rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-0319 Out-of-bounds Read in vim/vim
Out-of-bounds Read in vim/vim prior to 8.2.
Problem types: cwe_id: CWE-125
description: CWE-125 Out-of-bounds Read
Affected products: vendor: vim
product: vim/vim
Published: 2022-01-21T00:00:00.000Z
CVE-2022-0320 Essential Addons for Elementor < 5.0.5 - Unauthenticated LFI
The Essential Addons for Elementor WordPress plugin before 5.0.5 does not validate and sanitise some template data before it them in include statements, which could allow unauthenticated attackers to perform Local File Inclusion attack and read arbitrary files on the server, this could also lead to RCE via user uploaded files or other LFI to RCE techniques.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: Essential Addons for Elementor
Credits: lang: en
value: Wai Yan Myo Thet
Published: 2022-02-01T12:21:42.000Z
CVE-2022-0321 WP Voting Contest < 3.0 - Reflected Cross-Site Scripting
The WP Voting Contest WordPress plugin before 3.0 does not sanitise and escape the post_id parameter before outputting it back in the response via the wpvc_social_share_icons AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Voting Contest
Credits: lang: en
value: Brandon James Roldan
Published: 2022-03-14T14:41:28.000Z
CVE-2022-0322 
A flaw was found in the sctp_make_strreset_req function in net/sctp/sm_make_chunk.c in the SCTP network protocol in the Linux kernel with a local user privilege access. In this flaw, an attempt to use more buffer than is allocated triggers a BUG_ON issue, leading to a denial of service (DOS).
Problem types: cwe_id: CWE-681
description: CWE-681
Affected products: vendor: n/a
product: kernel
Published: 2022-03-25T18:02:58.000Z
CVE-2022-0323 Improper Neutralization of Special Elements Used in a Template Engine in bobthecow/mustache.php
Improper Neutralization of Special Elements Used in a Template Engine in Packagist mustache/mustache prior to 2.14.1.
Problem types: cwe_id: CWE-1336
description: CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
Affected products: vendor: bobthecow
product: bobthecow/mustache.php
Published: 2022-01-21T18:00:17.000Z
CVE-2022-0324 Buffer Overflow in Dhcp6relay in Software for Open Networking in the Cloud (SONiC)
There is a vulnerability in DHCPv6 packet parsing code that could be explored by remote attacker to craft a packet that could cause buffer overflow in a memcpy call, leading to out-of-bounds memory write that would cause dhcp6relay to crash. Dhcp6relay is a critical process and could cause dhcp relay docker to shutdown.

Discovered by Eugene Lim of GovTech Singapore.

Problem types: cwe_id: CWE-120
description: CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Affected products: vendor: Linux Foundation
product: Software for Open Networking in the Cloud (SONiC)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: ADJACENT_NETWORK
availabilityImpact: HIGH
baseScore: 8.1
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
version: 3.1
Published: 2022-11-14T16:08:34.224Z
CVE-2022-0326 NULL Pointer Dereference in mruby/mruby
NULL Pointer Dereference in Homebrew mruby prior to 3.2.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-01-21T06:45:12.000Z
CVE-2022-0327 Master Addons for Elementor < 1.8.2 - Reflected Cross-Site Scripting
The Master Addons for Elementor WordPress plugin before 1.8.5 does not sanitise and escape the error_message parameter before outputting it back in the response of the jltma_restrict_content AJAX action, available to unauthenticated and authenticated users, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Master Addons for Elementor
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-14T14:41:29.000Z
CVE-2022-0328 Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRF
The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Simple Membership
Credits: lang: en
value: Krzysztof Zając
Published: 2022-02-28T09:06:45.000Z
CVE-2022-0330 
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.
Problem types: cwe_id: CWE-281
description: CWE-281
Affected products: vendor: n/a
product: kernel
Published: 2022-03-25T00:00:00.000Z
CVE-2022-0331 
An information disclosure vulnerability in Webadmin allows an unauthenticated remote attacker to read the device serial number in Sophos Firewall version v18.5 MR2 and older.
Problem types: description: n/a
Affected products: vendor: Sophos
product: Sophos Firewall
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Mohammed Adel of Safe Decision Cybersecurity Labs
Published: 2022-03-29T00:30:13.000Z
CVE-2022-0332 
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data.
Problem types: cwe_id: CWE-89
description: CWE-89
Affected products: vendor: n/a
product: moodle
Published: 2022-01-25T19:11:10.000Z
CVE-2022-0333 
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The calendar:manageentries capability allowed managers to access or modify any calendar event, but should have been restricted from accessing user level events.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: moodle
Published: 2022-01-25T19:11:11.000Z
CVE-2022-0334 
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. Insufficient capability checks could lead to users accessing their grade report for courses where they did not have the required gradereport/user:view capability.
Problem types: cwe_id: CWE-863
description: CWE-863
Affected products: vendor: n/a
product: moodle
Published: 2022-01-25T19:11:11.000Z
CVE-2022-0335 
A flaw was found in Moodle in versions 3.11 to 3.11.4, 3.10 to 3.10.8, 3.9 to 3.9.11 and earlier unsupported versions. The "delete badge alignment" functionality did not include the necessary token check to prevent a CSRF risk.
Problem types: cwe_id: CWE-352
description: CWE-352
Affected products: vendor: n/a
product: moodle
Published: 2022-01-25T19:11:12.000Z
CVE-2022-0336 
The Samba AD DC includes checks when adding service principals names (SPNs) to an account to ensure that SPNs do not alias with those already in the database. Some of these checks are able to be bypassed if an account modification re-adds an SPN that was previously present on that account, such as one added when a computer is joined to a domain. An attacker who has the ability to write to an account can exploit this to perform a denial-of-service attack by adding an SPN that matches an existing service. Additionally, an attacker who can intercept traffic can impersonate existing services, resulting in a loss of confidentiality and integrity.
Problem types: cwe_id: CWE-276
description: CWE-276 - Incorrect Default Permissions
Affected products: vendor: n/a
product: Samba
Published: 2022-08-29T00:00:00.000Z
CVE-2022-0337 
Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentially sensitive information via a crafted HTML page. (Chrome security severity: High)
Problem types: description: Inappropriate implementation
Affected products: vendor: Google
product: Chrome
Published: 2023-01-02T00:00:00.000Z
CVE-2022-0338 Insertion of Sensitive Information into Log File in delgan/loguru
Insertion of Sensitive Information into Log File in Conda loguru prior to 0.5.3.
Problem types: cwe_id: CWE-532
description: CWE-532 Insertion of Sensitive Information into Log File
Affected products: vendor: delgan
product: delgan/loguru
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-01-25T09:00:12.000Z
CVE-2022-0339 Server-Side Request Forgery (SSRF) in janeczku/calibre-web
Server-Side Request Forgery (SSRF) in Pypi calibreweb prior to 0.6.16.
Problem types: cwe_id: CWE-918
description: CWE-918 Server-Side Request Forgery (SSRF)
Affected products: vendor: janeczku
product: janeczku/calibre-web
Published: 2022-01-30T13:17:54.000Z
CVE-2022-0341 Cross-site Scripting (XSS) - Stored in vanessa219/vditor
Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.12.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: vanessa219
product: vanessa219/vditor
Published: 2022-03-14T04:10:09.000Z
CVE-2022-0342 
An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG series firmware versions V1.20 through V1.33 Patch 4, which could allow an attacker to bypass the web authentication and obtain administrative access of the device.
Problem types: cwe_id: CWE-287
description: CWE-287: Improper Authentication
Affected products: vendor: Zyxel
product: USG/ZyWALL series firmware
vendor: Zyxel
product: USG FLEX series firmware
vendor: Zyxel
product: ATP series firmware
vendor: Zyxel
product: VPN series firmware
vendor: Zyxel
product: NSG series firmware
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 9.8
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-03-28T12:05:11.000Z
CVE-2022-0343 Local Priviledge escalation in Perfetto Dev scripts
A local attacker, as a different local user, may be able to send a HTTP request to 127.0.0.1:10000 after the user (typically a developer) manually invoked the ./tools/run-dev-server script. It is recommended to upgrade to any version beyond 24.2
Problem types: cwe_id: CWE-275
description: CWE-275 Permission Issues
Affected products: vendor: Google LLC
product: Perfetto Dev Scripts
CVSS v3.1: attackComplexity: HIGH
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 3.3
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N
version: 3.1
Published: 2022-03-29T15:10:11.000Z
CVE-2022-0344 
An issue has been discovered in GitLab affecting all versions starting from 10.0 before 14.5.4, all versions starting from 10.1 before 14.6.4, all versions starting from 10.2 before 14.7.1. Private project paths can be disclosed to unauthorized users via system notes when an Issue is closed via a Merge Request and later moved to a public project
Problem types: description: Information exposure in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.1
baseSeverity: LOW
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: Thanks [ashish_r_padelkar](https://hackerone.com/ashish_r_padelkar) for reporting this vulnerability through our HackerOne bug bounty program
Published: 2022-03-28T18:53:07.000Z
CVE-2022-0345 Better Notifications for WP < 1.8.7 - Email Address Disclosure
The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and query for user e-mail prefixes (finding the first letter, then the second one, then the third one etc.).
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Customize WordPress Emails and Alerts
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2022-02-28T09:06:47.000Z
CVE-2022-0346 Google XML Sitemap Generator < 2.0.4 - Reflected Cross-Site Scripting
The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: XML Sitemap Generator for Google
Credits: lang: en
value: Krzysztof Zając
Published: 2022-05-23T07:15:21.000Z
CVE-2022-0347 LoginPress < 1.5.12 - Reflected Cross-Site Scripting
The LoginPress | Custom Login Page Customizer WordPress plugin before 1.5.12 does not escape the redirect-page parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: LoginPress | Custom Login Page Customizer
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-07T08:16:26.000Z
CVE-2022-0348 Cross-site Scripting (XSS) - Stored in pimcore/pimcore
Cross-site Scripting (XSS) - Stored in Packagist pimcore/pimcore prior to 10.2.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: pimcore
product: pimcore/pimcore
Published: 2022-01-27T14:10:11.000Z
CVE-2022-0349 NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection
The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor
Credits: lang: en
value: Krzysztof Zając
Published: 2022-03-07T08:16:27.000Z
CVE-2022-0350 Cross-site Scripting (XSS) - Stored in vanessa219/vditor
Cross-site Scripting (XSS) - Stored in GitHub repository vanessa219/vditor prior to 3.8.13.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: vanessa219
product: vanessa219/vditor
Published: 2022-03-31T15:15:14.000Z
CVE-2022-0351 Access of Memory Location Before Start of Buffer in vim/vim
Access of Memory Location Before Start of Buffer in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-786
description: CWE-786 Access of Memory Location Before Start of Buffer
Affected products: vendor: vim
product: vim/vim
Published: 2022-01-25T00:00:00.000Z
CVE-2022-0352 Cross-site Scripting (XSS) - Reflected in janeczku/calibre-web
Cross-site Scripting (XSS) - Reflected in Pypi calibreweb prior to 0.6.16.
Problem types: cwe_id: CWE-79
description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: janeczku
product: janeczku/calibre-web
Published: 2022-01-28T21:29:15.000Z
CVE-2022-0353 

A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 

1.3.1.2

 and 

Lenovo Diagnostics versions prior to 4.45

 that could allow a local user with administrative access to trigger a system crash.


Problem types: cwe_id: CWE-400
description: CWE-400 Uncontrolled Resource Consumption
Affected products: vendor: Lenovo
product: HardwareScanPlugin 
default_status: unaffected
vendor: Lenovo
product: Diagnostics
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 4.4
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Gergo Pap at Quadron Research Lab for reporting this issue.
Published: 2023-10-24T20:39:21.969Z
CVE-2022-0354 
A vulnerability was reported in Lenovo System Update that could allow a local user with interactive system access the ability to execute code with elevated privileges only during the installation of a System Update package released before 2022-02-25 that displays a command prompt window.
Problem types: description: Insecure GUI
Affected products: vendor: Lenovo
product: System Update
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
version: 3.1
Credits: lang: en
value: Lenovo thanks Daniel Feichter (@VirtualAllocEx) at Infosec Tirol for reporting this issue.
Published: 2022-04-22T20:30:47.000Z
CVE-2022-0355 Improper Removal of Sensitive Information Before Storage or Transfer in feross/simple-get
Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.
Problem types: cwe_id: CWE-212
description: CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
Affected products: vendor: feross
product: feross/simple-get
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 8.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-01-26T00:00:00.000Z
CVE-2022-0357 Improper Quoting Path Issue in Bitdefender Total Security
Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM.

This issue affects:

Bitdefender Total Security
versions prior to 26.0.10.45.
Bitdefender Internet Security
versions prior to 26.0.10.45.
Bitdefender Antivirus Plus
versions prior to 26.0.10.45.
Problem types: cwe_id: CWE-428
description: CWE-428 Unquoted Search Path or Element
Affected products: vendor: Bitdefender
product: Total Security
default_status: unaffected
vendor: Bitdefender
product: Internet Security
default_status: unaffected
vendor: Bitdefender
product: Antivirus Plus
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6.7
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2023-05-24T07:53:32.812Z
CVE-2022-0358 
A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.
Problem types: cwe_id: CWE-273
description: CWE-273 - Improper Check for Dropped Privileges.
Affected products: vendor: n/a
product: QEMU/virtiofsd
Published: 2022-08-29T00:00:00.000Z
CVE-2022-0359 Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2022-01-26T00:00:00.000Z
CVE-2022-0360 WP Ultimate CSV Importer < 6.4.3 - Admin+ Stored Cross-Site Scripting
The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious ones (either intentionnaly or not) and lead to Stored Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Drag And drop All Import : WP Ultimate CSV Importer
Credits: lang: en
value: Felipe de Avila
Published: 2022-02-28T09:06:48.000Z
CVE-2022-0361 Heap-based Buffer Overflow in vim/vim
Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.
Problem types: cwe_id: CWE-122
description: CWE-122 Heap-based Buffer Overflow
Affected products: vendor: vim
product: vim/vim
Published: 2022-01-26T00:00:00.000Z
CVE-2022-0362 SQL Injection in star7th/showdoc
SQL Injection in Packagist showdoc/showdoc prior to 2.10.3.
Problem types: cwe_id: CWE-89
description: CWE-89 Improper Neutralization of Special Elements used in an SQL Command
Affected products: vendor: star7th
product: star7th/showdoc
Published: 2022-01-26T12:40:10.000Z
CVE-2022-0363 myCred < 2.4.4 - Subscriber+ Arbitrary Post Creation
The myCred WordPress plugin before 2.4.3.1 does not have any authorisation and CSRF checks in the mycred-tools-import-export AJAX action, allowing any authenticated users, such as subscribers, to call it and import mycred setup, thus creating badges, managing points or creating arbitrary posts.
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: myCred
default_status: unaffected
Credits: lang: en
value: Krzysztof Zając
lang: en
value: WPScan
Published: 2022-04-25T15:50:56.000Z
CVE-2022-0364 Modern Events Calendar Lite < 6.4.0 - Contributor+ Stored Cross Site Scripting
The Modern Events Calendar Lite WordPress plugin before 6.4.0 does not sanitize and escape some of the Hourly Schedule parameters which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Modern Events Calendar Lite
Credits: lang: en
value: Rohan Chaudhari
Published: 2022-03-21T18:55:43.000Z