Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-0704 State: PUBLISHED Published: 2022-03-16T09:15:15 Last Updated: 2024-08-02T23:40:03.327Z Severity: MEDIUM (CVSS 4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9 - https://huntr.dev/bounties/4142a8b4-b439-4328-aaa3-52f6fedfd0a6
CVE ID: CVE-2022-0705 State: PUBLISHED Published: 2022-03-16T10:30:12 Last Updated: 2024-08-02T23:40:03.461Z Severity: MEDIUM (CVSS 4.2 CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H) Vendors: pimcore Products: pimcore/pimcore Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.4.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/pimcore/pimcore/commit/6e0922c5b2959ac1b48500ac508d8fc5a97286f9 - https://huntr.dev/bounties/0e1b6836-e5b5-4e47-b9ab-2f6a4790ee7b
CVE ID: CVE-2022-0706 State: PUBLISHED Published: 2022-04-18T17:10:29 Last Updated: 2024-08-02T23:40:03.531Z Vendors: Unknown Products: Easy Digital Downloads – Simple eCommerce for Selling Digital Files Problem Types: CWE-79 Description: The Easy Digital Downloads WordPress plugin before 2.11.6 does not sanitise and escape the Downloadable File Name in the Logs, which could allow high privilege users to perform Cross-Site Scripting attacks when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/598d5c1b-7930-46a6-9a31-5e08a5f14907 - https://plugins.trac.wordpress.org/changeset/2697388
CVE ID: CVE-2022-0707 State: PUBLISHED Published: 2022-04-18T17:10:31 Last Updated: 2024-08-02T23:40:03.425Z Vendors: Unknown Products: Easy Digital Downloads – Simple eCommerce for Selling Digital Files Problem Types: CWE-352 Description: The Easy Digital Downloads WordPress plugin before 2.11.6 does not have CSRF check in place when inserting payment notes, which could allow attackers to make a logged admin insert arbitrary notes via a CSRF attack Additional Analyst Notes: - CVE Program Container: References: - https://plugins.trac.wordpress.org/changeset/2697388 - https://wpscan.com/vulnerability/50680797-61e4-4737-898f-e5b394d89117
CVE ID: CVE-2022-0708 State: PUBLISHED Published: 2022-02-21T17:49:29 Last Updated: 2024-12-06T23:11:05.829Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: Mattermost Products: Mattermost Problem Types: CWE-200 Description: Mattermost 6.3.0 and earlier fails to protect email addresses of the creator of the team via one of the APIs, which allows authenticated team members to access this information resulting in sensitive & private information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://mattermost.com/security-updates/
CVE ID: CVE-2022-0709 State: PUBLISHED Published: 2022-04-04T15:35:47 Last Updated: 2024-08-02T23:40:03.548Z Vendors: Unknown Products: Booking Package – Appointment Booking Calendar System Problem Types: CWE-200 Description: The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/3cd1d8d2-d2a4-45a9-9b5f-c2a56f08be85
CVE ID: CVE-2022-0710 State: PUBLISHED Published: 2022-02-24T18:27:06.000Z Last Updated: 2025-01-31T19:02:35.312Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: 99robots Products: Header Footer Code Manager Problem Types: CWE-79 Description: The Header Footer Code Manager plugin <= 1.1.16 for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the $_REQUEST['page'] parameter. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.wordfence.com/blog/2022/02/reflected-xss-in-header-footer-code-manager/
CVE ID: CVE-2022-0711 State: PUBLISHED Published: 2022-03-02T21:59:03 Last Updated: 2024-08-02T23:40:03.518Z Vendors: n/a Products: haproxy Problem Types: CWE-835 Description: A flaw was found in the way HAProxy processed HTTP responses containing the "Set-Cookie2" header. This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. The highest threat from this vulnerability is availability. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/security/cve/cve-2022-0711 - https://www.mail-archive.com/haproxy%40formilux.org/msg41833.html - https://github.com/
com/security/cve/cve-2022-0711 - https://www.mail-archive.com/haproxy%40formilux.org/msg41833.html - https://github.com/haproxy/haproxy/commit/bfb15ab34ead85f64cd6da0e9fb418c9cd14cee8 - https://www.debian.org/security/2022/dsa-5102
CVE ID: CVE-2022-0712 State: PUBLISHED Published: 2022-02-22T17:52:48 Last Updated: 2024-08-02T23:40:03.461Z Severity: MEDIUM (CVSS 5.9 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-476 Description: NULL Pointer Dereference in GitHub repository radareorg/radare2 prior to 5.6.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/1e572820-e502-49d1-af0e-81833e2eb466 - https://github.com/radareorg/radare2/commit/515e592b9bea0612bc63d8e93239ff35bcf645c7 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/ - http
CVE ID: CVE-2022-0713 State: PUBLISHED Published: 2022-02-22T18:30:11 Last Updated: 2024-08-02T23:40:03.538Z Severity: MEDIUM (CVSS 5.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) Vendors: radareorg Products: radareorg/radare2 Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository radareorg/radare2 prior to 5.6.4. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d35b3dff-768d-4a09-a742-c18ca8f56d3c - https://github.com/radareorg/radare2/commit/a35f89f86ed12161af09330e92e5a213014e46a1 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E6YBRQ3UCFWJVSOYIKPVUDASZ544TFND/ - ht
CVE ID: CVE-2022-0714 State: PUBLISHED Published: 2022-02-22T00:00:00 Last Updated: 2024-08-02T23:40:03.277Z Severity: HIGH (CVSS 8.4 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/db70e8db-f309-4f3c-986c-e69d2415c3b3 - https://github.com/vim/vim/commit/4e889f98e95ac05d7c8bd3ee933ab4d47820fdfa - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/ - https://lists.fedoraproject.org/archi
age-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HBUYQBZ6GWAWJRWP7AODJ4KHW5BCKDVP/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0715 State: PUBLISHED Published: 2022-03-09T19:30:14 Last Updated: 2024-08-02T23:40:03.366Z Vendors: Schneider Electric Products: APC Smart-UPS, SmartConnect Problem Types: CWE-287 Description: A CWE-287: Improper Authentication vulnerability exists that could cause an attacker to arbitrarily change the behavior of the UPS when a key is leaked and used to upload malicious firmware. Affected Product: APC Smart-UPS Family: SMT Series (SMT Series ID=18: UPS 09.8 and prior / SMT Series ID=1040: UPS 01.2 and prior / SMT Series ID=1031: UPS 03.1 and prior), SMC Series (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 an
eries (SMC Series ID=1005: UPS 14.1 and prior / SMC Series ID=1007: UPS 11.0 and prior / SMC Series ID=1041: UPS 01.1 and prior), SCL Series (SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior), SMX Series (SMX Series ID=20: UPS 10.2 and prior / SMX Series ID=23: UPS 07.0 and prior), SRT Series (SRT Series ID=1010/1019/1025: UPS 08.3 and prior / SRT Series ID=1024: UPS 01.0 and prior / SRT Series ID=1020: UPS 10.4 and prior / SRT Series ID=1021: UPS 12.2 and prior / SRT Series ID=1001/1013: UPS 05.1 and prior / SRT Series ID=1002/1014: UPSa05.2 and prior), APC SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018
and prior), APC SmartConnect Family: SMT Series (SMT Series ID=1015: UPS 04.5 and prior), SMC Series (SMC Series ID=1018: UPS 04.2 and prior), SMTL Series (SMTL Series ID=1026: UPS 02.9 and prior), SCL Series (SCL Series ID=1029: UPS 02.5 and prior / SCL Series ID=1030: UPS 02.5 and prior / SCL Series ID=1036: UPS 02.5 and prior / SCL Series ID=1037: UPS 03.1 and prior), SMX Series (SMX Series ID=1031: UPS 03.1 and prior) Additional Analyst Notes: - CVE Program Container: References: - https://www.se.com/ww/en/download/document/SEVD-2022-067-02/
CVE ID: CVE-2022-0717 State: PUBLISHED Published: 2022-02-23T02:05:11 Last Updated: 2024-08-02T23:40:03.266Z Severity: MEDIUM (CVSS 6.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: mruby Products: mruby/mruby Problem Types: CWE-125 Description: Out-of-bounds Read in GitHub repository mruby/mruby prior to 3.2. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/27a851a5-7ebf-409b-854f-b2614771e8f9 - https://github.com/mruby/mruby/commit/f72315575f78a9a773adbce0ee7d3ec33434cb76
CVE ID: CVE-2022-0718 State: PUBLISHED Published: 2022-08-29T14:03:04 Last Updated: 2024-08-02T23:40:03.318Z Vendors: n/a Products: openstack/python-oslo.utils Problem Types: CWE-522 Description: A flaw was found in python-oslo-utils. Due to improper parsing, passwords with a double quote ( " ) in them cause incorrect masking in debug logs, causing any part of the password after the double quote to be plaintext. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2056850 - https://bugs.launchpad.net/oslo.utils/+bug/1949623 - https://opendev.org/openstack/oslo.utils/commit/6e17ae1f7959c64dfd20a5f67edf422e702426aa - https://security-trac
49623 - https://opendev.org/openstack/oslo.utils/commit/6e17ae1f7959c64dfd20a5f67edf422e702426aa - https://security-tracker.debian.org/tracker/CVE-2022-0718 - https://access.redhat.com/security/cve/CVE-2022-0718 - https://lists.debian.org/debian-lts-announce/2022/09/msg00015.html
CVE ID: CVE-2022-0719 State: PUBLISHED Published: 2022-02-23T10:15:12 Last Updated: 2024-08-02T23:40:03.529Z Severity: HIGH (CVSS 7.6 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/bcdce15b-7f40-4971-a061-c25c6053c312 - https://github.com/microweber/microweber/commit/a5925f74d39775771d4c37c8d4c1acbb762fda0a
CVE ID: CVE-2022-0720 State: PUBLISHED Published: 2022-03-28T17:23:18 Last Updated: 2024-08-02T23:40:03.374Z Vendors: Unknown Products: Amelia – Events & Appointments Booking Calendar Problem Types: CWE-863 Description: The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/435ef99c-9210-46c7-80a4-09cd4d3d00cf
CVE ID: CVE-2022-0721 State: PUBLISHED Published: 2022-02-23T10:30:11 Last Updated: 2024-08-02T23:40:03.483Z Severity: HIGH (CVSS 8.8 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-215 Description: Insertion of Sensitive Information Into Debugging Code in GitHub repository microweber/microweber prior to 1.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/ae267d39-9750-4c69-be8b-4f915da089fb - https://github.com/microweber/microweber/commit/b12e1a490c79460bff019f34b2e17112249b16ec
CVE ID: CVE-2022-0722 State: PUBLISHED Published: 2022-06-27T10:50:10 Last Updated: 2024-08-02T23:40:03.445Z Severity: MEDIUM (CVSS 4.8 CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: ionicabizau Products: ionicabizau/parse-url Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/ionicabizau/parse-url/commit/21c72ab9412228eea753e2abc48f8962707b1fe3 - https://huntr.dev/bounties/2490ef6d-5577-4714-a4dd-9608251b4226
CVE ID: CVE-2022-0723 State: PUBLISHED Published: 2022-02-26T10:45:10 Last Updated: 2024-08-02T23:40:03.541Z Severity: HIGH (CVSS 8 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-79 Description: Cross-site Scripting (XSS) - Reflected in GitHub repository microweber/microweber prior to 1.2.11. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/16b0547b-1bb3-493c-8a00-5b6a11fca1c5 - https://github.com/microweber/microweber/commit/15e519a86e4b24526abaf9e6dc81cb1af86843a5
CVE ID: CVE-2022-0724 State: PUBLISHED Published: 2022-02-23T10:45:11 Last Updated: 2024-08-02T23:40:03.544Z Severity: CRITICAL (CVSS 9.1 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) Vendors: microweber Products: microweber/microweber Problem Types: CWE-922 Description: Insecure Storage of Sensitive Information in GitHub repository microweber/microweber prior to 1.3. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/0cdc4a29-dada-4264-b326-8b65b4f11062 - https://github.com/microweber/microweber/commit/b592c86d2b927c0cae5b73b87fb541f25e777aa3
CVE ID: CVE-2022-0725 State: PUBLISHED Published: 2022-03-07T14:00:21 Last Updated: 2024-08-02T23:40:03.535Z Vendors: n/a Products: keepass Problem Types: CWE-200 Description: A flaw was found in keepass. The vulnerability occurs due to logging the plain text passwords in system log and leads to an Information Exposure vulnerability. This flaw allows an attacker to interact and read sensitive passwords and logs. Additional Analyst Notes: - CVE Program Container: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2052696
CVE ID: CVE-2022-0726 State: PUBLISHED Published: 2022-02-23T00:00:00 Last Updated: 2024-08-02T23:40:03.515Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: chocobozzz Products: chocobozzz/peertube Problem Types: CWE-862 Description: Missing Authorization in GitHub repository chocobozzz/peertube prior to 4.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/chocobozzz/peertube/commit/6ea9295b8f5dd7cc254202a79aad61c666cc4259 - https://huntr.dev/bounties/8928ab08-7fcb-475e-8da7-18e8412c1ac3
CVE ID: CVE-2022-0727 State: PUBLISHED Published: 2022-02-23T13:20:10 Last Updated: 2024-08-02T23:40:03.260Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: chocobozzz Products: chocobozzz/peertube Problem Types: CWE-284 Description: Improper Access Control in GitHub repository chocobozzz/peertube prior to 4.1.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/d1faa10f-0640-480c-bb52-089adb351e6e - https://github.com/chocobozzz/peertube/commit/6ea9295b8f5dd7cc254202a79aad61c666cc4259
CVE ID: CVE-2022-0728 State: PUBLISHED Published: 2022-04-11T14:40:49 Last Updated: 2024-08-02T23:40:03.539Z Vendors: Unknown Products: Easy Smooth Scroll Links Problem Types: CWE-79 Description: The Easy Smooth Scroll Links WordPress plugin before 2.23.1 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/c6d3d308-4bf1-493f-86e9-dd623526e3c6
CVE ID: CVE-2022-0729 State: PUBLISHED Published: 2022-02-23T00:00:00 Last Updated: 2024-08-02T23:40:03.531Z Severity: HIGH (CVSS 7.8 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-823 Description: Use of Out-of-range Pointer Offset in GitHub repository vim/vim prior to 8.2.4440. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/f3f3d992-7bd6-4ee5-a502-ae0e5f8016ea - https://github.com/vim/vim/commit/6456fae9ba8e72c74b2c0c499eaf09974604ff30 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/ - https://lists.fedoraproject.o
ist/package-announce%40lists.fedoraproject.org/message/7ZLEHVP4LNAGER4ZDGUDS5V5YVQD6INF/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HBUYQBZ6GWAWJRWP7AODJ4KHW5BCKDVP/ - https://lists.debian.org/debian-lts-announce/2022/03/msg00018.html - https://security.gentoo.org/glsa/202208-32 - https://support.apple.com/kb/HT213488 - http://seclists.org/fulldisclosure/2022/Oct/41 - http://seclists.org/fulldisclosure/2022/Oct/28 - https://lists.debian.org/debian-lts-announce/2022/11/msg00009.html
CVE ID: CVE-2022-0730 State: PUBLISHED Published: 2022-03-03T00:00:00 Last Updated: 2024-08-02T23:40:03.539Z Vendors: n/a Products: Cati Problem Types: CWE-287 Description: Under certain ldap conditions, Cacti authentication can be bypassed with certain credential types. Additional Analyst Notes: - CVE Program Container: References: - https://github.com/Cacti/cacti/issues/4562 - https://lists.debian.org/debian-lts-announce/2022/03/msg00038.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZJERS4NYIGJUXEGT6ATUQA4CBYBRDLRA/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVOALVZSCBFNOAAZVHT
/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVOALVZSCBFNOAAZVHTJFSFB7UDSNYQ2/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZH67CCORDEYFG7NL7G6UH47PAV2PU7BA/ - https://www.debian.org/security/2022/dsa-5298 - https://lists.debian.org/debian-lts-announce/2022/12/msg00039.html
CVE ID: CVE-2022-0731 State: PUBLISHED Published: 2022-02-23T18:35:12 Last Updated: 2024-08-02T23:40:03.543Z Severity: MEDIUM (CVSS 5.4 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) Vendors: dolibarr Products: dolibarr/dolibarr Problem Types: CWE-284 Description: Improper Access Control (IDOR) in GitHub repository dolibarr/dolibarr prior to 16.0. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e242ab4e-fc70-4b2c-a42d-5b3ee4895de8 - https://github.com/dolibarr/dolibarr/commit/209ab708d4b65fbd88ba4340d60b7822cb72651a
CVE ID: CVE-2022-0732 State: PUBLISHED Published: 2022-02-24T16:10:11.015535Z Last Updated: 2024-09-16T18:13:36.167Z Vendors: 1Byte Products: Copy9, FoneTracker, iSpyoo, GuestSpy, TheSpyApp, ExactSpy, SecondClone, The Truth Spy, MxSpy Problem Types: CWE-284 Description: The backend infrastructure shared by multiple mobile device monitoring services does not adequately authenticate or authorize API requests, creating an IDOR (Insecure Direct Object Reference) vulnerability. Additional Analyst Notes: - CVE Program Container: References: - https://www.kb.cert.org/vuls/id/229438 - https://cwe.mitre.org/data/definitions/284.html - https://techcrunch.com/2022/02/22/stalkerware-network-spilling-dat
8 - https://cwe.mitre.org/data/definitions/284.html - https://techcrunch.com/2022/02/22/stalkerware-network-spilling-data/ - https://kb.cert.org/vuls/id/229438
CVE ID: CVE-2022-0734 State: PUBLISHED Published: 2022-05-24T02:10:12 Last Updated: 2024-08-02T23:40:03.547Z Severity: MEDIUM (CVSS 5.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) Vendors: Zyxel Products: USG/ZyWALL series firmware, USG FLEX series firmware, ATP series firmware, VPN series firmware Problem Types: CWE-79 Description: A cross-site scripting vulnerability was identified in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.35 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.35 through 5.20, and VPN series firmware versions 4.35 through 5.20, that could allow an attacker to obtain some information stored in the user'
series firmware versions 4.35 through 5.20, that could allow an attacker to obtain some information stored in the user's browser, such as cookies or session tokens, via a malicious script. Additional Analyst Notes: - CVE Program Container: References: - https://www.zyxel.com/support/multiple-vulnerabilities-of-firewalls-AP-controllers-and-APs.shtml
CVE ID: CVE-2022-0735 State: PUBLISHED Published: 2022-03-28T18:52:59 Last Updated: 2024-08-02T23:40:03.557Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: GitLab Products: GitLab Problem Types: Information exposure in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions starting from 14.7 before 14.7.4, all versions starting from 14.8 before 14.8.2. An unauthorised user was able to steal runner registration tokens through an information disclosure vulnerability using quick actions commands. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/
ility using quick actions commands. Additional Analyst Notes: - CVE Program Container: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/353529 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-0735.json
CVE ID: CVE-2022-0736 State: PUBLISHED Published: 2022-02-23T08:45:13 Last Updated: 2024-08-02T23:40:03.521Z Severity: HIGH (CVSS 8.2 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) Vendors: mlflow Products: mlflow/mlflow Problem Types: CWE-377 Description: Insecure Temporary File in GitHub repository mlflow/mlflow prior to 1.23.1. Additional Analyst Notes: - CVE Program Container: References: - https://huntr.dev/bounties/e5384764-c583-4dec-a1d8-4697f4e12f75 - https://github.com/mlflow/mlflow/commit/61984e6843d2e59235d82a580c529920cd8f3711
CVE ID: CVE-2022-0737 State: PUBLISHED Published: 2022-04-18T17:10:33 Last Updated: 2024-08-02T23:40:03.545Z Vendors: Unknown Products: Text Hover Problem Types: CWE-79 Description: The Text Hover WordPress plugin before 4.2 does not sanitize and escape the text to hover, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/a5c9fa61-e6f1-4460-84fe-977a203bd4bc