rainbutterfly/cve_corpus huggingface dataset:
CVE-2022-34538 
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/vca/bia/addacph.cgi. This vulnerability is exploitable via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-19T19:03:57.000Z
CVE-2022-34539 
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/curltest.cgi. This vulnerability is exploitable via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-19T19:04:06.000Z
CVE-2022-34540 
Digital Watchdog DW MEGApix IP cameras A7.2.2_20211029 was discovered to contain a command injection vulnerability in the component /admin/vca/license/license_tok.cgi. This vulnerability is exploitable via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-19T19:03:59.000Z
CVE-2022-34549 
Sims v1.0 was discovered to contain an arbitrary file upload vulnerability via the component /uploadServlet. This vulnerability allows attackers to escalate privileges and execute arbitrary commands via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T13:12:30.000Z
CVE-2022-34550 
Sims v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /addNotifyServlet. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the notifyInfo parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T13:12:30.000Z
CVE-2022-34551 
Sims v1.0 was discovered to allow path traversal when downloading attachments.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T13:12:31.000Z
CVE-2022-34555 
TP-LINK TL-R473G 2.0.1 Build 220529 Rel.65574n was discovered to contain a remote code execution vulnerability which is exploited via a crafted packet.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T22:57:29.000Z
CVE-2022-34556 
PicoC v3.2.2 was discovered to contain a NULL pointer dereference at variable.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T22:50:02.000Z
CVE-2022-34557 
Barangay Management System v1.0 was discovered to contain a SQL injection vulnerability via the hidden_id parameter at /pages/permit/permit.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T22:30:21.000Z
CVE-2022-34558 
WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute arbitrary code via a crafted dbs-client package.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T22:24:02.000Z
CVE-2022-34560 
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the History parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2022-34561 
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the video description parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2022-34562 
A cross-site scripting (XSS) vulnerability in PHPFox v4.8.9 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the status box.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2024-04-22T00:00:00.000Z
CVE-2022-34567 
An issue in \Roaming\Mango\Plugins of University of Texas Multi-image Analysis GUI (Mango) 4.1 allows attackers to escalate privileges via crafted plugins.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-01T14:01:35.000Z
CVE-2022-34568 
SDL v1.2 was discovered to contain a use-after-free via the XFree function at /src/video/x11/SDL_x11yuv.c.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T00:00:00.000Z
CVE-2022-34570 
WAVLINK WN579 X3 M79X3.V5030.191012/M79X3.V5030.191012 contains an information leak which allows attackers to obtain the key information via accessing the messages.txt page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T21:37:21.000Z
CVE-2022-34571 
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the system key information and execute arbitrary commands via accessing the page syslog.shtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T21:37:22.000Z
CVE-2022-34572 
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the telnet password via accessing the page tftp.txt.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T21:37:22.000Z
CVE-2022-34573 
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to arbitrarily configure device settings via accessing the page mb_wifibasic.shtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T21:37:23.000Z
CVE-2022-34574 
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing Tftpd32.ini.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T21:37:24.000Z
CVE-2022-34575 
An access control issue in Wavlink WiFi-Repeater RPTA2-77W.M4300.01.GD.2017Sep19 allows attackers to obtain the key information of the device via accessing fctest.shtml.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T21:37:24.000Z
CVE-2022-34576 
A vulnerability in /cgi-bin/ExportAllSettings.sh of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T21:37:25.000Z
CVE-2022-34577 
A vulnerability in adm.cgi of WAVLINK WN535 G3 M35G3R.V5030.180927 allows attackers to execute arbitrary code via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-25T21:37:26.000Z
CVE-2022-34578 
Open Source Point of Sale v3.3.7 was discovered to contain an arbitrary file upload vulnerability via the Update Branding Settings page.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T19:38:47.000Z
CVE-2022-34580 
Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the address parameter at ip/school/index.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T21:11:24.000Z
CVE-2022-34586 
itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via the grade parameter at /school/view/student_grade_wise.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T20:50:48.000Z
CVE-2022-34588 
itsourcecode Advanced School Management System v1.0 is vulnerable to SQL Injection via the grade parameter at /school/view/timetable_insert_form.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T20:50:47.000Z
CVE-2022-34590 
Hospital Management System v1.0 was discovered to contain a SQL injection vulnerability via the editid parameter in /HMS/admin.php.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T20:50:49.000Z
CVE-2022-34592 
Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-07T00:00:00.000Z
CVE-2022-34593 
DPTech VPN v8.1.28.0 was discovered to contain an arbitrary file read vulnerability.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-28T19:47:41.000Z
CVE-2022-34594 
Advanced School Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component ip/school/moudel/update_subject.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Edit Subject text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T01:41:17.000Z
CVE-2022-34595 
Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function setipv6status.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-06T17:00:36.000Z
CVE-2022-34596 
Tenda AX1803 v1.0.0.1_2890 was discovered to contain a command injection vulnerability via the function WanParameterSetting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-06T17:00:37.000Z
CVE-2022-34597 
Tenda AX1806 v1.0.0.1 was discovered to contain a command injection vulnerability via the function WanParameterSetting.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-06T17:00:38.000Z
CVE-2022-34598 
The udpserver in H3C Magic R100 V200R004 and V100R005 has the 9034 port opened, allowing attackers to execute arbitrary commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-06T17:00:39.000Z
CVE-2022-34599 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EdittriggerList interface at /goform/aspForm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:13.000Z
CVE-2022-34600 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditSTList interface at /goform/aspForm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:14.000Z
CVE-2022-34601 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the Delstlist interface at /goform/aspForm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:15.000Z
CVE-2022-34602 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ipqos_lanip_editlist interface at /goform/aspForm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:16.000Z
CVE-2022-34603 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the DelDNSHnList interface at /goform/aspForm.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:16.000Z
CVE-2022-34604 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /dotrace.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:17.000Z
CVE-2022-34605 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /dotrace.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:18.000Z
CVE-2022-34606 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the EditvsList parameter at /dotrace.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:18.000Z
CVE-2022-34607 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /doping.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:19.000Z
CVE-2022-34608 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the ajaxmsg parameter at /AJAX/ajaxget.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:19.000Z
CVE-2022-34609 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the INTF parameter at /doping.asp.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:20.000Z
CVE-2022-34610 
H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the URL /ihomers/app.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-20T13:41:21.000Z
CVE-2022-34611 
A cross-site scripting (XSS) vulnerability in /index.php/?p=report of Online Fire Reporting System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the "Contac #" text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T01:35:15.000Z
CVE-2022-34612 
Rizin v0.4.0 and below was discovered to contain an integer overflow via the function get_long_object(). This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted binary.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-27T00:00:00.000Z
CVE-2022-34613 
Mealie 1.0.0beta3 contains an arbitrary file upload vulnerability which allows attackers to execute arbitrary code via a crafted file.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T15:00:40.000Z
CVE-2022-34615 
Mealie 1.0.0beta3 employs weak password requirements which allows attackers to potentially gain unauthorized access to the application via brute-force attacks.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-19T13:21:01.000Z
CVE-2022-34618 
A stored cross-site scripting (XSS) vulnerability in Mealie 1.0.0beta3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the recipe description text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T15:00:28.000Z
CVE-2022-34619 
A stored cross-site scripting (XSS) vulnerability in Mealie v0.5.5 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Shopping Lists item names text field.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T21:50:37.000Z
CVE-2022-34621 
Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user passwords and other attributes via modification of the user_id parameter.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-19T13:21:24.000Z
CVE-2022-34624 
Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a crafted GET request.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-19T13:22:03.000Z
CVE-2022-34625 
Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code via a crafted Jinja2 template.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-08-02T15:16:16.000Z
CVE-2022-34632 
Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/RocketCore.scala.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:42.000Z
CVE-2022-34633 
CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted sfence.vma instructions rather create an exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:43.000Z
CVE-2022-34634 
CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted det instructions rather create an exception.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:44.000Z
CVE-2022-34635 
The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:45.000Z
CVE-2022-34636 
CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type when a PMA violation occurs during address translation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:45.000Z
CVE-2022-34637 
CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a implements an incorrect exception type when an illegal virtual address is loaded.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:46.000Z
CVE-2022-34639 
CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which can affect the function of the application.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:48.000Z
CVE-2022-34640 
The *tval of ecall/ebreak in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a was discovered to be incorrect.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:50.000Z
CVE-2022-34641 
CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect exception type when a PMP violation occurs during address translation.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:51.000Z
CVE-2022-34642 
The component mcontrol.action in RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 contains the incorrect mask which can cause a Denial of Service (DoS).
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:52.000Z
CVE-2022-34643 
RISCV ISA Sim commit ac466a21df442c59962589ba296c702631e041b5 implements the incorrect exception priotrity when accessing memory.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2022-07-18T22:45:54.000Z
CVE-2022-34648 WordPress Uploading SVG, WEBP and ICO files plugin <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated (author+) Stored Cross-Site Scripting (XSS) vulnerability in dmitrylitvinov Uploading SVG, WEBP and ICO files plugin <= 1.0.1 at WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: dmitrylitvinov
product: Uploading SVG, WEBP and ICO files (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.8
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: LOW
privilegesRequired: HIGH
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Kim Jong Min aka Universe (Patchstack Alliance)
Published: 2022-08-23T15:45:25.405Z
CVE-2022-34650 WordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities
Multiple Authenticated (contributor or higher user role) Stored Cross-Site Scripting (XSS) vulnerabilities in wpWax Team plugin <= 1.2.6 at WordPress.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: wpWax
product: Team (WordPress plugin)
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Vulnerability discovered by Ngo Van Thien (Patchstack Alliance)
Published: 2022-07-22T16:51:41.048Z
CVE-2022-34651 BIG-IP TLS 1.3 iRule vulnerability CVE-2022-34651
In BIG-IP Versions 16.1.x before 16.1.3.1 and 15.1.x before 15.1.6.1, when an LTM Client or Server SSL profile with TLS 1.3 enabled is configured on a virtual server, along with an iRule that calls HTTP::respond, undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: F5
product: BIG-IP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-08-04T17:47:17.368Z
CVE-2022-34652 
A sql injection vulnerability exists in the ObjectYPT functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. A specially-crafted HTTP request can lead to a SQL injection. An attacker can send an HTTP request to trigger this vulnerability.This vulnerability exists in the Live Schedules plugin, allowing an attacker to inject SQL by manipulating the description parameter.
Problem types: cwe_id: CWE-89
description: CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Affected products: vendor: WWBN
product: AVideo
Published: 2022-08-22T18:30:26.991Z
CVE-2022-34654 WordPress Manage Notification E-mails Plugin <= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery (CSRF) in Virgial Berveling's Manage Notification E-mails plugin <= 1.8.2 on WordPress.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Virgial Berveling
product: Manage Notification E-mails (WordPress plugin)
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Credits: lang: en
value: Muhammad Daffa (Patchstack Alliance)
Published: 2022-11-28T19:30:09.979Z
CVE-2022-34655 TMM vulnerability CVE-2022-34655
In BIG-IP Versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.6.1, and 14.1.x before 14.1.5, when an iRule containing the HTTP::payload command is configured on a virtual server, undisclosed traffic can cause Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-457
description: CWE-457 Use of Uninitialized Variable
Affected products: vendor: F5
product: BIG-IP
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Published: 2022-08-04T17:47:31.214Z