < 100.0.2, Firefox for Android < 100.3.0, and Thunderbird < 91.9.1. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.mozilla.org/security/advisories/mfsa2022-19/ - https://bugzilla.mozilla.org/show_bug.cgi?id=1770048