Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-4118 State: PUBLISHED Published: 2023-05-08T13:58:20.404Z Last Updated: 2025-01-31T21:46:32.433Z Vendors: Unknown Products: Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop Problem Types: CWE-89 SQL Injection Description: The Bitcoin / AltCoin Payment Gateway for WooCommerce & Multivendor store / shop WordPress plugin through 1.7.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by authenticated users Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/2839ff82-7d37-4392-8fa3-d490680d42c4
CVE ID: CVE-2022-4119 State: PUBLISHED Published: 2023-01-02T21:49:21.445Z Last Updated: 2025-04-10T15:15:33.191Z Vendors: Unknown Products: Image Optimizer, Resizer and CDN Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The Image Optimizer, Resizer and CDN WordPress plugin before 6.8.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/11040133-c134-4f96-8421-edd04901ed
am Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/11040133-c134-4f96-8421-edd04901ed0d
CVE ID: CVE-2022-4120 State: PUBLISHED Published: 2022-12-26T12:28:19.897Z Last Updated: 2025-04-14T13:24:34.260Z Vendors: Unknown Products: Stop Spammers Security | Block Spam Users, Comments, Forms Problem Types: CWE-502 Deserialization of Untrusted Data Description: The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2022.6 passes base64 encoded user input to the unserialize() PHP function when CAPTCHA are used as second challenge, which could lead to PHP Object injection if a plugin installed on the blog has a suitable gadget chain Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/
itional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/e8bb79db-ef77-43be-b449-4c4b5310eedf
CVE ID: CVE-2022-4121 State: PUBLISHED Published: 2023-01-17T00:00:00.000Z Last Updated: 2025-11-03T19:27:35.892Z Vendors: n/a Products: libetpan Problem Types: CWE-476 Description: In libetpan a null pointer dereference in mailimap_mailbox_data_status_free in low-level/imap/mailimap_types.c was found that could lead to a remote denial of service or other potential consequences. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://github.com/dinhvh/libetpan/issues/420 - https://github.com/dinhvh/libetpan/commit/5c9eb6b6ba64c4eb927d7a902317410181aacbba
CVE ID: CVE-2022-4122 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-22T20:30:06.788Z Vendors: n/a Products: podman Problem Types: CWE-59 Description: A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2144983 - https://github.com/containers/podman/pull/16315
CVE ID: CVE-2022-4123 State: PUBLISHED Published: 2022-12-08T00:00:00.000Z Last Updated: 2025-04-22T20:33:21.916Z Vendors: n/a Products: podman Problem Types: CWE-23 Description: A flaw was found in Buildah. The local path and the lowest subdirectory may be disclosed due to incorrect absolute path traversal, resulting in an impact to confidentiality. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2144989
CVE ID: CVE-2022-4124 State: PUBLISHED Published: 2022-12-19T13:41:48.505Z Last Updated: 2025-04-14T18:14:00.896Z Vendors: Unknown Products: Popup Manager Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF checks when deleting popups, which could allow unauthenticated users to delete them Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/60786bf8-c0d7-4d80-b189-866aba79bce2
CVE ID: CVE-2022-4125 State: PUBLISHED Published: 2022-12-19T13:41:50.163Z Last Updated: 2024-08-03T01:27:54.511Z Vendors: Unknown Products: Popup Manager Problem Types: CWE-79 Cross-Site Scripting (XSS), CWE-352 Cross-Site Request Forgery (CSRF) Description: The Popup Manager WordPress plugin through 1.6.6 does not have authorisation and CSRF check when creating/updating popups, and is missing sanitisation as well as escaping, which could allow unauthenticated attackers to create arbitrary popups and add Stored XSS payloads as well Additional Analyst Notes: - CVE Program Container: References: - https://wpscan.com/vulnerability/7862084a-2821-4ef1-8d01-c9c8b3f28b05
CVE ID: CVE-2022-4126 State: PUBLISHED Published: 2023-03-27T04:46:02.128Z Last Updated: 2025-02-19T16:26:56.266Z Severity: CRITICAL (CVSS 9.6 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Vendors: ABB Products: RCCMD Problem Types: CWE-1393 Description: Use of Default Password vulnerability in ABB RCCMD on Windows, Linux, MacOS allows Try Common or Default Usernames and Passwords.This issue affects RCCMD: before 4.40 230207. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://search.abb.com/library/Download.aspx?DocumentID=2CMT006099_EN&LanguageCode=en&DocumentPartId=&Action=Launch
CVE ID: CVE-2022-4127 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-14T18:08:33.221Z Vendors: n/a Products: Linux kernel (io_uring) Problem Types: CWE-476 Description: A NULL pointer dereference issue was discovered in the Linux kernel in io_files_update_with_index_alloc. A local user could use this flaw to potentially crash the system causing a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/all/d5a19c1e-9968-e22e-5917-c3139c5e7e89%40kernel.dk/ - https://github.com/torvalds/linux/commit/d785a773bed966a75ca1f11d108ae1897189975b
CVE ID: CVE-2022-4128 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-14T18:08:50.265Z Vendors: n/a Products: Linux kernel (mptcp) Problem Types: CWE-476 Description: A NULL pointer dereference issue was discovered in the Linux kernel in the MPTCP protocol when traversing the subflow list at disconnect time. A local user could use this flaw to potentially crash the system causing a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/netdev/20220708233610.410786-2-mathew.j.martineau%40linux.intel.com/ - https://github.com/torvalds/linux/commit/5c835bb142d4
CVE ID: CVE-2022-4129 State: PUBLISHED Published: 2022-11-28T00:00:00.000Z Last Updated: 2025-04-14T18:09:26.247Z Vendors: n/a Products: Linux kernel (l2tp) Problem Types: CWE-667 Description: A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can lead to a race condition and NULL pointer dereference. A local user could use this flaw to potentially crash the system causing a denial of service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://lore.kernel.org/all/20221114191619.124659-1-jakub%40cloudflare.com/t - https://lore.kernel.org/netdev/20221121085426.21315-1-jakub%40cloudfl
20221114191619.124659-1-jakub%40cloudflare.com/t - https://lore.kernel.org/netdev/20221121085426.21315-1-jakub%40cloudflare.com/t - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AM5KFIE6JNZXHBA5A2KYDZAT3MEX2B67/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7X5SPXMXXFANDASPCKER2JIQO2F3UHCP/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JOKXNIM2R4FQCDRQV67UMAY6EBC72QFG/ - https://lists.debian.org/debian-lts-announce/2023/05/msg00005.html
CVE ID: CVE-2022-4130 State: PUBLISHED Published: 2022-12-16T00:00:00.000Z Last Updated: 2025-04-14T18:13:22.554Z Vendors: n/a Products: Satellite Server Problem Types: Blind Site-to-Site Request Forgery Description: A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request of specific resources in the server. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2145254
CVE ID: CVE-2022-4131 State: PUBLISHED Published: 2023-01-12T00:00:00.000Z Last Updated: 2025-04-08T16:27:37.240Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) Vendors: GitLab Products: GitLab Problem Types: Uncontrolled resource consumption in GitLab Description: An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before 15.6.4, all versions starting from 15.7 before 15.7.2. An attacker may cause Denial of Service on a GitLab instance by exploiting a regex issue in how the application parses user agents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: Refe
how the application parses user agents. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/383598 - https://hackerone.com/reports/1772063 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4131.json
CVE ID: CVE-2022-4132 State: PUBLISHED Published: 2023-10-04T11:26:11.191Z Last Updated: 2024-09-19T14:41:40.138Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: n/a, Red Hat, Fedora Products: jss, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat JBoss Web Server 3, Red Hat JBoss Web Server 5, Extra Packages for Enterprise Linux, Fedora Problem Types: CWE-401 Description: A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting the login page). Additional Analyst Notes: - CVE Program Contain
t DoS vector if configured that way (repeatedly hitting the login page). Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-4132 - https://bugzilla.redhat.com/show_bug.cgi?id=2147372
CVE ID: CVE-2022-4133 State: REJECTED Published: N/A Last Updated: 2023-02-10T21:38:16.503Z Description: No description available.
CVE ID: CVE-2022-4134 State: PUBLISHED Published: 2023-03-06T00:00:00.000Z Last Updated: 2025-03-06T19:53:42.138Z Vendors: n/a Products: openstack Problem Types: CWE-829 Description: A flaw was found in openstack-glance. This issue could allow a remote, authenticated attacker to tamper with images, compromising the integrity of virtual machines created using these modified images. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2147462 - https://bugs.launchpad.net/glance/+bug/1990157 - https://wiki.openstack.org/wiki/OSSN/OSSN-0090
CVE ID: CVE-2022-4135 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-10-21T23:15:30.804Z Vendors: Google Products: Chrome Problem Types: Heap buffer overflow Description: Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High) Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html - https://crbug.com/1392715 - https://security.gentoo.org/glsa/202305-10
CVE ID: CVE-2022-4136 State: PUBLISHED Published: 2022-11-24T00:00:00.000Z Last Updated: 2025-04-14T17:48:17.480Z Severity: HIGH (CVSS 8.6 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L) Vendors: qmpaas Products: qmpaas/leadshop Problem Types: CWE-749 Description: Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/fe418ae1-7c80-4d91-8a5a-923d60ba78c3 - https://github.com/qmpaas/leadshop/commit/f27e9ca5c93eaadda1097396b65c234b16186d67
CVE ID: CVE-2022-4137 State: PUBLISHED Published: 2023-09-25T19:17:55.522Z Last Updated: 2024-08-03T01:27:54.542Z Severity: HIGH (CVSS 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Vendors: Red Hat Products: Red Hat Single Sign-On 7, Red Hat Single Sign-On 7.6 for RHEL 7, Red Hat Single Sign-On 7.6 for RHEL 8, Red Hat Single Sign-On 7.6 for RHEL 9 Problem Types: CWE-81 Description: A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable.
nto a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker. Additional Analyst Notes: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2023:1043 - https://access.redhat.com/errata/RHSA-2023:1044 - https://access.redhat.com/errata/RHSA-2023:1045 - https://access.redhat.com/errata/RHSA-2023:1049 - https://access.redhat.com/security/cve/CVE-2022-4137 - https://bugzilla.redhat.com/show_bug.cgi?id=2148496
CVE ID: CVE-2022-4138 State: PUBLISHED Published: 2023-02-13T00:00:00.000Z Last Updated: 2025-03-21T19:13:19.474Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Cross-site request forgery (csrf) in GitLab Description: A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from 15.7 before 15.7.6, and all versions starting from 15.8 before 15.8.1. An attacker could take over a project if an Owner or Maintainer uploads a file to a malicious project. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://
a malicious project. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/383709 - https://hackerone.com/reports/1778009 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4138.json
CVE ID: CVE-2022-4139 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T15:43:43.668Z Vendors: n/a Products: kernel Problem Types: CWE-281 Description: An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or data leaks. This flaw could allow a local user to crash the system or escalate their privileges on the system. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2147572 - https://www.openwall.com/lists/oss-security/2022/11/30/1 - https://security.netapp.com/advisory/ntap-20230309-0004/
CVE ID: CVE-2022-4140 State: PUBLISHED Published: 2023-01-02T21:49:12.877Z Last Updated: 2025-04-10T19:11:34.151Z Vendors: Unknown Products: Welcart e-Commerce Problem Types: CWE-552 Files or Directories Accessible to External Parties Description: The Welcart e-Commerce WordPress plugin before 2.8.5 does not validate user input before using it to output the content of a file, which could allow unauthenticated attacker to read arbitrary files on the server Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/0d649a7e-3334-48f7-abca-fff0856e12c7
CVE ID: CVE-2022-4141 State: PUBLISHED Published: 2022-11-25T00:00:00.000Z Last Updated: 2025-11-03T20:35:07.051Z Severity: HIGH (CVSS 7.3 CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: vim Products: vim/vim Problem Types: CWE-122 Description: Heap based buffer overflow in vim/vim 9.0.0946 and below by allowing an attacker to CTRL-W gf in the expression used in the RHS of the substitute command. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://huntr.dev/bounties/20ece512-c600-45ac-8a84-d0931e05541f - https://github.com/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5 - https://lists.fedoraproject.org/archives/list/package-announ
m/vim/vim/commit/cc762a48d42b579fb7bdec2c614636b830342dd5 - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AZ3JMSUCR6Y7626RDWQ2HNSUFIQOJ33G/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6ZNKVN4GICORTVFKVCM4MSOXCYWNHUC/ - https://security.gentoo.org/glsa/202305-16 - https://lists.debian.org/debian-lts-announce/2023/06/msg00015.html
CVE ID: CVE-2022-4142 State: PUBLISHED Published: 2023-01-02T21:49:17.868Z Last Updated: 2025-04-10T19:01:26.610Z Vendors: Unknown Products: WordPress Filter Gallery Plugin Problem Types: CWE-79 Cross-Site Scripting (XSS) Description: The WordPress Filter Gallery Plugin WordPress plugin before 0.1.6 does not properly escape the filters passed in the ufg_gallery_filters ajax action before outputting them on the page, allowing a high privileged user such as an administrator to inject HTML or javascript to the plugin settings page, even when the unfiltered_html capability is disabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vu
isabled. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/8c2adadd-0684-49a8-9185-0c7d9581aef1
CVE ID: CVE-2022-4143 State: PUBLISHED Published: 2023-06-28T00:00:00 Last Updated: 2024-12-03T19:59:00.410Z Severity: MEDIUM (CVSS 6.4 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N) Vendors: GitLab Products: GitLab Problem Types: Time-of-check time-of-use (toctou) race condition in GitLab Description: An issue has been discovered in GitLab affecting all versions starting from 15.7 before 15.8.5, from 15.9 before 15.9.4, and from 15.10 before 15.10.1 that allows for crafted, unapproved MRs to be introduced and merged without authorization Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/383776 - https://hac
ram Container: - CISA ADP Vulnrichment: References: - https://gitlab.com/gitlab-org/gitlab/-/issues/383776 - https://hackerone.com/reports/1767639 - https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4143.json
CVE ID: CVE-2022-4144 State: PUBLISHED Published: 2022-11-29T00:00:00.000Z Last Updated: 2025-04-14T18:09:55.614Z Vendors: n/a Products: QEMU (QXL device) Problem Types: CWE-125 Description: An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_b
tional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://bugzilla.redhat.com/show_bug.cgi?id=2148506 - https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg04143.html - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/ - https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTVPHLLXJ65BUMFBUUZ35F3J632SLFRK/ - https://security.netapp.com/advisory/ntap-20230127-0012/
CVE ID: CVE-2022-4145 State: PUBLISHED Published: 2023-10-05T12:34:57.523Z Last Updated: 2024-09-03T13:34:13.619Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: n/a, Red Hat Products: openshift, Red Hat OpenShift Container Platform 4 Problem Types: CWE-74 Description: A content spoofing flaw was found in OpenShift's OAuth endpoint. This flaw allows a remote, unauthenticated attacker to inject text into a webpage, enabling the obfuscation of a phishing operation. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-4145 - https://bugzilla.redhat.com/show_bug.cgi?id=2148667
CVE ID: CVE-2022-4146 State: PUBLISHED Published: 2023-07-18T02:01:04.391Z Last Updated: 2024-10-28T18:17:54.930Z Severity: HIGH (CVSS 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L) Vendors: Hitachi Products: Hitachi Replication Manager Problem Types: CWE-917 Description: Expression Language Injection vulnerability in Hitachi Replication Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Replication Manager: before 8.8.5-02. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-123/index.html
CVE ID: CVE-2022-4147 State: PUBLISHED Published: 2022-12-06T00:00:00.000Z Last Updated: 2025-04-14T18:10:52.032Z Vendors: n/a Products: quarkus-2 Problem Types: CWE-1026 Description: Quarkus CORS filter allows simple GET and POST requests with invalid Origin to proceed. Simple GET or POST requests made with XMLHttpRequest are the ones which have no event listeners registered on the object returned by the XMLHttpRequest upload property and have no ReadableStream object used in the request. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2022-4147
CVE ID: CVE-2022-4148 State: PUBLISHED Published: 2023-03-20T15:52:20.188Z Last Updated: 2025-02-26T18:59:29.135Z Vendors: Unknown Products: WP OAuth Server (OAuth Authentication) Problem Types: CWE-862 Missing Authorization, CWE-352 Cross-Site Request Forgery (CSRF) Description: The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.3.0 has a flawed CSRF and authorisation check when deleting a client, which could allow any authenticated users, such as subscriber to delete arbitrary client. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://wpscan.com/vulnerability/be9b25c8-b0d7-4c22-81ff-e41650a4ed41
CVE ID: CVE-2022-4149 State: PUBLISHED Published: 2023-06-15T06:44:25.434Z Last Updated: 2024-12-12T17:05:07.261Z Severity: HIGH (CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) Vendors: Netskope Products: Netskope Client Problem Types: CWE-367 Description: The Netskope client service (prior to R96) on Windows runs as NT AUTHORITY\SYSTEM which writes log files to a writable directory (C:\Users\Public\netSkope) for a standard user. The files are created and written with a SYSTEM account except one file (logplaceholder) which inherits permission giving all users full access control list. Netskope client restricts access to this file by allowing only read permissions as a standard user. Wh