rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-1074 TEM FLEX-1085 injection
A vulnerability has been found in TEM FLEX-1085 1.6.0 and classified as problematic. Using the input <h1>HTML Injection</h1> in the WiFi settings of the dashboard leads to html injection.
Problem types: cwe_id: CWE-74
description: CWE-74 Injection
Affected products: vendor: TEM
product: FLEX-1085
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-03-29T05:50:35.000Z
CVE-2022-1075 College Website Management System Contact cross site scripting
A vulnerability was found in College Website Management System 1.0 and classified as problematic. Affected by this issue is the file /cwms/classes/Master.php?f=save_contact of the component Contact Handler. The manipulation leads to persistent cross site scripting. The attack may be launched remotely and requires authentication.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: College Website Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-03-29T05:50:36.000Z
CVE-2022-1076 Automatic Question Paper Generator System My Account Page login.php cross site scripting
A vulnerability was found in Automatic Question Paper Generator System 1.0. It has been classified as problematic. This affects the file /aqpg/users/login.php of the component My Account Page. The manipulation of the argument First Name/Middle Name/Last Name leads to cross site scripting. It is possible to initiate the attack remotely.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: Automatic Question Paper Generator System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-03-29T05:50:38.000Z
CVE-2022-1077 TEM FLEX-1080/FLEX-1085 Log information disclosure
A vulnerability was found in TEM FLEX-1080 and FLEX-1085 1.6.0. It has been declared as problematic. This vulnerability log.cgi of the component Log Handler. A direct request leads to information disclosure of hardware information. The attack can be initiated remotely and does not require any form of authentication.
Problem types: cwe_id: CWE-200
description: CWE-200 Information Disclosure
Affected products: vendor: TEM
product: FLEX-1080
vendor: TEM
product: FLEX-1085
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Published: 2022-03-29T05:50:39.000Z
CVE-2022-1078 SourceCodester College Website Management System sql injection
A vulnerability was found in SourceCodester College Website Management System 1.0. It has been classified as critical. Affected is the file /cwms/admin/?page=articles/view_article/. The manipulation of the argument id with the input ' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc with an unknown input leads to sql injection. It is possible to launch the attack remotely and without authentication.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: College Website Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-03-29T05:50:40.000Z
CVE-2022-1079 SourceCodester One Church Management System churchprofile.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester One Church Management System. Affected are multiple files and parameters which are prone to to cross site scripting. It is possible to launch the attack remotely.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: One Church Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-03-29T05:50:42.000Z
CVE-2022-1080 SourceCodester One Church Management System attendancy.php sql injection
A vulnerability was found in SourceCodester One Church Management System 1.0. It has been declared as critical. This vulnerability affects code of the file attendancy.php as the manipulation of the argument search2 leads to sql injection. The attack can be initiated remotely.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: One Church Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-03-29T05:50:43.000Z
CVE-2022-1081 SourceCodester Microfinance Management System addcustomerHandler.php cross site scripting
A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been declared as problematic. This vulnerability affects the file /mims/app/addcustomerHandler.php. The manipulation of the argument first_name, middle_name, and surname leads to cross site scripting. The attack can be initiated remotely.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: Microfinance Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-03-29T05:50:45.000Z
CVE-2022-1082 SourceCodester Microfinance Management System Login Page login.php sql injection
A vulnerability was found in SourceCodester Microfinance Management System 1.0. It has been rated as critical. This issue affects the file /mims/login.php of the Login Page. The manipulation of the argument username/password with the input '||1=1# leads to sql injection. The attack may be initiated remotely.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: SourceCodester
product: Microfinance Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-03-29T05:50:47.000Z
CVE-2022-1083 Microfinance Management System sql injection
A vulnerability classified as critical has been found in Microfinance Management System. The manipulation of arguments like customer_type_number/account_number/account_status_number/account_type_number with the input ' and (select * from(select(sleep(10)))Avx) and 'abc' = 'abc leads to sql injection in multiple files. It is possible to launch the attack remotely.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: unspecified
product: Microfinance Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-03-29T05:50:48.000Z
CVE-2022-1084 SourceCodester One Church Management System Session userregister.php improper authentication
A vulnerability classified as critical was found in SourceCodester One Church Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /one_church/userregister.php. The manipulation leads to authentication bypass. The attack can be launched remotely.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: SourceCodester
product: One Church Management System
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 7.3
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
version: 3.1
Published: 2022-03-29T05:50:50.000Z
CVE-2022-1085 CLTPHP POST Parameter cross site scripting
A vulnerability was found in CLTPHP up to 6.0. It has been declared as problematic. Affected by this vulnerability is the POST Parameter Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: CLTPHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-03-29T05:50:51.000Z
CVE-2022-1086 DolphinPHP User Management Page cross site scripting
A vulnerability was found in DolphinPHP up to 1.5.0 and classified as problematic. Affected by this issue is the User Management Page. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: DolphinPHP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-03-29T05:50:53.000Z
CVE-2022-1087 htmly Edit Profile Module cross site scripting
A vulnerability, which was classified as problematic, has been found in htmly 5.3 whis affects the component Edit Profile Module. The manipulation of the field Title with script tags leads to persistent cross site scripting. The attack may be initiated remotely and requires an authentication. A simple POC has been disclosed to the public and may be used.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: unspecified
product: htmly
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 3.5
baseSeverity: LOW
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2022-03-29T05:50:54.000Z
CVE-2022-1088 Page Security & Membership <= 1.5.15 - Admin+ Stored Cross-Site Scripting
The Page Security & Membership WordPress plugin through 1.5.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Page Security & Membership
Credits: lang: en
value: Ankur Bakre
Published: 2022-04-18T17:10:51.000Z
CVE-2022-1089 Bulk Edit and Create User Profiles < 1.5.14 - Admin+ Stored Cross-Site Scripting
The Bulk Edit and Create User Profiles WordPress plugin before 1.5.14 does not sanitise and escape the Users Login, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Bulk Edit and Create User Profiles – WP Sheet Editor
Credits: lang: en
value: Ankur Bakre
Published: 2022-05-16T14:30:36.000Z
CVE-2022-1090 Good & Bad Comments <= 1.0.0 - Admin+ Stored Cross-Site Scripting
The Good & Bad Comments WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Good & Bad comments
Credits: lang: en
value: Vaibhav Nitin Gaikwad
Published: 2022-04-18T17:10:52.000Z
CVE-2022-1091 Safe SVG < 1.9.10 - SVG Sanitisation Bypass
The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Safe SVG
Credits: lang: en
value: David Hamann
Published: 2022-04-18T17:10:54.000Z
CVE-2022-1092 myCred < 2.4.4 - Subscriber+ Import/Export to Email Address Disclosure
The myCred WordPress plugin before 2.4.3.1 does not have authorisation and CSRF checks in its mycred-tools-import-export AJAX action, allowing any authenticated user to call and and retrieve the list of email address present in the blog
Problem types: description: CWE-862 Missing Authorization
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: myCred
default_status: unaffected
Credits: lang: en
value: David Hamann
lang: en
value: WPScan
Published: 2022-04-25T15:51:15.000Z
CVE-2022-1093 WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs
The WP Meta SEO WordPress plugin before 4.4.7 does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP Meta SEO
Credits: lang: en
value: Victor Pasman
Published: 2022-05-23T07:15:25.000Z
CVE-2022-1094 Amr Users < 4.59.4 - Admin+ Stored Cross-Site Scripting
The amr users WordPress plugin before 4.59.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: amr users
Credits: lang: en
value: Ankur Bakre
Published: 2022-04-25T15:51:16.000Z
CVE-2022-1095 Mihdan: No External Links < 5.0.2 - Admin+ Stored Cross-Site Scripting
The Mihdan: No External Links WordPress plugin before 5.0.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Mihdan: No External Links
Credits: lang: en
value: Vaibhav Nitin Gaikwad
Published: 2022-06-27T08:56:16.000Z
CVE-2022-1096 
Type confusion in V8 in Google Chrome prior to 99.0.4844.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Problem types: description: Type Confusion
Affected products: vendor: Google
product: Chrome
Published: 2022-07-22T23:35:35.000Z
CVE-2022-1097 
<code>NSSToken</code> objects were referenced via direct points, and could have been accessed in an unsafe way on different threads, leading to a use-after-free and potentially exploitable crash. This vulnerability affects Thunderbird < 91.8, Firefox < 99, and Firefox ESR < 91.8.
Problem types: description: Use-after-free in NSSToken objects
Affected products: vendor: Mozilla
product: Thunderbird
vendor: Mozilla
product: Firefox
vendor: Mozilla
product: Firefox ESR
Published: 2022-12-22T00:00:00.000Z
CVE-2022-1098 Delta Electronics DIAEnergie Uncontrolledly Search Path Element
Delta Electronics DIAEnergie (all versions prior to 1.8.02.004) are vulnerable to a DLL hijacking condition. When combined with the Incorrect Default Permissions vulnerability of 4.2.2 above, this makes it possible for an attacker to escalate privileges
Problem types: cwe_id: CWE-427
description: CWE-427 Uncontrolled Search Path Element
Affected products: vendor: DIAEnerrgie
product: DIAEnergie
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 7.8
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
version: 3.1
Published: 2022-04-01T22:17:22.593Z
CVE-2022-1099 
Adding a very large number of tags to a runner in GitLab CE/EE affecting all versions prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an attacker to impact the performance of GitLab
Problem types: description: Uncontrolled resource consumption in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2022-04-04T19:46:03.000Z
CVE-2022-1100 
A potential DOS vulnerability was discovered in GitLab CE/EE affecting all versions from 13.1 prior to 14.7.7, 14.8.0 prior to 14.8.5, and 14.9.0 prior to 14.9.2. The api to update an asset as a link from a release had a regex check which caused exponential number of backtracks for certain user supplied values resulting in high CPU usage.
Problem types: description: Improper input validation in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2022-04-04T19:46:02.000Z
CVE-2022-1101 SourceCodester Royale Event Management System userregister.php improper authentication
A vulnerability was found in SourceCodester Royale Event Management System 1.0. It has been rated as critical. This issue affects some unknown processing of the file /royal_event/userregister.php. The manipulation leads to improper authentication. The attack may be initiated remotely. The identifier VDB-195785 was assigned to this vulnerability.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: SourceCodester
product: Royale Event Management System
CVSS v3.1: version: 3.1
baseScore: 7.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
baseSeverity: HIGH
Credits: lang: en
value: mrempy (VulDB User)
Published: 2023-01-07T21:33:57.055Z
CVE-2022-1102 SourceCodester Royale Event Management System companyprofile.php cross site scripting
A vulnerability classified as problematic has been found in SourceCodester Royale Event Management System 1.0. Affected is an unknown function of the file /royal_event/companyprofile.php. The manipulation of the argument companyname/regno/companyaddress/companyemail leads to cross site scripting. It is possible to launch the attack remotely. VDB-195786 is the identifier assigned to this vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross Site Scripting
Affected products: vendor: SourceCodester
product: Royale Event Management System
CVSS v3.1: version: 3.1
baseScore: 4.3
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
baseSeverity: MEDIUM
Credits: lang: en
value: mrempy (VulDB User)
Published: 2023-01-07T21:34:19.194Z
CVE-2022-1103 Advanced Uploader <= 4.2 - Subscriber+ Arbitrary File Upload
The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Advanced uploader
Credits: lang: en
value: Roel van Beurden
Published: 2022-05-16T14:30:37.000Z
CVE-2022-1104 Popup Maker < 1.16.5 - Admin+ Stored Cross-Site Scripting
The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Popup Maker – Popup for opt-ins, lead gen, & more
Credits: lang: en
value: Roel van Beurden
Published: 2022-05-09T16:50:46.000Z
CVE-2022-1105 
An improper access control vulnerability in GitLab CE/EE affecting all versions from 13.11 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allows an unauthorized user to access pipeline analytics even when public pipelines are disabled
Problem types: description: Improper access control in GitLab
Affected products: vendor: GitLab
product: GitLab
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
version: 3.1
Credits: lang: en
value: This vulnerability has been discovered internally by the GitLab team
Published: 2022-04-04T19:46:04.000Z
CVE-2022-1106 use after free in mrb_vm_exec in mruby/mruby
use after free in mrb_vm_exec in GitHub repository mruby/mruby prior to 3.2.
Problem types: cwe_id: CWE-416
description: CWE-416 Use After Free
Affected products: vendor: mruby
product: mruby/mruby
Published: 2022-03-27T14:05:10.000Z