Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-3845 State: PUBLISHED Published: 2022-11-02T00:00:00.000Z Last Updated: 2025-04-15T13:17:33.838Z Severity: LOW (CVSS 2.4 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N) Vendors: unspecified Products: phpipam Problem Types: CWE-707 Description: A vulnerability has been found in phpipam and classified as problematic. Affected by this vulnerability is an unknown functionality of the file app/admin/import-export/import-load-data.php of the component Import Preview Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. Upgrading to version 1.5.0 is able to address this issue. The name of the patch is 22c797c3583001211fe7d31bccd3f1d4aeeb3bbc. I
ing to version 1.5.0 is able to address this issue. The name of the patch is 22c797c3583001211fe7d31bccd3f1d4aeeb3bbc. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-212863. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/phpipam/phpipam/commit/22c797c3583001211fe7d31bccd3f1d4aeeb3bbc - https://github.com/phpipam/phpipam/releases/tag/v1.5.0 - https://vuldb.com/?id.212863
CVE ID: CVE-2022-3846 State: PUBLISHED Published: 2022-12-05T16:51:48.844Z Last Updated: 2025-04-23T14:57:12.850Z Vendors: Unknown Products: Workreap Problem Types: CWE-639 Authorization Bypass Through User-Controlled Key Description: The Workreap WordPress theme before 2.6.3 has a vulnerability with the notifications feature as it's possible to read any user's notification (employer or freelancer) as the notification ID is brute-forceable. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/6220c7ef-69a6-49c4-9c56-156b945446af
CVE ID: CVE-2022-3847 State: PUBLISHED Published: 2022-11-28T13:50:08.559Z Last Updated: 2024-08-03T01:20:58.782Z Vendors: Unknown Products: Showing URL in QR Code Problem Types: CWE-352 Cross-Site Request Forgery (CSRF), CWE-79 Cross-Site Scripting (XSS) Description: The Showing URL in QR Code WordPress plugin through 0.0.1 does not have CSRF check when updating its settings, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin or editor add Stored XSS payloads via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6 - https://bulletin.iese.de/post/
er: References: - https://wpscan.com/vulnerability/a70ad549-2e09-44fb-b894-4271ad4a84f6 - https://bulletin.iese.de/post/get-site-to-phone-by-qr-code_0-0-1/
CVE ID: CVE-2022-3848 State: PUBLISHED Published: 2022-11-28T13:47:19.946Z Last Updated: 2025-04-25T17:23:07.982Z Vendors: Unknown Products: WP User Merger Problem Types: CWE-89 SQL Injection Description: The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/da1f0313-2576-490e-a95f-bf12de340610 - https://bulletin.iese.de/post/wp-user-merger_1-5-1_2/
CVE ID: CVE-2022-3849 State: PUBLISHED Published: 2022-11-28T13:47:16.821Z Last Updated: 2025-04-28T18:09:28.086Z Vendors: Unknown Products: WP User Merger Problem Types: CWE-89 SQL Injection Description: The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/511327d3-499b-4ad9-8fd3-99f9f7deb4f5 - https://bulletin.iese.de/post/wp-user-merger_1-5-1_3/
CVE ID: CVE-2022-3850 State: PUBLISHED Published: 2022-11-28T13:47:12.088Z Last Updated: 2025-04-25T15:00:33.969Z Vendors: Unknown Products: Find and Replace All Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The Find and Replace All WordPress plugin before 1.3 does not have CSRF check when replacing string, which could allow attackers to make a logged admin replace arbitrary string in database tables via a CSRF attack Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8ae42ec0-7e3a-4ea5-8e76-0aae7b92a8e9
CVE ID: CVE-2022-3852 State: PUBLISHED Published: 2022-11-03T17:15:11.490Z Last Updated: 2025-01-31T18:26:34.304Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: innate-images-llc Products: VR Calendar Problem Types: CWE-352 Cross-Site Request Forgery (CSRF) Description: The VR Calendar plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.3. This is due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to delete, and modify calendars as well as the plugin settings, via forged request granted they can trick a site administrator into performing an
ndars as well as the plugin settings, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/browser/vr-calendar-sync/tags/2.3.2/Admin/Classes/VRCalendarAdmin.class.php#L133 - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2809350%40vr-calendar-sync&new=2809350%40vr-calendar-sync&sfp_email=&sfph_mail= - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3852
CVE ID: CVE-2022-3853 State: PUBLISHED Published: 2022-12-12T17:54:45.964Z Last Updated: 2025-04-22T14:55:55.048Z Vendors: Unknown Products: Supra CSV Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c2bc7d23-5bfd-481c-b42b-da7ee80d9514
CVE ID: CVE-2022-3854 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-06T18:54:06.925Z Vendors: n/a Products: ceph Problem Types: CWE-177 Description: A flaw was found in Ceph, relating to the URL processing on RGW backends. An attacker can exploit the URL processing by providing a null URL to crash the RGW, causing a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2139925
CVE ID: CVE-2022-3855 State: PUBLISHED Published: 2023-01-09T22:13:43.274Z Last Updated: 2025-04-09T18:38:24.520Z Vendors: Unknown Products: 404 to Start Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The 404 to Start WordPress plugin through 1.6.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/ae44f2d8-a452-4310-b616-54d9519867eb
CVE ID: CVE-2022-3856 State: PUBLISHED Published: 2022-12-05T16:50:28.194Z Last Updated: 2025-04-24T13:38:59.924Z Vendors: Unknown Products: Comic Book Management System Problem Types: CWE-89 SQL Injection Description: The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/c0f5cf61-b3e2-440f-a185-61df360c1192 - https://bulletin.iese.de/post/comicbookmanagementsystemweeklypicks_2-0-0_1/
CVE ID: CVE-2022-3857 State: REJECTED Published: 2023-03-06T00:00:00 Last Updated: 2024-10-29T18:03:32.799Z Description: No description available.
CVE ID: CVE-2022-3858 State: PUBLISHED Published: 2022-12-05T16:50:40.032Z Last Updated: 2025-04-23T14:58:43.875Z Vendors: Unknown Products: Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button Problem Types: CWE-89 SQL Injection Description: The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line, WeChat, Email, SMS, Call Button WordPress plugin before 3.0.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d251b6c1-602b-4d72-9d6a-bf5d5ec541ec
CVE ID: CVE-2022-3859 State: PUBLISHED Published: 2022-11-30T08:29:29.242Z Last Updated: 2025-04-23T19:28:30.917Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Trellix Products: Trellix Agent Problem Types: CWE- 427: Uncontrolled Search Path Element Description: An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. This allows an attacker with admin access, which is required to place the DLL in the restricted Windows System folder, to elevate their privileges to System by placing a malicious DLL there. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://k
malicious DLL there. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kcm.trellix.com/corporate/index?page=content&id=SB10391
CVE ID: CVE-2022-3860 State: PUBLISHED Published: 2023-01-02T21:53:14.062Z Last Updated: 2025-04-10T18:31:31.153Z Vendors: Unknown Products: Visual Email Designer for WooCommerce Problem Types: CWE-89 SQL Injection Description: The Visual Email Designer for WooCommerce WordPress plugin before 1.7.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as author. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/d99ce21f-fbb6-429c-aa3b-19c4a5eb7557
CVE ID: CVE-2022-3861 State: PUBLISHED Published: 2022-11-21T12:45:46.108Z Last Updated: 2025-02-07T20:32:20.436Z Severity: HIGH (CVSS 8.8 CVSS:3.1/A:H/I:H/C:H/S:U/UI:N/PR:L/AC:L/AV:N) Vendors: MuffinGroup Products: Betheme Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Betheme theme for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 26.5.1.4 via deserialization of untrusted input supplied via the import, mfn-items-import-page, and mfn-items-import parameters passed through the mfn_builder_import, mfn_builder_import_page, importdata, importsinglepage, and importfromclipboard functions. This makes it possible for authenticated atta
ort_page, importdata, importsinglepage, and importfromclipboard functions. This makes it possible for authenticated attackers, with contributor level permissions and above to inject a PHP Object. The additional presence of a POP chain would make it possible for attackers to execute code, retrieve sensitive data, delete files, etc.. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://muffingroup.com/betheme/ - https://github.com/MrTuxracer/advisories/blob/master/CVEs/CVE-2022-3861.txt - https://www.wordfence.com/vulnerability-advisories-continued/#CVE-2022-3861
CVE ID: CVE-2022-3862 State: PUBLISHED Published: 2022-12-12T17:54:57.745Z Last Updated: 2025-04-22T14:46:42.191Z Vendors: Unknown Products: Livemesh Addons for Elementor Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/3db9a8f5-3335-4b8d-a067-091cbfed1efc
CVE ID: CVE-2022-3863 State: PUBLISHED Published: 2023-01-02T00:00:00 Last Updated: 2024-10-29T14:46:58.135Z Vendors: Google Products: Chrome Problem Types: Use after free Description: Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chrome security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop.html - https://crbug.com/1306507
CVE ID: CVE-2022-3864 State: PUBLISHED Published: 2024-01-04T09:31:20.283Z Last Updated: 2024-08-27T15:19:54.336Z Severity: MEDIUM (CVSS 4.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: Hitachi Energy Products: Relion 670/650/SAM600-IO Series Problem Types: CWE-347 Description: A vulnerability exists in the Relion update package signature validation. A tampered update package could cause the IED to restart. After restart the device is back to normal operation. An attacker could exploit the vulnerability by first gaining access to the system with security privileges and attempt to update the IED with a malicious update package. Successful exploitation of this vulnerability will caus
s and attempt to update the IED with a malicious update package. Successful exploitation of this vulnerability will cause the IED to restart, causing a temporary Denial of Service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://publisher.hitachienergy.com/preview?DocumentID=8DBD000146&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-3865 State: PUBLISHED Published: 2022-11-28T13:50:09.396Z Last Updated: 2025-04-25T15:05:38.236Z Vendors: Unknown Products: WP User Merger Problem Types: CWE-89 SQL Injection Description: The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/fbe4aed8-964a-4774-bbc3-d432792bfeb6 - https://bulletin.iese.de/post/wp-user-merger_1-5-1_1/
CVE ID: CVE-2022-3866 State: PUBLISHED Published: 2022-11-10T05:34:52.468Z Last Updated: 2025-05-01T19:05:00.374Z Severity: MEDIUM (CVSS 5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-668 Description: HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 workload identity token can list non-sensitive metadata for paths under nomad/ that belong to other jobs in the same namespace. Fixed in 1.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2022-25-nomad-s-workload-identity-token-can-list-non-sensitive-metadata-for-nomad-paths/46167
CVE ID: CVE-2022-3867 State: PUBLISHED Published: 2022-11-10T05:45:53.550Z Last Updated: 2025-05-01T19:04:09.365Z Severity: LOW (CVSS 2.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N) Vendors: HashiCorp Products: Nomad, Nomad Enterprise Problem Types: CWE-613 Description: HashiCorp Nomad and Nomad Enterprise 1.4.0 up to 1.4.1 event stream subscribers using a token with TTL receive updates until token garbage is collected. Fixed in 1.4.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://discuss.hashicorp.com/t/hcsec-2022-26-nomad-s-event-stream-subscriber-using-acl-token-with-ttl-receive-updates-until-garbage-collected/46168
CVE ID: CVE-2022-3868 State: PUBLISHED Published: 2022-11-05T00:00:00.000Z Last Updated: 2025-04-15T13:17:23.871Z Severity: MEDIUM (CVSS 4.7 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L) Vendors: SourceCodester Products: Sanitization Management System Problem Types: CWE-707 Description: A vulnerability classified as critical has been found in SourceCodester Sanitization Management System. Affected is an unknown function of the file /php-sms/classes/Master.php?f=save_quote. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213012. Ad
ly. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-213012. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/x9AD8/Sanitization-Management-System/blob/main/README.md - https://vuldb.com/?id.213012
CVE ID: CVE-2022-3869 State: PUBLISHED Published: 2022-11-05T00:00:00.000Z Last Updated: 2025-05-05T20:27:55.467Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: froxlor Products: froxlor/froxlor Problem Types: CWE-94 Description: Code Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/7de20f21-4a9b-445d-ae2b-15ade648900b - https://github.com/froxlor/froxlor/commit/3f10a4adede9df83408d60ded78b51b812a763a8
CVE ID: CVE-2022-3870 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-09T13:14:42.655Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: GitLab Products: GitLab Problem Types: Authorization bypass through user-controlled key in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. GitLab allows unauthenticated users to download user avatars using the victim's user ID, on private instances that restrict public level visibility. Additional Analyst Notes: - CVE Program Containe
's user ID, on private instances that restrict public level visibility. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/381647 - https://hackerone.com/reports/1753423 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-3870.json
CVE ID: CVE-2022-3872 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-05T20:23:42.503Z Vendors: n/a Products: QEMU Problem Types: CWE-193 Description: An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01068.html - https://securit
ADP Vulnrichment: References: - https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01068.html - https://security.netapp.com/advisory/ntap-20221215-0005/
CVE ID: CVE-2022-3873 State: PUBLISHED Published: 2022-11-07T00:00:00.000Z Last Updated: 2025-05-01T17:59:19.909Z Severity: MEDIUM (CVSS 6.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: jgraph Products: jgraph/drawio Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - DOM in GitHub repository jgraph/drawio prior to 20.5.2. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/52a4085e-b687-489b-9ed6-f0987583ed77 - https://github.com/jgraph/drawio/commit/d37894baf125430e85840c2635563b10d1a6523d
CVE ID: CVE-2022-3874 State: PUBLISHED Published: 2023-09-22T13:56:54.314Z Last Updated: 2024-09-24T15:01:27.145Z Severity: HIGH (CVSS 8 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a, Red Hat Products: foreman, Red Hat Satellite 6 Problem Types: CWE-78 Description: A command injection flaw was found in foreman. This flaw allows an authenticated user with admin privileges on the foreman instance to transpile commands through CoreOS and Fedora CoreOS configurations in templates, possibly resulting in arbitrary command execution on the underlying operating system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/sec
Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-3874 - https://bugzilla.redhat.com/show_bug.cgi?id=2140577
CVE ID: CVE-2022-3875 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-14T15:54:56.735Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Click Studios Products: Passwordstate, Passwordstate Browser Extension Chrome Problem Types: CWE-302 Description: A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component API. The manipulation leads to authentication bypass by assumed-immutable data. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade th
can be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-216244. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html - https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf - https://vuldb.com/?id.216244
CVE ID: CVE-2022-3876 State: PUBLISHED Published: 2022-12-19T00:00:00.000Z Last Updated: 2025-04-15T12:56:56.284Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Click Studios Products: Passwordstate, Passwordstate Browser Extension Chrome Problem Types: CWE-266 Description: A vulnerability, which was classified as problematic, has been found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This issue affects some unknown processing of the file /api/browserextension/UpdatePassword/ of the component API. The manipulation of the argument PasswordID leads to authorization bypass. The attack may be initiated remotely. The exploit has be
ation of the argument PasswordID leads to authorization bypass. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-216245 was assigned to this vulnerability. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://modzero.com/modlog/archives/2022/12/19/better_make_sure_your_password_manager_is_secure/index.html - https://www.modzero.com/static/MZ-22-03_Passwordstate_Security_Disclosure_Report-v1.0.pdf - https://vuldb.com/?id.216245