Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2022-47592 State: PUBLISHED Published: 2023-03-20T11:48:23.875Z Last Updated: 2025-01-10T19:19:07.255Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: Dmytriy.cooperman Products: MagicForm Problem Types: CWE-79 Description: Reflected Cross-Site Scripting (XSS) vulnerability in Dmytriy.Cooperman MagicForm plugin <= 0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/magicform/wordpress-magicform-plugin-0-1-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47593 State: PUBLISHED Published: 2023-06-22T12:45:40.792Z Last Updated: 2024-10-17T20:53:04.986Z Severity: HIGH (CVSS 8.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:H) Vendors: RapidLoad Products: RapidLoad Power-Up for Autoptimize Problem Types: CWE-89 Description: Auth. (subscriber+) SQL Injection (SQLi) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize plugin <= 1.6.35 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/unusedcss/wordpress-rapidload-power-up-for-autoptimize-plugin-1-6-35-sql-injection?_s_id=cve
CVE ID: CVE-2022-47594 State: PUBLISHED Published: 2024-12-13T14:22:12.225Z Last Updated: 2024-12-13T21:21:18.369Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N) Vendors: WPDeveloper Products: Essential Blocks for Gutenberg Problem Types: CWE-862 Description: Missing Authorization vulnerability in WPDeveloper Essential Blocks for Gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Blocks for Gutenberg: from n/a through 3.8.5. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/essential-blocks/vulnerability/wordpress-essential-blocks-for-gutenberg
https://patchstack.com/database/wordpress/plugin/essential-blocks/vulnerability/wordpress-essential-blocks-for-gutenberg-plugin-3-8-5-broken-access-control?_s_id=cve
CVE ID: CVE-2022-47595 State: PUBLISHED Published: 2023-03-14T06:27:58.886Z Last Updated: 2025-01-13T15:53:21.877Z Severity: MEDIUM (CVSS 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) Vendors: WP Go Maps Products: WP Go Maps (formerly WP Google Maps) Problem Types: CWE-22 Description: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in WP Go Maps (formerly WP Google Maps) plugin <= 9.0.15 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-google-maps/wordpress-wp-go-maps-formerly-wp-google-maps-plugin-9-0-15-directory-traversal?_s_id=cve
CVE ID: CVE-2022-47596 State: PUBLISHED Published: 2023-03-29T16:19:57.365Z Last Updated: 2025-02-19T21:37:11.413Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Jeffrey-WP Products: Media Library Categories Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Jeffrey-WP Media Library Categories plugin <= 1.9.9 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-media-library-categories/wordpress-media-library-categories-plugin-1-9-9-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47597 State: PUBLISHED Published: 2023-12-20T17:46:04.968Z Last Updated: 2024-08-03T14:55:08.404Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Vendors: Popup Maker Products: Popup Maker – Popup for opt-ins, lead gen, & more Problem Types: CWE-200 Description: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for opt-ins, lead gen, & more: from n/a through 1.17.1. Additional Analyst Notes: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/popup-maker/wordpress-popup-maker-plugin-1-17-1-una
ntainer: References: - https://patchstack.com/database/vulnerability/popup-maker/wordpress-popup-maker-plugin-1-17-1-unauth-access-to-debug-log?_s_id=cve
CVE ID: CVE-2022-47598 State: PUBLISHED Published: 2023-04-24T14:23:40.288Z Last Updated: 2025-01-09T15:35:36.694Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: WP Plugins Pro Products: WP Super Popup Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WP Plugins Pro WP Super Popup plugin <= 1.1.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-super-popup/wordpress-wp-super-popup-plugin-1-1-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47599 State: PUBLISHED Published: 2023-12-20T17:42:53.746Z Last Updated: 2025-05-06T18:40:37.512Z Severity: MEDIUM (CVSS 5.5 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L) Vendors: File Manager by Bit Form Team Products: File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager Problem Types: CWE-502 Description: Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This issue affects File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7. Additional Analyst Notes:
e & Open Source File Manager Plugin for WordPress | Bit File Manager: from n/a through 5.2.7. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/file-manager/wordpress-bit-file-manager-100-free-file-manager-for-wordpress-plugin-5-2-7-php-object-injection?_s_id=cve
CVE ID: CVE-2022-47600 State: PUBLISHED Published: 2023-05-10T10:41:30.329Z Last Updated: 2025-01-09T15:18:10.716Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: I Thirteen Web Solution Products: Mass Email To users Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in I Thirteen Web Solution Mass Email To users plugin <= 1.1.4 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mass-email-to-users/wordpress-mass-email-to-users-plugin-1-1-4-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47601 State: PUBLISHED Published: 2025-01-02T15:07:30.729Z Last Updated: 2025-01-03T18:56:26.216Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) Vendors: JoomUnited Products: WP Table Manager Problem Types: CWE-862 Description: Missing Authorization vulnerability in JoomUnited WP Table Manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Table Manager: from n/a through 3.5.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/wordpress/plugin/wp-table-manager/vulnerability/wordpress-wp-table-manager-plugin-3-5-2-broken-access-control?_s_id=cve
CVE ID: CVE-2022-47602 State: PUBLISHED Published: 2023-03-29T19:24:50.155Z Last Updated: 2025-01-10T19:13:00.547Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) Vendors: JoomUnited Products: WP Table Manager Problem Types: CWE-79 Description: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in JoomUnited WP Table Manager plugin <= 3.5.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-table-manager/wordpress-wp-table-manager-plugin-3-5-2-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47603 State: PUBLISHED Published: 2023-03-29T18:57:56.117Z Last Updated: 2025-01-10T19:13:12.665Z Severity: HIGH (CVSS 7.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) Vendors: wpdevart Products: Gallery – Image and Video Gallery with Thumbnails Problem Types: CWE-79 Description: Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in wpdevart Gallery – Image and Video Gallery with Thumbnails plugin <= 2.0.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/gallery-album/wordpress-gallery-image-and-video-gallery-with-thumbnails-plugin-2-0-1-cross-site-scripting-xss?_s_id=cv
y/gallery-album/wordpress-gallery-image-and-video-gallery-with-thumbnails-plugin-2-0-1-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47604 State: PUBLISHED Published: 2024-03-21T17:41:52.901Z Last Updated: 2024-08-03T15:02:35.892Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) Vendors: junkcoder, ristoniinemets Products: AJAX Thumbnail Rebuild Problem Types: CWE-862 Description: Missing Authorization vulnerability in junkcoder, ristoniinemets AJAX Thumbnail Rebuild.This issue affects AJAX Thumbnail Rebuild: from n/a through 1.13. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://patchstack.com/database/vulnerability/ajax-thumbnail-rebuild/wordpress-ajax-thumbnail-rebuild-plugin-1-13-broken-access-control-vulnerability?_s_id=cve
CVE ID: CVE-2022-47605 State: PUBLISHED Published: 2023-04-12T14:41:14.131Z Last Updated: 2025-01-08T22:08:25.521Z Severity: HIGH (CVSS 8.3 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:L) Vendors: Kunal Nagar Products: Custom 404 Pro Problem Types: CWE-89 Description: Auth. SQL Injection') vulnerability in Kunal Nagar Custom 404 Pro plugin <= 3.7.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/custom-404-pro/wordpress-custom-404-pro-plugin-3-7-0-admin-sql-injection-vulnerability?_s_id=cve
CVE ID: CVE-2022-47606 State: PUBLISHED Published: 2023-05-10T10:31:14.887Z Last Updated: 2025-02-19T21:30:49.154Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Tim Stephenson Products: WP-CORS Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Tim Stephenson WP-CORS plugin <= 0.2.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/wp-cors/wordpress-wp-cors-plugin-0-2-1-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47607 State: PUBLISHED Published: 2023-03-29T18:51:39.501Z Last Updated: 2025-01-10T19:13:21.861Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Usersnap Products: Usersnap Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Usersnap plugin <= 4.16 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/usersnap/wordpress-usersnap-plugin-4-16-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47608 State: PUBLISHED Published: 2023-04-25T16:56:57.092Z Last Updated: 2025-01-09T15:34:18.241Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Fullworks Products: Quick Contact Form Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Fullworks Quick Contact Form plugin <= 8.0.3.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/quick-contact-form/wordpress-quick-contact-form-plugin-8-0-3-1-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47609 State: PUBLISHED Published: 2023-05-22T08:56:03.469Z Last Updated: 2025-01-09T15:11:03.861Z Severity: MEDIUM (CVSS 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L) Vendors: Nicearma Products: DNUI Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Nicearma DNUI plugin <= 2.8.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/dnui-delete-not-used-image-wordpress/wordpress-dnui-plugin-2-8-1-multiple-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47610 State: PUBLISHED Published: 2023-03-29T18:46:56.606Z Last Updated: 2025-01-10T19:13:32.194Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: Mr Digital Products: Simple Image Popup Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Mr Digital Simple Image Popup plugin <= 1.3.6 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/simple-image-popup/wordpress-simple-image-popup-plugin-1-3-6-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47611 State: PUBLISHED Published: 2023-05-22T09:06:05.292Z Last Updated: 2025-01-09T15:10:53.199Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Julian Weinert // cs&m Products: Hover Image Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Julian Weinert // cs&m Hover Image plugin <= 1.4.1 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/hover-image/wordpress-hover-image-plugin-1-4-1-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47612 State: PUBLISHED Published: 2023-02-28T14:51:31.800Z Last Updated: 2025-01-13T15:55:44.072Z Severity: MEDIUM (CVSS 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) Vendors: Roland Barker, xnau webdesign Products: Participants Database Problem Types: CWE-352 Description: Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/participants-database/wordpress-participants-database-plugin-2-4-5-cross-site-request-forgery-csrf?_s_id=cve
CVE ID: CVE-2022-47613 State: PUBLISHED Published: 2023-03-29T18:42:16.724Z Last Updated: 2025-01-10T19:13:43.991Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L) Vendors: QuantumCloud Products: AI ChatBot Problem Types: CWE-79 Description: Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in QuantumCloud AI ChatBot plugin <= 4.3.0 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/chatbot/wordpress-chatbot-plugin-4-3-0-multiple-cross-site-scripting-xss?_s_id=cve
CVE ID: CVE-2022-47614 State: PUBLISHED Published: 2023-06-23T14:31:36.064Z Last Updated: 2024-10-18T13:01:54.834Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:L) Vendors: InspireUI Products: MStore API Problem Types: CWE-89 Description: Unauth. SQL Injection (SQLi) vulnerability in InspireUI MStore API plugin <= 3.9.7 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/mstore-api/wordpress-mstore-api-plugin-3-9-7-sql-injection?_s_id=cve
CVE ID: CVE-2022-47615 State: PUBLISHED Published: 2023-01-24T09:05:26.900Z Last Updated: 2025-01-08T22:09:01.990Z Severity: CRITICAL (CVSS 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N) Vendors: ThimPress Products: LearnPress – WordPress LMS Plugin Problem Types: Local File Inclusion Description: Local File Inclusion vulnerability in LearnPress – WordPress LMS Plugin <= 4.1.7.3.2 versions. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://patchstack.com/database/vulnerability/learnpress/wordpress-learnpress-plugin-4-1-7-3-2-local-file-inclusion?_s_id=cve - https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress
2-local-file-inclusion?_s_id=cve - https://patchstack.com/articles/multiple-critical-vulnerabilities-fixed-in-learnpress-plugin-version/
CVE ID: CVE-2022-47616 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T18:23:41.287Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitron Technologies Inc. Products: Hitron CODA-5310 Problem Types: CWE-78 Description: Hitron CODA-5310 has insufficient filtering for specific parameters in the connection test function. A remote attacker authenticated as an administrator, can use the management page to perform command injection attacks, to execute arbitrary system command, manipulate system or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-70
al Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7082-373d5-1.html
CVE ID: CVE-2022-47617 State: PUBLISHED Published: 2023-06-02T00:00:00 Last Updated: 2025-01-10T18:22:49.498Z Severity: HIGH (CVSS 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) Vendors: Hitron Technologies Inc. Products: Hitron CODA-5310 Problem Types: CWE-798 Description: Hitron CODA-5310 has hard-coded encryption/decryption keys in the program code. A remote attacker authenticated as an administrator can decrypt system files using the hard-coded keys for file access, modification, and cause service disruption. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-7083-94e13-1.html
CVE ID: CVE-2022-47618 State: PUBLISHED Published: 2023-01-03T00:00:00.000Z Last Updated: 2025-04-10T15:48:50.318Z Severity: CRITICAL (CVSS 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) Vendors: Merit Lilin Ent. Co., Ltd. Products: AH55B04 DVR firmware, AH55B08 DVR firmware Problem Types: CWE-798 Description: Merit LILIN AH55B04 & AH55B08 DVR firm has hard-coded administrator credentials. An unauthenticated remote attacker can use these credentials to log in administrator page, to manipulate system or disrupt service. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.twcert.org.tw/tw/cp-132-6825-6691e-1.html
CVE ID: CVE-2022-47629 State: PUBLISHED Published: 2022-12-20T00:00:00.000Z Last Updated: 2025-04-16T17:35:45.308Z Vendors: n/a Products: n/a Problem Types: n/a Description: Libksba before 1.6.3 is prone to an integer overflow vulnerability in the CRL signature parser. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libksba.git%3Ba=commit%3Bh=f61a5ea4e0f6a80fd4b28ef0174bee77793cf070 - https://dev.gnupg.org/T6284 - https://www.debian.org/security/2022/dsa-5305 - https://lists.debian.org/debian-lts-announce/2022/12/msg00035.html - https://security.gentoo.org/glsa/202212-07 - https://security.netapp.com/advisor
an-lts-announce/2022/12/msg00035.html - https://security.gentoo.org/glsa/202212-07 - https://security.netapp.com/advisory/ntap-20230316-0011/
CVE ID: CVE-2022-47630 State: PUBLISHED Published: 2023-01-16T00:00:00.000Z Last Updated: 2025-04-08T20:26:30.379Z Vendors: n/a Products: n/a Problem Types: n/a Description: Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates. This affects downstream use of get_ext and auth_nvctr. Attackers might be able to trigger dangerous read side effects or obtain sensitive information about microarchitectural state. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.trustedfirmware.org/news/ - https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-10.html - htt
e.org/news/ - https://trustedfirmware-a.readthedocs.io/en/latest/security_advisories/security-advisory-tfv-10.html - http://www.openwall.com/lists/oss-security/2023/01/16/8
CVE ID: CVE-2022-47631 State: PUBLISHED Published: 2023-09-14T00:00:00 Last Updated: 2024-08-03T15:02:36.559Z Vendors: n/a Products: n/a Problem Types: n/a Description: Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management. Attackers can place DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if it detects malicious DLLs in this directory, attackers can exploit a race condition and replace a valid DLL (i.e., a copy of a legitimate Razer DLL) with a malicious DLL after the service
race condition and replace a valid DLL (i.e., a copy of a legitimate Razer DLL) with a malicious DLL after the service has already checked the file. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows. Additional Analyst Notes: - CVE Program Container: References: - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2023-002.txt - http://seclists.org/fulldisclosure/2023/Sep/6 - http://packetstormsecurity.com/files/174696/Razer-Synapse-Race-Condition-DLL-Hijacking.html
CVE ID: CVE-2022-47632 State: PUBLISHED Published: 2023-01-27T00:00:00.000Z Last Updated: 2025-03-28T15:53:40.000Z Vendors: n/a Products: n/a Problem Types: n/a Description: Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation. Attackers can place malicious DLLs into %PROGRAMDATA%\Razer\Synapse3\Service\bin if they do so before the service is installed and if they deny write access for the SYSTEM user. Although the service will not start if the malicious DLLs are unsigned, it suffices to use self-signed DLLs. The validity of the DLL signatures is not checked. As a result, local
re unsigned, it suffices to use self-signed DLLs. The validity of the DLL signatures is not checked. As a result, local Windows users can abuse the Razer driver installer to obtain administrative privileges on Windows. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://syss.de - https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2022-047.txt - http://packetstormsecurity.com/files/170772/Razer-Synapse-3.7.0731.072516-Local-Privilege-Escalation.html - http://seclists.org/fulldisclosure/2023/Sep/6 - http://packetstormsecurity.com/files/174696/Razer-Synapse-Race-Condition-DLL-Hijacking.html
CVE ID: CVE-2022-47633 State: PUBLISHED Published: 2022-12-23T00:00:00.000Z Last Updated: 2025-04-15T03:22:55.828Z Vendors: n/a Products: n/a Problem Types: n/a Description: An image signature validation bypass vulnerability in Kyverno 1.8.3 and 1.8.4 allows a malicious image registry (or a man-in-the-middle attacker) to inject unsigned arbitrary container images into a protected Kubernetes cluster. This is fixed in 1.8.5. This has been fixed in 1.8.5 and mitigations are available for impacted releases. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://kyverno.io/docs/writing-policies/verify-images/ - https://github.com/kyverno/kyverno/compare/
ent: References: - https://kyverno.io/docs/writing-policies/verify-images/ - https://github.com/kyverno/kyverno/compare/v1.8.4...v1.8.5 - https://github.com/kyverno/kyverno/releases/tag/v1.8.5 - https://github.com/kyverno/kyverno/pull/5713 - https://github.com/kyverno/kyverno/security/advisories/GHSA-m3cq-xcx9-3gvm
CVE ID: CVE-2022-47634 State: PUBLISHED Published: 2023-01-01T00:00:00.000Z Last Updated: 2025-04-10T19:18:17.028Z Vendors: n/a Products: n/a Problem Types: n/a Description: M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access and manipulate archive data via certain HTTP endpoints, aka LINK-2867. Additional Analyst Notes: - CVE Program Container: - CISA ADP Vulnrichment: References: - https://www.isode.com/support/security/advisory/m-link-incorrect-access-control-vulnerability-21-12-2022.html