Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-25841 State: PUBLISHED Published: 2022-08-18T19:56:28.000Z Last Updated: 2025-05-05T16:23:14.868Z Vendors: n/a Products: version Problem Types: escalation of privilege Description: Uncontrolled search path elements in the Intel(R) Datacenter Group Event Android application, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00678.html
CVE ID: CVE-2022-25842 State: PUBLISHED Published: 2022-05-01T15:25:39.245954Z Last Updated: 2024-09-17T00:56:48.532Z Severity: MEDIUM (CVSS 6.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:L/E:P) Vendors: n/a Products: com.alibaba.oneagent:one-java-agent-plugin Problem Types: Arbitrary File Write via Archive Extraction (Zip Slip) Description: All versions of package com.alibaba.oneagent:one-java-agent-plugin are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) using a specially crafted archive that holds directory traversal filenames (e.g. ../../evil.exe). The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call the
. The attacker can overwrite executable files and either invoke them remotely or wait for the system or user to call them, thus achieving remote command execution on the victim’s machine. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMALIBABAONEAGENT-2407874 - https://github.com/alibaba/one-java-agent/blob/1f399a2299a8a409d15ea6111a7098629b8f1050/one-java-agent-plugin/src/main/java/com/alibaba/oneagent/utils/IOUtils.java - https://github.com/alibaba/one-java-agent/pull/29 - https://github.com/alibaba/one-java-agent/pull/29/commits/359603b63fc6c59d8b57e061c171954bab3433bf
CVE ID: CVE-2022-25844 State: PUBLISHED Published: 2022-05-01T15:25:32.752Z Last Updated: 2025-11-03T19:26:56.516Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:F) Vendors: n/a Products: angular Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package angular after 1.7.0 are vulnerable to Regular Expression Denial of Service (ReDoS) by providing a custom locale rule that makes it possible to assign the parameter in posPre: ' '.repeat() of NUMBER_FORMATS.PATTERNS[1].posPre with a very high value. **Note:** 1) This package has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher. Additional Analyst
ge has been deprecated and is no longer maintained. 2) The vulnerable versions are 1.7.0 and higher. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-ANGULAR-2772735 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2772736 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2772737 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2772738 - https://stackblitz.com/edit/angularjs-material-blank-zvtdvb - https://security.netapp.com/advisory/ntap-20220629-0009/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3/ - https://lists.fedoraproject.org/archives/list/packa
0lists.fedoraproject.org/message/2WUSPYOTOMAZPDEFPWPSCSPMNODRDKK3/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7LNAKCNTVBIHWAUT3FKWV5N67PQXSZOO/
CVE ID: CVE-2022-25845 State: PUBLISHED Published: 2022-06-10T20:05:40.814063Z Last Updated: 2024-09-16T23:36:49.600Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: com.alibaba:fastjson Problem Types: Deserialization of Untrusted Data Description: The package com.alibaba:fastjson before 1.2.83 are vulnerable to Deserialization of Untrusted Data by bypassing the default autoType shutdown restrictions, which is possible under certain conditions. Exploiting this vulnerability allows attacking remote servers. Workaround: If upgrading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode). Additiona
rading is not possible, you can enable [safeMode](https://github.com/alibaba/fastjson/wiki/fastjson_safemode). Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JAVA-COMALIBABA-2859222 - https://www.ddosi.org/fastjson-poc/ - https://github.com/alibaba/fastjson/commit/8f3410f81cbd437f7c459f8868445d50ad301f15 - https://github.com/alibaba/fastjson/commit/35db4adad70c32089542f23c272def1ad920a60d - https://github.com/alibaba/fastjson/wiki/security_update_20220523 - https://github.com/alibaba/fastjson/releases/tag/1.2.83 - https://www.oracle.com/security-alerts/cpujul2022.html
CVE ID: CVE-2022-25847 State: PUBLISHED Published: 2023-01-25T05:00:01.656Z Last Updated: 2025-04-01T14:55:17.127Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: serve-lite Problem Types: CWE-79 Description: All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renders a file listing of all of its contents with links that include the actual file names without any sanitization or output encoding. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SERVELITE-3149915 - https://gist.github.c
: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SERVELITE-3149915 - https://gist.github.com/lirantal/52debd25284726fcc2eaed9c7512975c
CVE ID: CVE-2022-25848 State: PUBLISHED Published: 2022-11-29T16:50:11.226Z Last Updated: 2025-04-24T17:53:10.185Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: static-dev-server Problem Types: Directory Traversal Description: This affects all versions of package static-dev-server. This is because when paths from users to the root directory are joined, the assets for the path accessed are relative to that of the root directory. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-STATICDEVSERVER-3149917 - https://gist.github.com/lirantal/5550bcd0bdf92c1b56fbb20e141fe5bd
CVE ID: CVE-2022-25849 State: PUBLISHED Published: 2022-10-26T05:05:09.395Z Last Updated: 2025-05-09T19:09:38.117Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: joyqi/hyper-down Problem Types: Cross-site Scripting (XSS) Description: The package joyqi/hyper-down from 0.0.0 are vulnerable to Cross-site Scripting (XSS) because the module of parse markdown does not filter the href attribute very well. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-PHP-JOYQIHYPERDOWN-2953544
CVE ID: CVE-2022-25850 State: PUBLISHED Published: 2022-05-01T15:20:09.959214Z Last Updated: 2024-09-16T22:36:02.981Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P) Vendors: n/a Products: github.com/hoppscotch/proxyscotch Problem Types: Server-side Request Forgery (SSRF) Description: The package github.com/hoppscotch/proxyscotch before 1.0.0 are vulnerable to Server-side Request Forgery (SSRF) when interceptor mode is set to proxy. It occurs when an HTTP request is made by a backend server to an untrusted URL submitted by a user. It leads to a leakage of sensitive information from the server. Additional Analyst Notes: - CVE Program Container: References: - https:/
akage of sensitive information from the server. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMHOPPSCOTCHPROXYSCOTCH-2435228 - https://github.com/hoppscotch/proxyscotch/commit/de67380f62f907f201d75854b76024ba4885fab7
CVE ID: CVE-2022-25851 State: PUBLISHED Published: 2022-06-10T20:05:52.826505Z Last Updated: 2024-09-16T18:55:23.053Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: jpeg-js Problem Types: Denial of Service (DoS) Description: The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-JPEGJS-2859218 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2860295 - https://github.com/jpeg-js/jpeg-js/issues/105 - https://github.com/jpeg-js/jpeg-js/pull/106/ -
A-ORGWEBJARSNPM-2860295 - https://github.com/jpeg-js/jpeg-js/issues/105 - https://github.com/jpeg-js/jpeg-js/pull/106/ - https://github.com/jpeg-js/jpeg-js/commit/9ccd35fb5f55a6c4f1902ac5b0f270f675750c27
CVE ID: CVE-2022-25852 State: PUBLISHED Published: 2022-06-17T20:05:29.137642Z Last Updated: 2024-09-17T01:51:47.069Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: pg-native, libpq Problem Types: Denial of Service (DoS) Description: All versions of package pg-native; all versions of package libpq are vulnerable to Denial of Service (DoS) when the addons attempt to cast the second argument to an array and fail. This happens for every non-array argument passed. **Note:** pg-native is a mere binding to npm's libpq library, which in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may t
ich in turn has the addons and bindings to the actual C libpq library. This means that problems found in pg-native may transitively impact npm's libpq. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-PGNATIVE-2392365 - https://snyk.io/vuln/SNYK-JS-LIBPQ-2392366
CVE ID: CVE-2022-25853 State: PUBLISHED Published: 2023-02-06T05:00:01.967Z Last Updated: 2025-03-25T18:10:39.844Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: semver-tags Problem Types: CWE-78 Description: All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SEMVERTAGS-3175612 - https://github.com/jtrussell/semver-tags/blob/db1ba680bafed0d51e1bb36bd38f2c5439fe8b00/lib/get-tags.js%23L21
CVE ID: CVE-2022-25854 State: PUBLISHED Published: 2022-04-29T20:00:19.691641Z Last Updated: 2024-09-17T04:19:33.050Z Severity: MEDIUM (CVSS 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: n/a Products: @yaireo/tagify Problem Types: Cross-site Scripting (XSS) Description: This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358 - https://github.com/yairEO/tagify/issues/988 - https://github.com/yairEO/tagify
yk.io/vuln/SNYK-JS-YAIREOTAGIFY-2404358 - https://github.com/yairEO/tagify/issues/988 - https://github.com/yairEO/tagify/releases/tag/v4.9.8 - https://github.com/yairEO/tagify/commit/198c0451fad188390390395ccfc84ab371def4c7 - https://bsg.tech/blog/cve-2022-25854-stored-xss-in-yaireo-tagify-npm-module/
CVE ID: CVE-2022-25855 State: PUBLISHED Published: 2023-02-06T05:00:01.170Z Last Updated: 2025-03-25T18:28:05.043Z Severity: HIGH (CVSS 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: create-choo-app3 Problem Types: CWE-78 Description: All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-CREATECHOOAPP3-3157951
CVE ID: CVE-2022-25856 State: PUBLISHED Published: 2022-06-17T20:00:17.630029Z Last Updated: 2024-09-17T04:24:21.034Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Vendors: n/a Products: github.com/argoproj/argo-events/sensors/artifacts Problem Types: Directory Traversal Description: The package github.com/argoproj/argo-events/sensors/artifacts before 1.7.1 are vulnerable to Directory Traversal in the (g *GitArtifactReader).Read() API in git.go. This could allow arbitrary file reads if the GitArtifactReader is provided a pathname containing a symbolic link or an implicit directory name such as ... Additional Analyst Notes: - CVE Program Container: References: - https
ic link or an implicit directory name such as ... Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMARGOPROJARGOEVENTSSENSORSARTIFACTS-2864522 - https://github.com/argoproj/argo-events/commit/d0f66dbce78bc31923ca057b20fc722aa24ca961 - https://github.com/argoproj/argo-events/issues/1947
CVE ID: CVE-2022-25857 State: PUBLISHED Published: 2022-08-30T05:05:11.588462Z Last Updated: 2024-09-16T21:57:41.551Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a Products: org.yaml:snakeyaml Problem Types: Denial of Service (DoS) Description: The package org.yaml:snakeyaml from 0 and before 1.31 are vulnerable to Denial of Service (DoS) due missing to nested depth limitation for collections. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JAVA-ORGYAML-2806360 - https://bitbucket.org/snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174 - https://github.com/snakeyaml/snakeyaml/commit/fc3
snakeyaml/snakeyaml/commits/fc300780da21f4bb92c148bc90257201220cf174 - https://github.com/snakeyaml/snakeyaml/commit/fc300780da21f4bb92c148bc90257201220cf174 - https://bitbucket.org/snakeyaml/snakeyaml/issues/525 - https://lists.debian.org/debian-lts-announce/2022/10/msg00001.html - https://security.netapp.com/advisory/ntap-20240315-0010/
CVE ID: CVE-2022-25858 State: PUBLISHED Published: 2022-07-15T20:00:19.590096Z Last Updated: 2024-09-16T19:45:47.956Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: terser Problem Types: Regular Expression Denial of Service (ReDoS) Description: The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-TERSER-2806366 - https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722 - https://github.com/terser/terser/blob/master/lib/compress/evaluate.js
s://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949722 - https://github.com/terser/terser/blob/master/lib/compress/evaluate.js%23L135 - https://github.com/terser/terser/commit/a4da7349fdc92c05094f41d33d06d8cd4e90e76b - https://github.com/terser/terser/commit/d8cc5691be980d663c29cc4d5ce67e852d597012
CVE ID: CVE-2022-25860 State: PUBLISHED Published: 2023-01-24T05:00:02.399Z Last Updated: 2025-04-01T15:29:18.377Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: simple-git Problem Types: CWE-94 Description: Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemote() methods, due to improper input sanitization. This vulnerability exists due to an incomplete fix of [CVE-2022-25912](https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3112221). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNY
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://security.snyk.io/vuln/SNYK-JS-SIMPLEGIT-3177391 - https://github.com/steveukx/git-js/pull/881/commits/95459310e5b8f96e20bb77ef1a6559036b779e13 - https://github.com/steveukx/git-js/commit/ec97a39ab60b89e870c5170121cd9c1603cc1951
CVE ID: CVE-2022-25862 State: PUBLISHED Published: 2022-05-13T20:05:11.030472Z Last Updated: 2024-09-16T19:20:38.214Z Severity: MEDIUM (CVSS 4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L/E:P) Vendors: n/a Products: sds Problem Types: Prototype Pollution Description: This affects the package sds from 0.0.0. The library could be tricked into adding or modifying properties of the Object.prototype by abusing the set function located in js/set.js. **Note:** This vulnerability derives from an incomplete fix to [CVE-2020-7618](https://security.snyk.io/vuln/SNYK-JS-SDS-564123) Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SDS-2385944 - https://github.
itional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-SDS-2385944 - https://github.com/monsterkodi/sds/blob/master/js/set.js
CVE ID: CVE-2022-25863 State: PUBLISHED Published: 2022-06-10T20:00:19.275131Z Last Updated: 2024-09-17T00:31:34.621Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:P) Vendors: n/a Products: gatsby-plugin-mdx Problem Types: Deserialization of Untrusted Data Description: The package gatsby-plugin-mdx before 2.14.1, from 3.0.0 and before 3.15.2 are vulnerable to Deserialization of Untrusted Data when passing input through to the gray-matter package, due to its default configurations that are missing input sanitization. Exploiting this vulnerability is possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / R
possible when passing input in both webpack (MDX files in src/pages or MDX file imported as a component in frontend / React code) and data mode (querying MDX nodes via GraphQL). Workaround: If an older version of gatsby-plugin-mdx must be used, input passed into the plugin should be sanitized ahead of processing. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-GATSBYPLUGINMDX-2405699 - https://drive.google.com/file/d/1EoCzbwTWOM8-fjvwMbH3bqcZ2iKksxTW/view?usp=sharing - https://github.com/gatsbyjs/gatsby/pull/35830 - https://github.com/gatsbyjs/gatsby/pull/35830/commits/f214eb0694c61e348b2751cecd1aace2046bc46e
CVE ID: CVE-2022-25864 State: PUBLISHED Published: 2023-08-11T02:37:14.176Z Last Updated: 2024-10-10T18:14:10.104Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel(R) oneMKL software Problem Types: escalation of privilege, CWE-427 Description: Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - http://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00873.html
CVE ID: CVE-2022-25865 State: PUBLISHED Published: 2022-05-13T20:00:19.528859Z Last Updated: 2024-09-16T17:19:17.377Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: workspace-tools Problem Types: Command Injection Description: The package workspace-tools before 0.18.4 are vulnerable to Command Injection via git argument injection. When calling the fetchRemoteBranch(remote: string, remoteBranch: string, cwd: string) function, both the remote and remoteBranch parameters are passed to the git fetch subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. Additional Analyst Notes: - C
itional flags can be set. The additional flags can be used to perform a command injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-JS-WORKSPACETOOLS-2421201 - https://github.com/microsoft/workspace-tools/commit/9bc7e65ce497f87e1f363fd47b8f802f3d3cd978 - https://github.com/microsoft/workspace-tools/pull/103
CVE ID: CVE-2022-25866 State: PUBLISHED Published: 2022-04-25T17:10:10.912749Z Last Updated: 2024-09-16T16:38:31.811Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P) Vendors: n/a Products: czproject/git-php Problem Types: Command Injection Description: The package czproject/git-php before 4.0.3 are vulnerable to Command Injection via git argument injection. When calling the isRemoteUrlReadable($url, array $refs = NULL) function, both the url and refs parameters are passed to the git ls-remote subcommand in a way that additional flags can be set. The additional flags can be used to perform a command injection. Additional Analyst Notes: - CVE Program Container: Refer
he additional flags can be used to perform a command injection. Additional Analyst Notes: - CVE Program Container: References: - https://snyk.io/vuln/SNYK-PHP-CZPROJECTGITPHP-2421349 - https://github.com/czproject/git-php/commit/5e82d5479da5f16d37a915de4ec55e1ac78de733 - https://github.com/czproject/git-php/releases/tag/v4.0.3
CVE ID: CVE-2022-25867 State: PUBLISHED Published: 2022-08-02T13:28:24.215901Z Last Updated: 2024-09-16T22:25:32.958Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P) Vendors: n/a Products: io.socket:socket.io-client Problem Types: NULL Pointer Dereference Description: The package io.socket:socket.io-client before 2.0.1 are vulnerable to NULL Pointer Dereference when parsing a packet with with invalid payload format. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JAVA-IOSOCKET-2949738 - https://github.com/socketio/socket.io-client-java/issues/508%23issuecomment-1179817361 - https://github.com/socketio/socket.io-cl
ithub.com/socketio/socket.io-client-java/issues/508%23issuecomment-1179817361 - https://github.com/socketio/socket.io-client-java/commit/e8ffe9d1383736f6a21090ab959a2f4fa5a41284 - https://github.com/socketio/socket.io-client-java/commit/8664499b6f31154f49783531f778dac5387b766b - https://github.com/socketio/socket.io-client-java/releases/tag/socket.io-client-2.0.1
CVE ID: CVE-2022-25868 State: REJECTED Published: N/A Last Updated: 2025-05-28T16:31:33.185Z Description: No description available.
CVE ID: CVE-2022-25869 State: PUBLISHED Published: 2022-07-15T20:02:02.727939Z Last Updated: 2025-07-28T09:59:04.148Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P) Vendors: n/a Products: angular, org.webjars.npm:angular, org.webjars.bower:angular, org.webjars.bowergithub.angular:angular, AngularJS.Core, angularjs Problem Types: CWE-79 Description: All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements. Additional Analyst Notes: - CVE Program C
Internet Explorer browser, which allows interpolation of <textarea> elements. Additional Analyst Notes: - CVE Program Container: References: - https://security.snyk.io/vuln/SNYK-JS-ANGULAR-2949781 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2949782 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-2949783 - https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBANGULAR-2949784 - https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJSCORE-6084031 - https://security.snyk.io/vuln/SNYK-DOTNET-ANGULARJS-10771617 - https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869
CVE ID: CVE-2022-25870 State: REJECTED Published: N/A Last Updated: 2025-05-28T16:38:57.308Z Description: No description available.