Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
08-0BA2) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA2) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA2) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA2) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA2) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA2) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LO
S LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA2) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA2) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA2) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA2) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA2) (All versions). Affected devices do not conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipu
ot conduct certain validations when interacting with them. This could allow an unauthenticated remote attacker to manipulate the devices IP address, which means the device would not be reachable and could only be recovered by power cycling the device. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-955858.pdf - https://cert-portal.siemens.com/productcert/html/ssa-955858.html
CVE ID: CVE-2022-36363 State: PUBLISHED Published: 2022-10-11T00:00:00 Last Updated: 2024-10-08T08:39:55.848Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:T/RC:C) Vendors: Siemens Products: LOGO! 12/24RCE, LOGO! 12/24RCEo, LOGO! 230RCE, LOGO! 230RCEo, LOGO! 24CE, LOGO! 24CEo, LOGO! 24RCE, LOGO! 24RCEo, SIPLUS LOGO! 12/24RCE, SIPLUS LOGO! 12/24RCEo, SIPLUS LOGO! 230RCE, SIPLUS LOGO! 230RCEo, SIPLUS LOGO! 24CE, SIPLUS LOGO! 24CEo, SIPLUS LOGO! 24RCE, SIPLUS LOGO! 24RCEo Problem Types: CWE-1285 Description: A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE
in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All versions), LOGO! 230RCE (6ED1052-1FB08-0BA1) (All versions), LOGO! 230RCEo (6ED1052-2FB08-0BA1) (All versions), LOGO! 24CE (6ED1052-1CC08-0BA1) (All versions), LOGO! 24CEo (6ED1052-2CC08-0BA1) (All versions), LOGO! 24RCE (6ED1052-1HB08-0BA1) (All versions), LOGO! 24RCEo (6ED1052-2HB08-0BA1) (All versions), SIPLUS LOGO! 12/24RCE (6AG1052-1MD08-7BA1) (All versions), SIPLUS LOGO! 12/24RCEo (6AG1052-2MD08-7BA1) (All versions), SIPLUS LOGO! 230RCE (6AG1052-1FB08-7BA1) (All versions), SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions), SIPLUS
SIPLUS LOGO! 230RCEo (6AG1052-2FB08-7BA1) (All versions), SIPLUS LOGO! 24CE (6AG1052-1CC08-7BA1) (All versions), SIPLUS LOGO! 24CEo (6AG1052-2CC08-7BA1) (All versions), SIPLUS LOGO! 24RCE (6AG1052-1HB08-7BA1) (All versions), SIPLUS LOGO! 24RCEo (6AG1052-2HB08-7BA1) (All versions). Affected devices do not properly validate an offset value which can be defined in TCP packets when calling a method. This could allow an attacker to retrieve parts of the content of the memory. Additional Analyst Notes: - CVE Program Container: References: - https://cert-portal.siemens.com/productcert/pdf/ssa-955858.pdf - https://cert-portal.siemens.com/productcert/html/ssa-955858.html
CVE ID: CVE-2022-36364 State: PUBLISHED Published: 2022-07-28T08:35:10 Last Updated: 2024-08-03T10:00:04.292Z Vendors: Apache Software Foundation Products: Apache Calcite Avatica Problem Types: CWE-665 Description: Apache Calcite Avatica JDBC driver creates HTTP client instances based on class names provided via `httpclient_impl` connection property; however, the driver does not verify if the class implements the expected interface before instantiating it, which can lead to code execution loaded via arbitrary classes and in rare cases remote code execution. To exploit the vulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a v
ulnerability: 1) the attacker needs to have privileges to control JDBC connection parameters; 2) and there should be a vulnerable class (constructor with URL parameter and ability to execute code) in the classpath. From Apache Calcite Avatica 1.22.0 onwards, it will be verified that the class implements the expected interface before invoking its constructor. Additional Analyst Notes: - CVE Program Container: References: - https://lists.apache.org/thread/5csdj8bv4h3hfgw27okm84jh1j2fyw0c - http://www.openwall.com/lists/oss-security/2022/07/28/1
CVE ID: CVE-2022-36365 State: PUBLISHED Published: 2022-09-21T19:06:24.757Z Last Updated: 2025-02-20T20:05:10.962Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: WHA Products: WHA Crossword (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Crossword plugin <= 1.1.10 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wha-crossword/wordpress-wha-crossword-plugin-1-1-10-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities - https://wordpress.org/pl
rossword-plugin-1-1-10-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities - https://wordpress.org/plugins/wha-crossword/
CVE ID: CVE-2022-36366 State: REJECTED Published: N/A Last Updated: 2025-05-28T18:20:32.070Z Description: No description available.
CVE ID: CVE-2022-36367 State: PUBLISHED Published: 2022-11-11T15:48:38.720Z Last Updated: 2025-02-05T20:53:26.387Z Severity: MEDIUM (CVSS 4.4 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: Intel(R) Support Android application Problem Types: information disclosure Description: Incorrect default permissions in the Intel(R) Support Android application before version v22.02.28 may allow a privileged user to potentially enable information disclosure via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00740.html
CVE ID: CVE-2022-36368 State: PUBLISHED Published: 2022-10-24T00:00:00.000Z Last Updated: 2025-05-07T14:26:45.593Z Vendors: IPFire Project Products: IPFire Problem Types: Cross-site scripting Description: Multiple stored cross-site scripting vulnerabilities in the web user interface of IPFire versions prior to 2.27 allows a remote authenticated attacker with administrative privilege to inject an arbitrary script. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://blog.ipfire.org/post/ipfire-2-27-core-update-170-released - https://bugzilla.ipfire.org/show_bug.cgi?id=12925 - https://github.com/ipfire/ipfire-2.x - https://jvn.jp/en/jp/JVN15411362/i
://bugzilla.ipfire.org/show_bug.cgi?id=12925 - https://github.com/ipfire/ipfire-2.x - https://jvn.jp/en/jp/JVN15411362/index.html
CVE ID: CVE-2022-36369 State: PUBLISHED Published: 2023-02-16T20:00:28.740Z Last Updated: 2025-01-27T18:12:49.543Z Severity: HIGH (CVSS 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: n/a Products: QATzip software maintained by Intel(R) Problem Types: escalation of privilege Description: Improper access control in some QATzip software maintained by Intel(R) before version 1.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00765.html
CVE ID: CVE-2022-36370 State: PUBLISHED Published: 2022-11-11T15:48:54.374Z Last Updated: 2025-02-05T15:37:41.825Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC Boards and Intel(R) NUC Kits Problem Types: escalation of privilege Description: Improper authentication in BIOS firmware for some Intel(R) NUC Boards and Intel(R) NUC Kits before version MYi30060 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00752.html
CVE ID: CVE-2022-36372 State: PUBLISHED Published: 2023-08-11T02:37:29.052Z Last Updated: 2024-10-09T16:27:13.433Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) NUC BIOS firmware Problem Types: escalation of privilege, CWE-92 Description: Improper buffer restrictions in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00917.html
CVE ID: CVE-2022-36373 State: PUBLISHED Published: 2022-09-01T16:49:39.276Z Last Updated: 2025-02-20T20:09:52.534Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Simon Ward Products: MP3-jPlayer (WordPress plugin) Problem Types: CWE-352 Description: Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in Simon Ward MP3 jPlayer plugin <= 2.7.3 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mp3-jplayer/wordpress-mp3-jplayer-plugin-2-7-3-multiple-cross-site-request-forgery-csrf-vulnerabilities - https://wordpress.org/plugins/mp3-jplayer/
CVE ID: CVE-2022-36374 State: PUBLISHED Published: 2023-11-14T19:04:43.074Z Last Updated: 2024-08-30T17:13:59.323Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Aptio* V UEFI Firmware Integrator Tools Problem Types: escalation of privilege, CWE-284 Description: Improper access control in some Intel(R) Aptio* V UEFI Firmware Integrator Tools before version iDmi Windows 5.27.03.0003 may allow a privileged user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-009
er: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html
CVE ID: CVE-2022-36375 State: PUBLISHED Published: 2022-07-25T19:50:50.904Z Last Updated: 2025-02-20T20:15:05.168Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Biplob Adhikari Products: Tabs (WordPress plugin) Problem Types: CWE-264 Description: Authenticated (high role user) WordPress Options Change vulnerability in Biplob Adhikari's Tabs plugin <= 3.6.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://plugins.trac.wordpress.org/changeset/2646981 - https://patchstack.com/database/vulnerability/vc-tabs/wordpress-tabs-plugin-3-6-0-authenticated-wordpress-options-change-vulnerability
CVE ID: CVE-2022-36376 State: PUBLISHED Published: 2022-09-09T14:39:53.112Z Last Updated: 2025-02-20T20:07:59.362Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N) Vendors: Rank Math Products: Rank Math SEO (WordPress plugin) Problem Types: CWE-918 Description: Server-Side Request Forgery (SSRF) vulnerability in Rank Math SEO plugin <= 1.0.95 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/seo-by-rank-math/wordpress-rank-math-seo-plugin-1-0-95-server-side-request-forgery-ssrf-vulnerability/_s_id=cve - https://rankmath.com/changelog/
CVE ID: CVE-2022-36377 State: PUBLISHED Published: 2022-11-11T15:49:12.793Z Last Updated: 2025-02-05T14:34:04.206Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs Problem Types: escalation of privilege, CWE-277 Description: Insecure inherited permissions in some Intel(R) Wireless Adapter Driver installation software for Intel(R) NUC Kits & Mini PCs before version 22.190.0.3 for Windows may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Ref
scalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00908.html
CVE ID: CVE-2022-36378 State: PUBLISHED Published: 2022-07-29T18:57:27.625Z Last Updated: 2025-02-20T20:14:35.199Z Severity: MEDIUM (CVSS 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) Vendors: PluginlySpeaking Products: Floating Div (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (author or higher user role) Stored Cross-Site Scripting (XSS) vulnerability in PluginlySpeaking Floating Div plugin <= 3.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/floating-div/#developers - https://patchstack.com/database/vulnerability/floating-div/wordpress-floating-div-plugin-3-0-authenticated-sto
elopers - https://patchstack.com/database/vulnerability/floating-div/wordpress-floating-div-plugin-3-0-authenticated-stored-cross-site-scripting-xss-vulnerability
CVE ID: CVE-2022-36379 State: PUBLISHED Published: 2022-08-23T15:47:42.258Z Last Updated: 2025-02-20T20:11:02.342Z Severity: HIGH (CVSS 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) Vendors: YooMoney Products: ЮKassa для WooCommerce (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) leading to plugin settings update in YooMoney ЮKassa для WooCommerce plugin <= 2.3.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/yookassa/#developers - https://patchstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-cross-site-request-forgery-cs
hstack.com/database/vulnerability/yookassa/wordpress-yukassa-dlya-woocommerce-plugin-2-3-0-cross-site-request-forgery-csrf-leading-to-plugin-settings-update
CVE ID: CVE-2022-36380 State: PUBLISHED Published: 2022-11-11T15:49:12.259Z Last Updated: 2025-02-04T17:17:51.283Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 Problem Types: escalation of privilege Description: Uncontrolled search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/
- CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00747.html
CVE ID: CVE-2022-36381 State: PUBLISHED Published: 2022-08-16T07:03:29 Last Updated: 2024-08-03T10:00:04.369Z Vendors: Nintendo Co., Ltd. Products: Nintendo Wi-Fi Network Adaptor WAP-001 Problem Types: OS Command Injection Description: OS command injection vulnerability in Nintendo Wi-Fi Network Adaptor WAP-001 All versions allows an attacker with an administrative privilege to execute arbitrary OS commands via unspecified vectors. Additional Analyst Notes: - CVE Program Container: References: - https://www.nintendo.co.jp/support/information/2022/0720.html - https://jvn.jp/en/jp/JVN17625382/index.html
CVE ID: CVE-2022-36382 State: PUBLISHED Published: 2023-02-16T20:00:26.578Z Last Updated: 2025-01-27T18:13:41.505Z Severity: MEDIUM (CVSS 6 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H) Vendors: n/a Products: Intel(R) Ethernet Network Controllers and Adapters E810 Series and some Intel(R) Ethernet 700 Series Controllers and Adapters Problem Types: denial of service Description: Out-of-bounds write in firmware for some Intel(R) Ethernet Network Controllers and Adapters E810 Series before version 1.7.0.8 and some Intel(R) Ethernet 700 Series Controllers and Adapters before version 9.101 may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Not
rsion 9.101 may allow a privileged user to potentially enable denial of service via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00754.html
CVE ID: CVE-2022-36383 State: PUBLISHED Published: 2022-09-21T19:05:04.778Z Last Updated: 2025-02-20T20:05:19.710Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) Vendors: WHA Products: Word Search Puzzles game (WordPress plugin) Problem Types: CWE-79 Description: Multiple Authenticated (contributor+) Stored Cross-Site Scripting (XSS) vulnerabilities in WHA Word Search Puzzles game plugin <= 2.0.1 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/wha-wordsearch/ - https://patchstack.com/database/vulnerability/wha-wordsearch/wordpress-word-search-puzzles-game-plugin-2-0-1-multiple-auth
tps://patchstack.com/database/vulnerability/wha-wordsearch/wordpress-word-search-puzzles-game-plugin-2-0-1-multiple-authenticated-stored-cross-site-scripting-xss-vulnerabilities
CVE ID: CVE-2022-36384 State: PUBLISHED Published: 2022-11-11T15:49:11.789Z Last Updated: 2025-02-04T17:30:03.148Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 Problem Types: escalation of privilege Description: Unquoted search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advi
E Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00747.html
CVE ID: CVE-2022-36385 State: PUBLISHED Published: 2022-09-13T14:54:35.692Z Last Updated: 2025-04-16T17:47:37.455Z Severity: MEDIUM (CVSS 6.8 CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Contec Health Products: CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor Problem Types: CWE-284 Description: A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a drive-by attack to load the firmware on any CMS8000 device. Additional Analyst Notes: - CVE Progra
ware and performing a drive-by attack to load the firmware on any CMS8000 device. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01
CVE ID: CVE-2022-36386 State: PUBLISHED Published: 2022-09-21T19:02:24.214Z Last Updated: 2025-02-20T20:05:33.981Z Severity: CRITICAL (CVSS 9.1 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: Soflyy Products: Import any XML or CSV File to WordPress (WordPress plugin) Problem Types: Arbitrary Code Execution Description: Authenticated Arbitrary Code Execution vulnerability in Soflyy Import any XML or CSV File to WordPress plugin <= 3.6.7 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-all-import/wordpress-import-any-xml-or-csv-file-to-wordpress-plugin-3-6-7-authenticated-arbitrary-co
se/vulnerability/wp-all-import/wordpress-import-any-xml-or-csv-file-to-wordpress-plugin-3-6-7-authenticated-arbitrary-code-execution-vulnerability - https://wordpress.org/plugins/wp-all-import/#developers
CVE ID: CVE-2022-36387 State: PUBLISHED Published: 2022-09-06T22:19:13.284Z Last Updated: 2025-02-20T20:08:59.219Z Severity: HIGH (CVSS 7.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L) Vendors: Alessio Caiazza Products: About Me (WordPress plugin) Problem Types: CWE-264 Description: Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/about-me/wordpress-about-me-plugin-1-0-12-broken-access-control-vulnerability/_s_id=cve - https://wordpress.org/plugins/about-me/
CVE ID: CVE-2022-36388 State: PUBLISHED Published: 2022-09-23T14:31:32.290Z Last Updated: 2025-02-20T20:02:59.848Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L) Vendors: Ydesignservices Products: YDS Support Ticket System (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in YDS Support Ticket System plugin <= 1.0 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/yds-support-ticket-system/wordpress-yds-support-ticket-system-plugin-1-0-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/pl
-yds-support-ticket-system-plugin-1-0-cross-site-request-forgery-csrf-vulnerability/_s_id=cve - https://wordpress.org/plugins/yds-support-ticket-system/
CVE ID: CVE-2022-36389 State: PUBLISHED Published: 2022-08-23T15:48:47.656Z Last Updated: 2025-02-20T20:10:17.167Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: WordPlus Products: Better Messages (WordPress plugin) Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wordpress.org/plugins/bp-better-messages/#developers - https://patchstack.com/database/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-9-148-cross-site-request-forgery-csrf-vulnerabil
e/vulnerability/bp-better-messages/wordpress-better-messages-plugin-1-9-9-148-cross-site-request-forgery-csrf-vulnerability-2
CVE ID: CVE-2022-36390 State: PUBLISHED Published: 2022-09-21T19:03:45.225Z Last Updated: 2025-02-20T20:05:26.891Z Severity: MEDIUM (CVSS 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N) Vendors: Totalsoft Products: Event Calendar – Calendar (WordPress plugin) Problem Types: CWE-79 Description: Authenticated (subscriber+) Reflected Cross-Site Scripting (XSS) vulnerability in Totalsoft Event Calendar – Calendar plugin <= 1.4.6 at WordPress. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/calendar-event/wordpress-event-calendar-calendar-plugin-1-4-6-authenticated-reflected-cross-site-scripting-xss-vulnerab
/calendar-event/wordpress-event-calendar-calendar-plugin-1-4-6-authenticated-reflected-cross-site-scripting-xss-vulnerability - https://wordpress.org/plugins/calendar-event/#developers